CCNA Proactive Threat Detection Questions

DNS tunneling often encodes data in subdomain labels, resulting in unusually long and random-looking subdomains. Attackers use this to exfiltrate data or establish command-and-control channels. Frequent queries with long, high-entropy subdomains are a strong indicator of tunneling because legitimate DNS queries typically have shorter, meaningful names. This pattern is more specific than just high volume.

The Infrastructure axis of the Diamond Model describes the physical and logical assets adversaries use, including command-and-control servers, domains and channels. Examining it reveals the systems compromised hosts communicate with, directly answering the analyst's requirement.

Pass-the-Hash uses a stolen NTLM hash to authenticate without knowing the plaintext password. A key indicator is successful NTLM authentication to a remote host from a workstation where no interactive logon or credential prompt occurred. This mismatch between authentication success and user activity suggests the hash was used directly, which is the core behavior of Pass-the-Hash lateral movement.

Suppression rules scoped to known-good internal administration scanners remove predictable, benign scan traffic without disabling the signatures themselves, so genuine malicious activity on other hosts still triggers alerts. This cuts analyst triage volume while preserving detection coverage elsewhere.

Mapping existing log sources to high-prevalence ATT&CK techniques first reveals which common enterprise threats are already detectable and where telemetry gaps remain, directing coverage investment. This satisfies the stem's goal of maximising detection coverage proactively.

DNS resolver query logs provide a searchable, timestamped record of every query, including query name, type, and client. This is the primary data source for detecting DNS tunneling behavior such as high-volume TXT queries to a single external domain. Forwarding these logs to the SIEM enables fast aggregation and anomaly detection without manual packet analysis.

Event ID 4769 is logged when a Kerberos service ticket is requested. Encryption type 0x17 is RC4-HMAC, which is weak and commonly requested by Kerberoasting tools. Filtering for non-machine accounts with an SPN reduces noise from legitimate computer accounts. This combination directly identifies the behavior of requesting a crackable service ticket for a user account.

certutil.exe is a signed Microsoft binary abused for downloading payloads, decoding Base64 files, and installing certificates. Legitimate non-administrative use is rare, so its invocation by a standard user satisfies the stem's LotL detection constraint and warrants immediate investigation.

Beaconing malware typically communicates with its C2 server at fixed intervals (e.g., every 60 seconds) to check for instructions. These connections often have similar packet sizes and occur with clock-like regularity, which stands out from normal user traffic that is bursty and varied. This pattern is a strong, reliable indicator of automated C2 communication.

Low and slow exfiltration keeps each transfer small, so volume thresholds never trigger. Baselining normal outbound volume per host or destination and alerting on sustained deviations exposes the gradual, cumulative data movement that signature-based tools miss.

Kerberoasting requests service tickets for SPNs and cracks them offline. Event 4769 logs TGS requests; encryption type 0x17 (RC4-HMAC) is weaker and often used by attackers. Alerting on RC4 tickets for non-standard service accounts catches the attack while reducing noise from legitimate AES requests, making it the most effective detection.

Integrating IOCs into the SIEM as correlation rules enables real-time detection of known malicious IPs, domains, or file hashes. This is a standard proactive use of threat intelligence, turning static indicators into actionable alerts. It allows the SOC to detect and respond to threats that match the IOCs, directly supporting proactive defense.

DNS tunneling often uses TXT records to exfiltrate data because they can carry more data. Long, random subdomains indicate encoded data, and large responses suggest data is being returned. This combination is highly suspicious and not typical of normal DNS traffic.

Proxy logs capture outbound HTTP/HTTPS requests with timestamps, destinations, and user agents. Analyzing them for repeated requests to the same external domain at consistent intervals is a classic beaconing detection method. The regularity and repetition distinguish C2 from normal browsing. This source is directly relevant to identifying periodic command-and-control callbacks.

User-writable directories such as C:\Users\Public\ and C:\Windows\Temp\ let any unprivileged process drop and execute payloads, so a scheduled task pointing there signals attacker staging rather than a vendor update, which would run from Program Files or a signed system path.

STIX observable types (IP, domain, file hash) must be translated into the SIEM's own incident categories and severity levels, otherwise automated ingestion produces alerts that cannot trigger the internal response workflow. This mapping is the mandatory setting linking feed data to that workflow.

DNS tunneling encodes data in subdomain labels, producing many queries with long, random-looking (high-entropy) labels to a single domain. Volume and label entropy are strong indicators. This query captures the exfiltration pattern without flagging normal DNS traffic, making it the most effective proactive detection for tunneling.

Running a sweep queries historical endpoint telemetry for past occurrences of the IOC, revealing earlier compromises that point-in-time detection missed. This satisfies the proactive requirement by converting a single finding into retroactive hunting across the estate.

Stack counting command-line arguments across the estate reveals whether the encoded PowerShell pattern is rare or widespread, satisfying the need to distinguish malicious activity from routine administration. Legitimate administrative scripts recur predictably, whereas attacker tradecraft produces outliers; frequency analysis surfaces those deviations without relying on signature detection.

The 'Task To Run' field specifies the executable or command that the scheduled task launches. This is the most critical field because it reveals what the task actually does. Malicious tasks often run scripts, PowerShell commands, or binaries from unusual locations. By examining this field, an analyst can identify suspicious actions like encoded PowerShell or execution from temp directories, which are strong indicators of persistence.

Event ID 4104 is generated when a script block is executed and Script Block Logging is enabled. It contains the actual PowerShell code, including obfuscated or malicious scripts. This is crucial for proactive detection because it reveals the intent and functionality of scripts.

LSASS holds credential material, so unauthorised or unsigned processes requesting access to lsass.exe memory is the strongest behavioural indicator of credential dumping tools such as Mimikatz. It targets the specific access pattern rather than generic process or file activity.

Multi-stage correlation rules combine several weak or partial indicators before raising an alert, so isolated low-fidelity events no longer generate tickets. This raises the confidence threshold each alert must clear, directly improving the Signal-to-Noise ratio and reducing the alert fatigue described in the stem.

The Terminal Server Client Servers registry key stores the hostnames or IP addresses of systems to which the user has previously connected using the Remote Desktop Connection client. Each subkey represents a target, often with a MRU value. This is a reliable client-side artifact for identifying outbound RDP connections, including those to external IPs, during a proactive hunt.

PowerShell Script Block Logging writes Event ID 4104, capturing the full script block content executed, including de-obfuscated commands. This provides the deepest visibility into fileless PowerShell activity, unlike command-line auditing which may truncate or miss dynamically constructed code.

This approach applies the diamond model by capturing all four vertices—adversary, infrastructure, capability, and victim—and translating them into a detection rule. Correlating DNS queries with subsequent connections increases fidelity, reduces false positives, and creates reusable detection logic. It also enriches the SIEM with context, enabling proactive hunting for related infrastructure and behaviors beyond the single domain.

Kerberoasting requests service tickets for accounts with SPNs, often using weak RC4 encryption (0x17). Event ID 4769 logs Kerberos service ticket requests. A non-computer service account with RC4 encryption is suspicious because modern environments typically use AES. This combination strongly suggests an attacker is requesting a ticket to crack offline.

HKCU\Software\Classes\CLSID enables per-user COM hijacking: an attacker registers a malicious in-process COM server that loads whenever any application instantiates the hijacked CLSID, achieving persistence without admin rights. This satisfies the hunt's requirement to cover common registry persistence locations, since user-writable CLSID entries are a documented, frequently abused technique.

Kerberoasting tools often request RC4-encrypted TGS tickets because they are easier to crack. If service accounts are configured to support AES, a sudden RC4 request is anomalous. Event ID 4769 logs TGS requests; filtering for RC4 when AES is expected highlights potential Kerberoasting, as attackers downgrade encryption to simplify offline cracking.

Network traffic logs capture SMB and RDP sessions between workstations, revealing the connection patterns lateral movement produces. This satisfies the stem's requirement for detecting remote access techniques, since authentication logs alone may not show the network path used.

Indicators decay as attackers rotate infrastructure, so stale entries generate false positives. Automating expiry against the intelligence aging policy enforces the stem's actionability requirement by removing indicators once their validity window lapses, keeping SIEM detections current.

Beaconing produces periodic connections with low variance in inter-arrival times, whereas normal user traffic is bursty and irregular. Measuring variance in the time delta between consecutive connections to the destination IP exposes that regularity, reliably separating automated callbacks from genuine high-volume activity.