Security Operations practice questions

Require a second signal such as new device, failed MFA, or mailbox rule creation

Combining identity anomalies reduces false positives.

Add trusted VPN egress ranges as named/known locations

Known corporate VPN egress can explain apparent travel.

Parent process name and command line

Parent context shows how execution began.

User and host identifiers

Identity and asset context support scoping and response.

Child process command line

Command line arguments reveal suspicious execution behaviour.

Database audit logs showing queried objects and accounts

Database logs reveal whether sensitive data was accessed before transfer.

NetFlow or proxy logs showing destination, volume, and timing

Flow/proxy data establishes transfer pattern and destination.

Suppress alerts only with documented criteria and expiry

Time-bound suppression preserves governance.

Add enrichment such as asset criticality and threat-intel context

Enrichment helps analysts prioritize real risk.

Unusual volume of TGS requests for many service principals

Kerberoasting often generates broad service-ticket requests.

Requests from a workstation that does not normally administer services

Abnormal source context increases suspicion.

Command line containing unusual DLL path or URL pattern

Command-line arguments distinguish abuse from normal use.

Image or process name matching rundll32.exe

The executed binary is central to the behaviour.

Cloud audit logs for secret-read operations

Secret-read events show what was accessed.

Recent role assignment or policy changes for the workload identity

Permission changes may explain new access capability.

Add domain age and lookalike/typosquatting checks

New and visually similar domains are common phishing indicators.

Use attachment sandboxing and URL detonation results

Dynamic analysis can reveal malicious behaviour beyond static lists.

Baseline query length, entropy, and subdomain uniqueness for the host

Tunnelling often creates abnormal label characteristics.

Compare query rate and destination domains against peer hosts

Peer comparison distinguishes normal service behaviour from outliers.

Threat intelligence reputation and first-seen date

Reputation and recency help judge maliciousness.

Internal asset and previous-seen telemetry

Internal context shows whether the destination is common or anomalous.

Volume and timing of queries to the same domain or name server

Regular high-volume queries support a tunnelling or beaconing hypothesis.

Query length and entropy compared with normal DNS traffic

Long, high-entropy labels can indicate encoded data in DNS queries.

The binary is normally administrative but launched from an unusual parent process

Parent context can indicate abuse of legitimate tools.

The command line performs download, encode, dump, or remote-execution behaviour

Suspicious arguments reveal malicious use of trusted tools.

Source distribution and timing of failed logons

Distributed or patterned failures suggest attack activity.

Whether one service account repeatedly fails after a password change

A single repeating account may indicate stale credentials.

Pod spec fields such as privileged mode, hostPath, and hostNetwork

These fields indicate high-risk container privileges.

Recent role binding or cluster role binding changes

Privilege changes may have enabled the action.

Check whether the destination and application protocol match the rule intent

Protocol and destination context help identify misfired signatures.

Inspect packet payload or session metadata around the alert

Traffic context can confirm whether the signature matched meaningful exploit content.

Reduction in analyst triage time for enriched alerts

Faster triage indicates operational value.

Percentage of enriched alerts with asset owner and criticality populated

Context completeness supports better prioritization.

Office document spawning a script interpreter from a user context

Office-to-script process chains are common initial execution patterns for phishing payloads.

Kerberoasting reconnaissance or ticket harvesting

Unusual TGS-REQ volume across service principals can indicate Kerberoasting activity.

MFA fatigue or push-bombing attack

Repeated unsolicited prompts that lead to approval are characteristic of MFA fatigue attacks.

Log normalization and field mapping in the parser

Detection rules depend on consistent normalized fields across sources.