Certified Threat Intelligence Analyst (312-85) (312-85) — Questions 1–75

Integrating tactical intelligence directly into security tools like SIEM or TIP enables automated detection and response. This ensures that IOCs are immediately actionable, reducing the time between dissemination and mitigation. It aligns with the need for speed and accuracy in tactical operations.

A command-line execution sequence captures attacker behaviour in progress, such as suspicious process chains, rather than a static artefact left behind. IOAs focus on active tactics and techniques, distinguishing them from IOCs like file hashes or IP addresses.

DLL side-loading is a specific ATT&CK technique, so analysis must first determine the tactic it serves, then map to the precise Technique ID. This satisfies the stem's requirement for the analytical technique that correctly places the observation within the ATT&CK matrix.

IDS/IPS and firewall logs are machine-generated telemetry collected from technical infrastructure, making them technical threat intelligence sources. This satisfies the stem's 'Technical' category, distinguishing them from human-source categories such as OSINT, HUMINT or social media reporting.

Enrichment depends on consistent, deduplicated records. Parsing the JSON and validating required fields prevents malformed records from propagating. Normalizing indicator types ensures the same value is not treated as both a domain and a URL. Removing duplicates reduces wasted enrichment calls and prevents conflicting context. Performing these steps first produces a clean dataset, which is the prerequisite for reliable asset and geographic enrichment.

Threat modelling translates identified threats and their likelihood into concrete controls, producing security requirements proportionate to the application's risk profile. This satisfies the stem by ensuring requirements are derived from modelled threats rather than applied generically.

DNS tunnelling exfiltrates data by encoding it in DNS queries, commonly abusing TXT records because they carry larger payloads. A high volume of TXT queries to unusual domains therefore signals tunnelling far more strongly than ordinary A or PTR lookups.

Triaging, validating and prioritising the RFI against established intelligence priorities is the required first action once a request enters the RFI management lifecycle, ensuring collection effort aligns with the direction phase's defined requirements before any tasking occurs. This satisfies the stem's constraint that the request concerns a newly observed malware strain requiring assessment against current priorities.

STIX 2.1 is a standardized language for expressing cyber threat intelligence, and most TIPs support it for automated ingestion. It provides a common structure for indicators, relationships, and other objects, enabling seamless integration. Using STIX 2.1 ensures that the data can be parsed and ingested without manual reformatting, making it the most appropriate choice for this scenario.

Planning and Direction is the phase where intelligence requirements are defined based on the organization's needs, such as the SOC manager's request for a tailored threat landscape report. This phase ensures that collection and analysis efforts are aligned with specific objectives, preventing irrelevant or excessive data from being included.

Dark web forums often employ rate limiting to detect and block automated scraping. Using rotating proxies and randomized delays mimics human browsing behavior, reducing the chance of triggering these defenses. Without such measures, the tool's rapid, repetitive requests would be flagged, leading to an IP ban. This is the most likely cause and the appropriate mitigation.

Exploitation is the phase where the adversary takes advantage of a vulnerability to gain access to the target system. In this scenario, the adversary exploited a vulnerability in a public-facing web server to gain a foothold, which directly matches the Exploitation phase. This phase follows Delivery and precedes Installation. It is the moment the adversary's code executes on the victim's system, often via a remote exploit.

Script Block Logging (Event ID 4104) records the de-obfuscated script text even when the command line was obfuscated, so seeing DownloadString piped into Invoke-Expression with a hard-coded IP under a winword.exe parent is a strong, evidence-backed indicator of macro-based stager execution. The hunter has the actual code, the network destination, and the initiating parent, which together justify escalation rather than dismissal as benign administration.

TLP:RED restricts disclosure to the named recipients only, which satisfies the stem's constraint that a leak could cause irreparable damage. Unlike TLP:AMBER, which permits sharing within the recipient's organisation, RED forbids onward dissemination entirely, making it the sole marking appropriate for an unpatched zero-day of this severity.

Adversary is the actor or group responsible for the intrusion. It is a core feature of the Diamond Model. The analyst must identify the adversary to attribute the attack and understand their motivation. Along with capability, it completes the model when victim and infrastructure are known.

After a significant business change like a merger, stakeholder needs may shift. Re-interviewing key stakeholders ensures that the revised PIRs reflect the new business strategy and operational realities. This step is critical before modifying collection or analysis processes, as it directly addresses the alignment of intelligence requirements with evolving business goals.

Normalization is a core processing activity that standardizes indicators, such as converting IP addresses to a uniform notation or domains to lowercase. This ensures consistency and enables accurate correlation and enrichment. It is essential for preparing data for analysis and dissemination, making it a correct action for the processing phase.

Beaconing produces repeated connections at regular intervals with similar session durations and roughly symmetric or consistently sized payloads. These metadata patterns remain visible without decryption and can be baselined per host. Periodicity combined with destination reputation and payload size consistency is the standard method for finding C2 beacons in encrypted traffic.

This SIR is specific, measurable, and time-bound. It focuses on a particular threat actor, a specific vulnerability, and a defined asset (email servers) within a clear timeframe. This precision enables the analyst to collect and analyze relevant data efficiently and provides a clear answer that can inform mitigation decisions, directly supporting the organization's PIRs.

Indicators of Compromise list concrete artefacts such as file hashes, domains, IP addresses and registry keys. Incident responders use these to search local systems and logs, determining whether the malware variant is actually present, which is the report section that enables local detection.

The Command and Control phase is when the adversary establishes a communication channel with the compromised system. After delivery and exploitation, the attacker needs to control the malware. The scenario states the adversary is establishing a C2 channel, which directly matches this phase.

An executive summary translating the threat into potential business impact — financial, operational and reputational consequences — gives the C-suite the decision-relevant context they need. Technical indicators, IOCs and packet-level detail belong in analyst-facing sections, not board-level reporting.

Clearing Windows Event Logs is classified as Defense Evasion (Indicator Removal) because it erases forensic artefacts that defenders rely on. Destroying audit evidence impedes detection and investigation, matching the technique's defining trait of avoiding observation rather than gaining access.

PowerShell Script Block Logging records the actual script content executed in memory, which is essential because fileless malware leaves no executable on disk. It captures the malicious commands attackers run through PowerShell, providing the primary forensic evidence for such infections.

Increasing the specificity of EEIs helps filter out irrelevant data by clearly defining what information is essential. This reduces false positives by guiding collection tools to focus on precise indicators that directly answer the requirement. In this scenario, refining EEIs ensures that collection efforts are targeted, minimizing noise and improving the quality of intelligence.

Regular, low-volume, unidirectional UDP traffic to one external host at a fixed interval is a classic beaconing signature, since implants frequently poll their controller on a timer and receive little or no response payload. The small packet size and long duration further reduce the chance this is normal user activity. Treating it as a lead for endpoint and DNS analysis is the proportionate next step rather than assuming benign or confirmed compromise.

Pivoting on hosting infrastructure lets you group indicators that share an ASN or netblock, revealing which clusters are adversary-specific versus commodity CDN noise. By filtering clusters that also contain non-targeted victim domains, you remove indicators that lack discriminative value for this targeting question. This preserves the analytic integrity of the remaining data set before you assess consistency of targeting.

All-source intelligence is the integration of information from multiple sources, including internal telemetry and external feeds, to provide a comprehensive view. This term precisely describes the analyst's approach of combining SIEM data with commercial threat feeds. It emphasizes the holistic analysis of disparate sources to produce a unified intelligence picture.

Registered domains and fast-flux DNS form part of the Infrastructure axis because they are adversary-controlled resources used for delivery and command and control. Fast flux rapidly rotates IP addresses behind changing DNS records to complicate takedown and tracking. These domains are not the capability itself but the operational platforms that support it, making Infrastructure the correct Diamond Model classification.

Damage quantifies the potential harm an exploited vulnerability could inflict, covering data loss, service disruption and financial impact. Within DREAD's five scoring axes — Damage, Reproducibility, Exploitability, Affected users and Discoverability — it is the impact dimension, directly satisfying the stem's request for what the 'D' denotes.

Cloud assets are short-lived: instances, containers and serverless functions are created and destroyed rapidly, so indicators tied to IP addresses or hostnames expire quickly. This ephemerality undermines traditional long-lived indicator matching, making continuous discovery and contextual correlation necessary for cloud threat intelligence.

The most critical characteristic of a well-written intelligence requirement is that it supports a decision or action. This ensures relevance and prevents the collection of intelligence for its own sake. By linking to a decision, the requirement provides clear criteria for prioritization and helps analysts determine when the requirement is satisfied. It also facilitates communication with stakeholders.

TLP:AMBER permits sharing within the recipient's organization and with clients, but only on a need-to-know basis. This ensures the information reaches those who can act on it while limiting exposure. The partner's organization can further share with its own clients if necessary, but public release is not allowed. This handling respects the source's wishes and maintains operational security.

Using PowerShell with Base64 encoding is a technique (T1059.001 and T1027) within the Execution and Defense Evasion tactics. It describes a specific method the adversary uses to run code and avoid detection. This is a TTP because it reflects a behavioral pattern that can be detected and mitigated.

-WindowStyle Hidden suppresses the PowerShell console window, a technique attackers use to conceal malicious execution from the logged-in user. Legitimate administrative scripts rarely need to hide their window, making this parameter a strong indicator of suspicious activity in telemetry.

Enrichment adds contextual metadata like geolocation, WHOIS, and reputation scores to IOCs, enabling analysts to judge relevance, severity, and urgency. This helps prioritize which indicators to block or investigate first. For a financial firm, understanding the source and reputation of an IOC is critical before automated blocking, reducing business impact and false positives.

Defining specific intelligence questions ensures that collection efforts are focused and directly address the intelligence requirement. Without clear questions, the plan may gather irrelevant data. For APT actors targeting cloud infrastructure, questions might include which TTPs are used, what cloud services are targeted, and what indicators of compromise exist. This step aligns collection with the consumer's needs.

The `number_observed` property records how many times the observed data was seen, satisfying the need to quantify sightings of an indicator. STIX 2.1 defines it as an integer with a default of 1, making it one of the standard attributes characterising an Observed Data object alongside `first_observed` and `last_observed`.

Assessing product effectiveness ensures that intelligence outputs are relevant and actionable for stakeholders. If products are not meeting needs, requirements must be adjusted. This activity directly supports alignment with business objectives by validating that the intelligence program delivers value and informs decisions, and it identifies gaps or areas for improvement.

Relevance depends on whether the feed addresses threats your sector actually faces. An industry vertical focus ensures reported actors, tactics and vulnerabilities map to your operating environment, so analysts are not flooded with intelligence about unrelated sectors.

This approach is correct because it tailors the same report to multiple audiences by providing an executive summary for non-technical readers and detailed technical content for practitioners. It maintains clarity, ensures the TLP marking communicates sensitivity, and avoids duplication. This is a standard best practice in intelligence reporting to balance strategic and tactical needs without fragmenting the message.

Encrypted email to a specific contact ensures the report reaches only the intended recipient and protects it in transit. This method aligns with TLP:AMBER or TLP:RED requirements, as it limits access. It is a standard secure dissemination method for sensitive threat intelligence to trusted partners. Encryption prevents interception, and targeting the contact avoids unintended recipients.

Processing converts raw collected data into a structured, analyzable format. Normalizing timestamps, removing duplicates, translating content, and enriching IPs with geolocation are all classic processing tasks that prepare data for the Analysis and Production phase. The scenario describes exactly this transformation pipeline, which sits between collection and analysis in the intelligence lifecycle.

The Admiralty Code pairs a letter for source reliability with a digit for information credibility. A denotes a highly trusted source, and 1 denotes information confirmed by multiple independent sources, so the verified partner report is graded A1.

In the Diamond Model, Capability refers to the tools, techniques, and malware used by the adversary. A custom backdoor is a distinctive capability that can serve as a pivot point to correlate with other incidents where the same or similar tool was used. This helps attribute activity to a specific threat group by matching their toolset.

Process Explorer displays running processes in a hierarchical tree, showing each process's parent and children, which directly reveals process lineage during a hunt. This parent-child visualisation exposes suspicious spawning relationships that flat process listings or network-focused tools cannot show.

Structured formats like STIX/TAXII or CSV enable automated ingestion into security tools, allowing the SOC to rapidly deploy detections. This method minimizes manual effort and errors, and supports real-time updates. It aligns with best practices for tactical intelligence sharing, ensuring IOCs are actionable immediately. Direct push to TIP or SIEM streamlines the process.

Dissemination and feedback closes the intelligence cycle by returning consumer responses to planners, so revised requirements reflect actual business needs. During a formal review, that feedback loop directly informs the direction and planning phase, ensuring collection priorities stay aligned with changing goals rather than static assumptions.

T1547.001 specifically covers Registry Run Keys, which load programs automatically at user logon. Writing to the HKLM Run key establishes persistence machine-wide, matching the stem's custom script exactly. Other T1547 sub-techniques address different autostart locations, such as Startup folders or Winlogon helpers, so they do not fit this registry path.

Threat-Actor is a valid STIX 2.1 Domain Object, representing an individual, group or organisation believed to be acting with malicious intent. It sits alongside other SDOs such as Malware and Attack-Pattern within the STIX 2.1 data model.

Threat actor aliases sit within the Adversary vertex, which describes the actor conducting the intrusion. Aliases are the alternate names by which an adversary is tracked, alongside the operator and customer roles that the vertex also encompasses.

Timeliness measures latency: how quickly intelligence about a threat becomes available after that threat first occurs or is observed. A short interval means defenders can act before exploitation spreads, so this attribute directly quantifies the freshness gap the stem asks about.

Different stakeholders require different levels of detail. Executives need business impact and strategic context, while technical teams need IOCs and TTPs. Tailoring the content ensures the intelligence is actionable and understood. This practice is fundamental to effective dissemination and is emphasized in threat intelligence frameworks. Without tailoring, reports may be ignored or misused, reducing their value.

File hashes are cryptographic fingerprints of known malicious files, so matching one against a scanned file confirms prior compromise. This satisfies the IOC definition: it is forensic evidence indicating an intrusion already occurred, unlike a vulnerability or a preventive control.

The Z-score expresses how many standard deviations each timestamp lies from the distribution mean, giving a normalised threshold for judging whether an observation is statistically unusual. Applying it to the timestamp distribution identifies which outliers are significant enough to justify revising threat modelling.

PIRs are the primary output of the direction phase and directly articulate the intelligence needs tied to strategic decision-making. They ensure collection and analysis efforts are aligned with the organization's critical assets and business objectives, enabling efficient resource allocation. In this scenario, the CISO's focus on critical assets and strategic decisions makes PIRs the essential first step.

Scheduled task creation leaves two complementary traces: the schtasks.exe command line and the task definition file written under the Tasks directory. Correlating process creation with the subsequent file creation ties the actor to the artifact and enables detection even when the command line uses unusual arguments. This pairing gives the hunter both the mechanism and the persistence artifact, which is the most direct coverage available with the deployed configuration.

TLP:GREEN allows sharing within the community, which includes peers and partner organizations, but not public release. This enables wide but controlled dissemination to those who can benefit from the information while preventing exposure to untrusted parties. It is suitable for information that can be shared broadly but not openly.

Event ID 4104 in the Microsoft-Windows-PowerShell/Operational log records script block logging, capturing the de-obfuscated script text after PowerShell decodes the Base64 -EncodedCommand payload. The engine log (400/800) only shows the encoded string, so 4104 is the provider that reveals actual content.

Reconnaissance is the first phase of the Cyber Kill Chain and involves harvesting information about the target, such as employee names, email addresses, and technical infrastructure. The scenario explicitly states the adversary spent weeks performing open-source research on employees and infrastructure before any exploitation, which maps directly to this phase. No payload, delivery, or exploitation activity is described, confirming this is the correct phase.

Directory service authentication records tie an account to the client address that requested the ticket or bind, providing an independent view of the same movement. When host logs are incomplete or cleared, these records often preserve the account-to-source mapping. Together with endpoint logon events they corroborate the direction and sequence of lateral authentication.

A 403 during an HTTPS pull means the provider received the request but refused it, so authentication and connectivity are working. Verifying that the connector's source IP is whitelisted on the provider side addresses the authorisation constraint causing the rejection.

The direction phase translates stakeholder decision needs into a prioritized set of intelligence requirements that guide all subsequent collection and analysis. Producing that approved, prioritized requirements set is precisely the output the CISO is asking for, because it tells the team what questions matter most before any collection begins.

Industry-specific ISACs and regulatory compliance bodies supply sector-tailored threat intelligence, attack patterns and reporting obligations that generic sources omit. Consulting them directly satisfies the stem's requirement for accurate sector-specific threat requirements, since these bodies coordinate real incidents and mandates within the organisation's own sector rather than broad, cross-industry data.

Tunnelling exfiltration data inside DNS queries or HTTP/S requests blends with permitted traffic, so volume and payload inspection reveal misuse. This satisfies the stem's anomaly criterion because the protocol itself is expected, but its unexpected purpose and payload pattern are not.

Get-ScheduledTask queries the Task Scheduler service and, combined with the -CimSession parameter, enumerates scheduled tasks on remote hosts, enabling enterprise-wide auditing for unauthorised entries. It returns task definitions including actions and triggers, exposing persistence mechanisms hidden in the scheduler.

Pivot tables enable analysts to quickly summarize and cross-tabulate large datasets, making it easier to spot trends, outliers, and relationships between variables like source IP and event type. This is essential for threat hunting and incident analysis, as it helps prioritize investigations and identify anomalies efficiently.

The Strategic Threat Intelligence Analyst interprets long-term threat trends and adversary intent, converting them into business risk language and prioritisation for executives and board members. This translation of high-level intelligence into strategic risk satisfies the stem's requirement for board-level reporting.

Filtering by confidence occurs in the TAXII client, since TAXII 2.1 servers expose collections without a standard confidence query parameter. The client inspects each STIX object's confidence property and discards low-confidence indicators before ingestion, satisfying the requirement to retrieve only high-confidence indicators from the feed.

Port 445 carries SMB directly over TCP, the channel PSExec and similar tools abuse for remote service creation and lateral movement. Monitoring 445 for anomalous internal connections exposes unauthorised admin shares and credential relay activity.

A custom CSV mapping template in the Import module lets you bind each source column to its MISP attribute type and category, so the Category field is parsed from your file rather than falling back to the default Network activity. Saving the template makes this mapping persist for all future imports, satisfying the efficiency constraint.

The review phase involves assessing whether the intelligence requirements still support the organization's goals. Business objectives can change, making some PIRs obsolete. Evaluating their relevance ensures that the program continues to deliver value and adapts to new priorities. This is a core activity of the review phase, distinct from planning and direction.

A board-level brief connecting a regulatory change to organizational exposure and intelligence priorities is strategic. It speaks to governance, risk appetite, and long-term prioritization rather than to any single intrusion. Strategic products often draw on non-cyber drivers such as law, economics, and geopolitics, and they are consumed by executives who set direction rather than by analysts who hunt threats.

A periodic review should evaluate the continued relevance of each requirement and the effectiveness of collection. Inactive requirements may be obsolete or may indicate collection shortfalls. By assessing both relevance and collection, the team can make informed decisions to revise, retire, or enhance collection. This ensures the program remains aligned with decision-maker needs and resources are used efficiently.

Establishing key intelligence questions ties collection directly to the assets and risks the bank actually cares about, which is the foundation of the Planning and Direction phase. Without these requirements, feed selection and analysis become unfocused and unmeasurable. This step must precede tooling or feed acquisition because it defines what 'relevant' means for this specific organization.