Threat Hunting And Detection

A threat hunter wants to identify unauthorized DNS tunneling. Which data point is most indicative of this activity?

A threat hunter is reviewing PowerShell operational logs collected via Windows Event Forwarding and notices Event ID 4104 entries that contain a script block defining a function which, when invoked, calls System.Net.WebClient.DownloadString with a hard-coded IP address and then passes the returned content to Invoke-Expression. The parent process is winword.exe. Which hunting conclusion is most defensible?

A threat hunter is asked to determine whether a suspected intrusion involved beaconing over HTTPS to an external command-and-control server. The organization has full network metadata but no TLS interception. Which hunting approach is most appropriate to identify beaconing behavior without decrypting traffic?

Which TWO artifacts are most important when investigating a possible 'Fileless Malware' infection?

Which TWO command-line parameters are highly suspicious when observed with 'powershell.exe' in your telemetry?

Which tool is most effective for visualizing the parent-child process relationships during a threat hunt?

A threat hunter wants to detect adversary use of scheduled tasks for persistence on Windows endpoints and has Sysmon deployed with a configuration that includes process creation and file creation events. Which approach gives the most direct and reliable detection coverage for newly created scheduled tasks?

During an investigation, you observe suspicious PowerShell execution with the -EncodedCommand flag. Which log provider should you consult to see the decoded script block content?

You are hunting for unauthorized scheduled tasks. Which PowerShell cmdlet allows you to audit these tasks remotely across the enterprise?

An analyst is hunting for unauthorized network connections. Which port is commonly associated with SMB, frequently used for lateral movement (e.g., PSExec)?

Which hunting methodology involves starting with a known adversary tactic and working backward to identify evidence in your logs?

A threat hunter is examining network flow data to detect potential lateral movement using the SMB protocol. The hunter notices a series of connections from a single workstation to multiple servers on port 445, each followed by a short-lived session. Which analysis technique would best help identify this as malicious lateral movement?

A threat hunter wants to detect adversaries abusing the Windows Management Instrumentation command-line utility to execute code on remote hosts during a hunt for lateral movement. Which artifact should the hunter prioritize to identify the remote execution attempt on the target machine?

A threat hunter is examining Sysmon telemetry on a workstation and sees an svchost.exe process whose image path is C:\Users\Public\svchost.exe, whose parent is explorer.exe, and which has an unsigned binary with no version information. Which hunting assessment is most appropriate?

A threat hunter is reviewing Sysmon logs to detect potential credential dumping via LSASS memory access. Which Sysmon Event ID should the hunter prioritize to identify suspicious access to the lsass.exe process?

A threat hunter is investigating a suspected data exfiltration over HTTPS. The hunter has full network traffic capture and wants to identify potential exfiltration channels. Which two characteristics are most indicative of malicious exfiltration over HTTPS? (Choose two.)

You are hunting for Cobalt Strike C2 using JA3/JA3S fingerprinting. If the JA3S value is unique for your environment and observed across multiple hosts, what does this suggest?

Which TWO log sources are most essential when hunting for adversary use of living-off-the-land binaries (LotL)?

During a threat hunt for Kerberoasting, an analyst reviews Windows Security event logs and notices Event ID 4769 (Kerberos service ticket request) entries with RC4 encryption (0x17) for multiple service principal names from a single user account within a short window. Which additional context is most important to confirm malicious intent rather than benign service access?

While hunting for living-off-the-land (LotL) binaries, you identify suspicious use of 'certutil.exe'. What is the most likely malicious purpose for this utility?

A threat hunter is analyzing Windows event logs to detect an adversary using scheduled tasks for persistence. The hunter wants to identify tasks created with a hidden setting. Which event ID and field should the hunter focus on?

Which TWO file integrity monitoring (FIM) events would be most useful to detect potential unauthorized persistence mechanisms?

A threat hunter is investigating a suspected Kerberoasting attack. Which Windows event ID should the hunter analyze to identify service tickets being requested for accounts with Service Principal Names (SPNs)?

A hunter is investigating anomalous DNS activity on an internal resolver. Several endpoints are issuing high volumes of queries for long, random-looking subdomains under a single registered domain, with responses that are mostly NXDOMAIN but occasionally resolve. Which TWO detection approaches would most effectively confirm whether this is DNS tunneling or domain generation algorithm activity? (Choose two.)

A hunter is reviewing Zeek conn.log and notices long-lived, low-volume TLS sessions from several internal workstations to the same external IP on port 443 where the server certificate is self-signed, the JA3S value is identical across all sessions, and the byte counts are almost symmetric over hours. The workstations show no matching DNS queries for that IP and no proxy logs because the traffic bypasses the proxy. Which hypothesis best fits this evidence?

An analyst is investigating potential persistence via WMI event subscriptions. Which WMI namespace should the hunter focus on for suspicious event consumers?

A threat hunter reviewing Windows Security event logs notices that a service account's credentials were used to authenticate to 14 workstations within a 3-minute window, all successful logons with Logon Type 3. No scheduled tasks or administrative scripts are known to run under this account. Which hypothesis best explains this pattern and should drive the next hunt step?

When hunting for credential dumping using Mimikatz, which process memory access pattern is the most common indicator?

A threat hunter is investigating possible data staging prior to exfiltration on a file server. The hunter has full Windows Security auditing, Sysmon, and PowerShell logging available. Which TWO telemetry patterns most directly indicate that an adversary is staging and compressing collected data on the host? (Choose two.)

A threat hunter is reviewing DNS logs to detect potential domain generation algorithm (DGA) activity. Which characteristic is most indicative of a DGA-generated domain?

When hunting for lateral movement, which THREE activities should be flagged as highly suspicious in a Windows environment?

Which THREE indicators are strong evidence of a 'Pass-the-Hash' attack occurring in your network?

While using ELK Stack for threat hunting, you need to identify beaconing behavior. Which aggregation function would best reveal periodicity in connection intervals?

A threat hunter is investigating a suspected data exfiltration channel that uses DNS tunneling. The organization's DNS logs capture query names, query types, response codes, and source hosts, but not full packet payloads. Which TWO characteristics of the DNS queries would most reliably indicate tunneling activity rather than normal DNS behavior? (Choose two.)

A threat hunter is reviewing DNS query logs from a corporate recursive resolver to identify hosts that may be beaconing to a domain generation algorithm (DGA) family. The hunter notices that one workstation generates many queries for short, random-looking domains that all fail with NXDOMAIN, while another workstation generates far fewer queries but with a consistent subdomain string appended to a long-lived domain. Which observation most strongly indicates an active DGA-based beacon rather than normal application behavior?

A hunt for unusual Kerberos activity reveals an 'AS-REP Roasting' attack. What specific event indicator should the analyst look for in domain controller logs?

A threat hunter is reviewing Sysmon event logs to detect credential dumping. The hunter observes that a process opened lsass.exe with access rights 0x1410 and then created a memory dump file. Which Sysmon event ID and field combination is most directly relevant for detecting this activity?

A threat hunter is examining network traffic to identify potential command-and-control (C2) communication. Which characteristic of the traffic is most indicative of a C2 channel using HTTP?