Threat Hunting And Detection

Which THREE techniques are commonly associated with the 'Execution' phase of the MITRE ATT&CK framework and should be prioritized in a threat hunt?

A threat hunter wants to identify unauthorized DNS tunneling. Which data point is most indicative of this activity?

When hunting for malicious DLL side-loading, which file property is most critical to verify?

Which TWO artifacts are most important when investigating a possible 'Fileless Malware' infection?

Which TWO command-line parameters are highly suspicious when observed with 'powershell.exe' in your telemetry?

Which tool is most effective for visualizing the parent-child process relationships during a threat hunt?

During an investigation, you observe suspicious PowerShell execution with the -EncodedCommand flag. Which log provider should you consult to see the decoded script block content?

You are hunting for unauthorized scheduled tasks. Which PowerShell cmdlet allows you to audit these tasks remotely across the enterprise?

An analyst is hunting for unauthorized network connections. Which port is commonly associated with SMB, frequently used for lateral movement (e.g., PSExec)?

A threat hunter is using Sysmon to identify potential process hollowing. Which Event ID should the analyst prioritize in their hunting query?

Which hunting methodology involves starting with a known adversary tactic and working backward to identify evidence in your logs?

To effectively hunt for C2 communication, which THREE indicators should be monitored in your proxy or firewall logs?

You are hunting for Cobalt Strike C2 using JA3/JA3S fingerprinting. If the JA3S value is unique for your environment and observed across multiple hosts, what does this suggest?

Which TWO log sources are most essential when hunting for adversary use of living-off-the-land binaries (LotL)?

While hunting for living-off-the-land (LotL) binaries, you identify suspicious use of 'certutil.exe'. What is the most likely malicious purpose for this utility?

Which TWO file integrity monitoring (FIM) events would be most useful to detect potential unauthorized persistence mechanisms?

An analyst is investigating potential persistence via WMI event subscriptions. Which WMI namespace should the hunter focus on for suspicious event consumers?

When hunting for credential dumping using Mimikatz, which process memory access pattern is the most common indicator?

When hunting for lateral movement, which THREE activities should be flagged as highly suspicious in a Windows environment?

Which THREE indicators are strong evidence of a 'Pass-the-Hash' attack occurring in your network?

While using ELK Stack for threat hunting, you need to identify beaconing behavior. Which aggregation function would best reveal periodicity in connection intervals?

When conducting a hunt for 'Golden Ticket' attacks, which attribute should be checked for anomalies in the Kerberos ticket?

A hunt for unusual Kerberos activity reveals an 'AS-REP Roasting' attack. What specific event indicator should the analyst look for in domain controller logs?