CCNA Perform threat hunting Questions

Anomalous logon location is one of the built-in hunting queries in Microsoft Sentinel, found in the Hunting blade. It uses KQL to analyze sign-in logs, detecting attempts from unexpected geographies or IP addresses, which may indicate compromised credentials or impossible travel. This query is part of Sentinel's predefined hunting pack and is a strong indicator of credential misuse.

This query correctly isolates the last 24 hours of activity, groups events by each caller (user or service principal) and by one-hour time bins, and then computes the distinct count of Resource values—the full Azure resource IDs—for each group. The filter dcount_Resource > 20 surfaces users that accessed an unusually high number of distinct Azure resources within a single hour, a pattern consistent with an attacker rapidly enumerating the environment to find high-value targets. This approach balances sensitivity and performance, and it directly maps to the MITRE ATT&CK technique T1087 (Account Discovery) or T1526 (Cloud Service Discovery) when run as a scheduled Sentinel analytics rule.

IdentityLogonEvents captures only on-premises Active Directory and AD FS authentication, not cloud sign-ins. Azure Portal logons are recorded in Microsoft Entra ID sign-in logs, surfaced in Microsoft Defender for Cloud Apps through the AADSignInEventsBeta table. Querying the wrong table explains the empty result despite known portal logons.

Checking for access to applications outside a user's historical usage is a high-fidelity indicator of identity compromise because attackers rarely mimic the exact application footprint of the legitimate user. In Microsoft Sentinel, you can use UEBA data or sign-in logs to build a baseline and then alert when a newly logged-on application has no prior events for that user. This type of anomaly is less likely to be a false positive than raw volume-based signals, because it directly reflects the attacker's post-authentication intent.

Investigating entities found in the query results is a defining threat-hunting action because it requires pivoting from raw data to the entity pages for users, devices, files, IPs, or mailboxes, then reviewing timelines, related alerts, and correlated events to decide whether the behavior is genuinely malicious. This validation step is what confirms or refutes the original hypothesis and reveals the scope of the threat. Without entity-level investigation, a hunter cannot distinguish a true positive from a benign anomaly or a false positive.

Hunting queries in the Microsoft Sentinel hunting blade let analysts proactively search logs for indicators such as PowerShell encoded commands, matching the requirement to seek out a known threat actor's techniques rather than wait for an alert.

IdentityLogonEvents records authentication activity across Microsoft Entra ID and on-premises identity infrastructure, including logon type, application and failure reasons. This makes it the appropriate table for surfacing anomalous or suspicious logon patterns indicative of credential theft.

Connecting Microsoft 365 data sources is essential because Microsoft Sentinel hunting queries must run against ingested telemetry from these connectors. Office 365 and Entra ID provide audit logs, sign-in logs, and email/Teams activity, and Defender for Cloud Apps adds SaaS shadow IT and session data. Without these sources, KeyVault events, IdentityInfo, and other UEBA-dependent tables remain empty, so hunting for malicious user behavior is impossible.

Microsoft Entra ID audit logs record sign-in and directory change activity, and Microsoft Sentinel ingests them through the Entra ID data connector. They surface authentication anomalies and privilege changes, giving threat hunters a native identity-based data source for correlating suspicious account behaviour across the environment.

DeviceNetworkEvents is the correct table for C2 hunting because it specifically records network connection attempts, including source and destination IP addresses, ports, protocols, and remote URLs. Unlike file or process events, this table lets you directly search for outbound connections to known malicious or suspicious infrastructure, which is the core signature of command-and-control communications. Without this telemetry, you cannot definitively identify the network egress point to a C2 server.

The Anomalous Azure Operations rule is a built-in Microsoft Sentinel analytics rule that uses machine learning to analyze AzureActivity logs and flag unusual operations within an Azure subscription, such as atypical role assignments, resource deployments, or modification of critical settings. Unlike other anomaly rules, it specifically targets the Azure control plane and is driven by the AzureActivity data connector. This rule is the correct choice for a threat hunter seeking to uncover abnormal Azure subscription operations.

Ransomware communicates with C2 servers for key exchange.

The summarize operator aggregates log data, allowing you to count failed logons grouped by IP address within a five-minute bin. This produces the per-IP threshold needed to trigger the anomalous failed-logon alert in Microsoft Sentinel.

Saved custom KQL queries in the Hunting blade let analysts run reusable, scheduled or ad hoc searches across Sentinel's Log Analytics workspace, directly satisfying the requirement for a valid threat-hunting method rather than relying solely on automated analytics rules.

HackTool is the correct classification because detection ID 2147723152 corresponds to a known hacking utility, which Defender categorizes under the HackTool threat type. These tools are commonly used for privilege escalation, credential dumping, or lateral movement, and their detection is based on file signatures and behavior analytics. The alert's ID directly maps to this family, confirming the verdict.

Consent to application records the OAuth grant event, capturing the user, the application and the scopes requested. This directly satisfies the stem's requirement to detect a malicious app granted high privileges by a user, since the consent activity surfaces the permission grant itself rather than later API usage.

The AzureActivity table records control-plane operations, so filtering on HttpMethod == 'PUT' isolates resource creation and update calls. Summarising by CallerIpAddress with bin(TimeGenerated, 1h) surfaces anomalous IP addresses and off-hours spikes, directly satisfying the requirement to hunt suspicious Azure Resource Manager resource-creation activity.

DeviceNetworkEvents captures outbound and inbound connection attempts, including connections to TCP port 445, which is used for SMB file sharing to remote admin shares. Lateral movement techniques such as PsExec generate distinctive network connections to hosts on port 445 or any high-order port, making this telemetry among the most relevant for detecting an attacker pivoting across systems. The source IP, destination IP, and port data directly expose the network-level footprint of a move.

DeviceFileEvents records file creation and modification activity with SHA256 hashes, including quarantined items, so filtering on the known hash returns every device that encountered the file regardless of location. This satisfies the requirement to include quarantined detections.

The contains operator checks for a substring anywhere in the string, so it will match command lines that include 'net user' even if there are additional arguments. This is appropriate for detecting the execution of 'net user' because the command may appear with various parameters. However, be aware that contains is case-insensitive and can be slower than has on large datasets.

Microsoft Entra ID is correct because this data connector streams both sign-in logs and audit logs into Microsoft Sentinel via diagnostic settings. The sign-in logs include interactive, non-interactive, service principal, and managed identity sign-ins, with rich details like MFA result, Conditional Access policy, and risk level. This comprehensive authentication telemetry is exactly what a threat hunter needs to detect unusual or malicious cloud sign-in behavior.

Excluding known DNS servers reduces noise from legitimate traffic.

DeviceEvents includes various event types, and the ActionType 'WmiProcessCreate' specifically logs process creation via WMI. This is a direct signal of WMI-based process execution, which is exactly what you need to detect lateral movement. Querying DeviceEvents for this action type will surface relevant events without relying on parent process inference.

Microsoft Defender for Identity alerts only flow to Microsoft Sentinel when the tenant has the appropriate license, such as Microsoft Entra ID P2 (or a Microsoft 365 E5 license) that includes the MDI service plan. Without this license, the connector may show a healthy status but will not forward MDI alerts to the SecurityAlert table. This is a well-known licensing prerequisite and the most likely reason for the symptom.

The EmailEvents table in Microsoft 365 Defender Advanced Hunting is the primary source for email metadata, including the sender, recipient, subject, and message ID (NetworkMessageId). It also records delivery status (Delivered, Blocked, Failed) and detection verdicts for malware, phishing, and spam. This table is essential for hunting email-borne threats because it allows you to filter by specific senders or recipients, inspect message disposition, and correlate with other email and identity tables.

This query correctly targets the DeviceProcessEvents table in Microsoft Defender XDR advanced hunting, filters for the process name certutil.exe, and uses has_any to match either of the suspicious arguments. Because DeviceProcessEvents captures process creation events with full command lines, it is the appropriate table for detecting this behavior. The has_any operator efficiently checks for multiple substrings in the command line, making it ideal for this scenario.

Downloading hundreds of files from SharePoint Online in a short period matches mass-download behaviour that Defender for Cloud Apps flags as potential exfiltration. The volume and compressed timeframe satisfy the suspicious-activity constraint in the stem, unlike routine single-file access, making it the strongest hunting query candidate.

A hypothesis must state what the adversary is trying to achieve, since the goal directs which behaviours, telemetry and queries the hunter pursues. Without an objective, hunting lacks a testable premise and becomes unfocused data review.

SigninLogs holds Microsoft Entra ID interactive sign-in events with UserPrincipalName and IPAddress, so filtering the last 24 hours and summarising by IPAddress satisfies the requirement to enumerate distinct source addresses for that user. AADNonInteractiveUserSignInLogs would not match interactive portal sign-ins.

Reviewing all failed attempts from that IP in the Activity log reveals the pattern, volume and targeted accounts, confirming whether the behaviour constitutes brute-force credential guessing rather than isolated user error. This evidence-based correlation is the most effective next investigative step.

The endswith operator checks if a string ends with a specified suffix. Using endswith '.locked' on the FileName column will accurately identify files that have been renamed with the '.locked' extension, which is characteristic of ransomware encryption. This operator is case-insensitive and efficient for this purpose.

DeviceNetworkEvents records network connection events from onboarded endpoints, including DNS query details and remote addresses. This makes it the primary table for spotting DNS tunnelling patterns such as high-volume or encoded queries to suspicious domains.

The Microsoft Entra ID data connector ingests sign-in and audit logs into Microsoft Sentinel, supplying the identity events UEBA analyses for anomalous behaviour detection. Enabling it is required before UEBA can surface risky sign-in activity.

Incorporating threat-feed indicators of compromise lets queries match observed malicious artefacts—IP addresses, domains, file hashes—against telemetry already ingested in Microsoft Sentinel, satisfying the stem's requirement for effective hunting queries. This converts external threat intelligence into concrete detection logic, surfacing known adversary infrastructure without waiting for an alert to fire.

Office 365 audit logs capture Exchange mailbox rule creation and modification events, including Set-InboxRule operations that forward mail externally. Querying this source in Microsoft Sentinel surfaces users who configured external forwarding, matching the exfiltration hunt.

join is correct because the KQL join operator correlates rows from two tabular expressions on one or more equality conditions (keys), returning rows that contain columns from both sides. For example, joining SigninLogs with AADAuditLogs on UserId or IP address lets you see a logon event and the subsequent activity side by side, which is exactly the kind of key-based matching needed when hunting across heterogeneous data sources. You can control the output with join kinds such as innerunique, inner, leftouter, and rightouter to tailor the hunt to your hypothesis.

The lookup operator enriches a fact table by pulling values from a dimension-style table based on equality of specified keys, using left-outer semantics that preserve the left side's row count and only add columns. This is essential in threat hunting for attaching authoritative context—such as user names, asset owners, or threat-intel tags—to raw events without the risk of row multiplication. Unlike join, lookup is optimized for dimension-style, one-to-many enrichment and is a common choice when the goal is to decorate events with descriptive attributes.

Microsoft Defender for Endpoint supplies the device telemetry that Sentinel's advanced hunting and C2-related tables query. Without onboarding, those devices emit no events, so the KQL query returns nothing despite the malicious IPs being active.

DeviceNetworkEvents is the Advanced Hunting table designed to capture network connection attempts, including local/remote IPs, ports, protocol, and connection state. Critically, it includes the initiating process information (InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine), so you can directly attribute the outbound connection to the user's dev process. This makes it the correct choice when the analyst needs the process responsible for an outbound connection.

Adding filters that match suspicious certutil command-line patterns—such as '-urlcache', '-split', or '-decode'—directly targets the known malicious usage of this tool while ignoring routine certificate work like CRL checks and certificate store queries. In KQL, you would combine the process image with a condition on the command line, for example: where ProcessCommandLine contains "certutil" and (ProcessCommandLine contains "-urlcache" or ProcessCommandLine contains "-split"), to isolate the payload-download behavior. This is far more precise because legitimate administrators rarely invoke certutil with these file-handling switches, especially in conjunction with a remote URL, so the false-positive rate drops dramatically while detection fidelity remains high.

The DeviceProcessEvents table records process creation events, including command lines and file hashes, across all onboarded devices. Searching by the script's SHA256 hash or command-line pattern identifies every server where the same PowerShell execution occurred, directly satisfying the requirement to find other compromised servers efficiently.

DeviceNetworkEvents contains network connection events from devices, including the remote IP address. Filtering by RemoteIP equal to the malicious IP and a timestamp within the last 30 days will return all devices that communicated with that IP. This is the correct table and fields for this purpose. The Timestamp field is used for time filtering in Advanced Hunting, and the query is straightforward and effective.

DeviceNetworkEvents records outbound and inbound connection attempts per device, including remote IP addresses, ports and the initiating process. Correlating these events against threat intelligence identifies processes connecting to known malicious IPs, satisfying the hunt requirement.

ProcessCommandLine contains the full command line, including the -EncodedCommand parameter and the base64 string attackers use to hide their payload. This is the primary field to inspect when hunting for obfuscated PowerShell, as the encoded blob is present verbatim. In Microsoft 365 Defender's DeviceProcessEvents, this field enables decoding and further analysis, making it the directly relevant column.

The query calls an external data source, so its reliability and latency depend on that service rather than Microsoft Sentinel's own log store. If the source is unavailable or slow, the hunt returns incomplete or delayed results, unlike queries against native workspace tables.

Defender for Endpoint's DeviceLogonEvents table captures endpoint-level authenticated logon telemetry, including both successful and failed attempts, along with key contextual fields such as logon type, source IP, and the executing process. This makes it invaluable for detecting lateral movement, because it exposes patterns like a single account authenticating to many devices in a short time or unusual logon types (e.g., network logons) that indicate credential reuse. As a native hunting table in Microsoft 365 Defender, it enables queries that directly correlate logon activity with endpoint alerts and device risk indicators.

SecurityEvent carries Windows logon events, including 4624, 4625 and 4648, exposing failed logons, explicit credential use and unusual logon types. These fields let hunters detect anomalous authentication patterns across on-premises and domain-joined systems forwarded to Microsoft Sentinel.

Aggregating DeviceFileEvents by device, initiating process and five-minute bins, then filtering counts above 100, directly surfaces mass file modification — the ransomware encryption signature. Grouping by InitiatingProcessFileName attributes the burst to a specific process, satisfying the stem's requirement to identify rapid, high-volume encryption activity.

A burst of failed logons immediately followed by a success from the same IP signals credential brute-forcing or hash reuse, matching the pass-the-hash pattern where stolen NTLM hashes authenticate without knowing the plaintext password. Defender for Identity surfaces this sequence as suspicious authentication behaviour worth hunting.

AADSignInEventsBeta records Microsoft Entra ID sign-in events, capturing interactive and non-interactive authentication attempts with user, application, device and conditional access details. This directly satisfies the stem's requirement for user authentication data, complementing IdentityLogonEvents, which covers on-premises Active Directory authentication rather than cloud sign-ins.

Ingesting Windows Security Event ID 4624 into a Log Analytics workspace lets the hunter join those sign-in events with SigninLogs on account name and timestamp, correlating the on-premises server compromise with the Microsoft 365 sign-in from the new IP.

DeviceEvents includes various event types, such as WmiProcessCreate, which specifically logs process creation via WMI. This table captures the WMI provider host process, the command line, and the remote caller, allowing you to detect remote WMI process creation. Querying DeviceEvents for ActionType == 'WmiProcessCreate' is the correct approach for this scenario.

This is the most plausible reason: in a KQL inner join, only rows with matching keys are returned. If the ThreatIntelligenceIndicator table contains no indicators with an Active status that equal any of the observed RemoteIP values, the joined result set will be empty by design. Indicators that are expired or have another status are filtered out, and the TI lookup data may simply not include the IPs the devices are connecting to. This aligns with the classic behavior where an inner join produces zero rows when the right side lacks matches.

The user entity is the core anchor for UEBA in Microsoft Sentinel, enabling the engine to build a behavioral baseline and detect anomalies like unusual logon times, failed logins, or peers' rare access to sensitive resources. Insider threat hunting depends on correlating identity, access, and action attributes around a unique user, which is why user entity analysis correctly identifies abnormal access patterns. Without user-level behavioral analytics, insider threats that leverage legitimate credentials would remain undetected.

AzureHound enumerates Microsoft Entra ID objects, users, groups and role assignments via the Graph API, so Microsoft Entra ID Audit Logs capture the directory read and consent activity that reveals enumeration. These logs expose the reconnaissance patterns AzureHound generates.

Matching EventID 4769 with TicketOptions "0x40810000" and TicketEncryptionType "0x17" isolates RC4-encrypted, forwardable, renewable service ticket requests typical of golden ticket activity, then summarising count() by AccountName and taking the top 10 surfaces the most prolific requesters.

This option correctly describes the query's purpose: it starts with medium-risk user sign-ins, joins those with service principal sign-ins on the same IP address, and uses a count threshold to identify repeated correlation. Such a pattern can reveal token theft or lateral movement where an attacker uses a stolen user token from an IP also associated with a service principal. The combination of the risk level on the user sign-in and the shared IP with a service principal is the key investigative signal.

DeviceProcessEvents records process creation events and exposes the SHA256 column, letting the hunter filter executions by the exact file hash observed. This satisfies the 24-hour scope via Timestamp filtering, returning every device that ran that specific binary regardless of filename or path.

Content hub hunting queries map to MITRE ATT&CK tactics and techniques, giving you pre-built KQL aligned to the framework's structure. This satisfies the scenario's requirement to conduct hunting within ATT&CK, letting you pivot from known technique coverage rather than authoring detections from scratch.

This query is correct because it uses the CloudAppEvents table, the authoritative table in Microsoft 365 Defender advanced hunting for cloud app activities, and filters on ActionType == 'FileDownloaded', which is the exact event name for file downloads in SharePoint Online. The AccountDisplayName filter isolates the target user's actions within the last 7 days, and summarize TotalSize = sum(FileSize) correctly aggregates the FileSize numeric column to yield the total bytes downloaded. It is the only option that combines the right table, accurate action type, and proper aggregation.

Service accounts often have elevated privileges and allow remote connections (e.g., SMB, WinRM, RDP) to multiple systems for legitimate application workloads. When an attacker compromises a service account, correlating its historical baseline with anomalous outbound network connections—such as connections to previously unseen hosts or non-standard protocols—can reveal lateral movement attempts that would otherwise blend in with normal service traffic.

DeviceFileEvents records file creation, modification and renaming activity from Defender for Endpoint, capturing the rapid, high-volume write and rename operations ransomware performs during encryption. This directly satisfies the stem's requirement to detect file encryption events, unlike tables covering process, network or registry activity.

The query targets the active threats collection, which only holds unresolved detections. Once remediation completes, the threat moves out of that list, so querying by that ID returns nothing even though the historical record may still exist elsewhere.

Adding filters that exclude known benign activity narrows the result set, directly reducing the false positives the hunt query returns. This refines the analytic without disabling it, satisfying the requirement to tune detection logic so genuine threats remain visible while routine noise is suppressed.

DeviceNetworkEvents is the workflow's core because it reveals each process's outbound and inbound network connections, including remote IP, remote port, protocol, and the initiating process image. Lateral movement requires a connection to another host via protocols like SMB (445), RDP (3389), or WinRM (5985), so hunting can simply look for unusual or repetitive connection patterns from a compromised host to internal addresses. This table also lets you join to process creation events, making it indispensable for reconstructing the full attack chain between systems.

Excluding known admin accounts helps reduce noise while keeping detection for other users.

DeviceEvents is the correct table because it contains a wide range of Windows security events, including Event ID 4698 which is specifically the creation of a scheduled task. This table ingests events from the Windows Event Log and is the primary place to hunt for persistence mechanisms like new scheduled tasks. You can also find related events like task updates (4702) and deletions (4699) here. So for identifying suspicious scheduled task creation, DeviceEvents is the authoritative source.

Office 365 audit logs, specifically the Exchange workload, are the authoritative source because they capture changes to mailbox forwarding and inbox rules. Operations like Set-Mailbox, which includes modifications to ForwardingSmtpAddress, and New-InboxRule or Set-InboxRule with RedirectTo are logged with the actor's UPN, the exact timestamp, and the target mailbox. These events are accessible via the Microsoft Purview compliance portal or the Search-UnifiedAuditLog cmdlet, making them the definitive evidence for a data exfiltration via email investigation.

Event ID 1102 records the Windows security audit log being cleared, written to the Security log whenever someone runs wevtutil or clears it via Event Viewer. Filtering on 1102 in the KQL query therefore surfaces exactly the anti-forensic behaviour the hunter targets, satisfying the requirement to detect security logging being disabled on those servers.

Event ID 5861 in the Microsoft-Windows-WMI-Activity/Operational log records the registration or modification of a permanent WMI event subscription, including the originating ProcessID and the consumer/filter details. Attackers commonly use WMI as a LotL lateral movement technique, so correlating this event with Windows process creation (Event ID 4688) reveals the exact command line, such as wmic.exe or PowerShell, that created the subscription. Without that correlation, 5861 can be mistaken for legitimate administrative tooling.

IdentityLogonEvents is the correct table because it is specifically designed to capture authentication events to applications using Microsoft Entra ID (Azure AD). Each row represents a user authentication attempt to a cloud app, with details such as the target application, logon type, protocol, and whether the attempt succeeded or failed. This directly matches the requirement to find instances of authentication to a cloud application, making it the authoritative source for this hunt.

DeviceEvents is the correct table because it stores security-sensitive behavioral events, and specifically the ActionType 'LsassAccessedByProcess' is emitted when a process attempts to open the LSASS process handle with credential-theft access rights such as PROCESS_VM_READ or PROCESS_ALL_ACCESS. This event directly indicates a potential credential-dumping attempt, making it the definitive data source for this hunt. Other tables may show supporting artifacts, but only DeviceEvents captures the actual LSASS access.

SecurityEvent is a core Windows event log source in Sentinel, capturing event IDs such as 4624 (successful logon), 4625 (failed logon), 4672 (special privileges), and 4720 (user account created). Because it includes logon types and account logon details, it directly supports detection of brute-force attacks, pass-the-hash, and lateral movement across managed endpoints. Without this table, identity-focused hunts would lack the fine-grained audit trails of OS-level authentication and authorization.

DeviceProcessEvents capture process creation events, including the full command line, which is exactly where Mimikatz's execution appears—for example, 'mimikatz.exe privilege::debug sekurlsa::logonpasswords'. Searching ProcessCommandLine for 'mimikatz' directly detects the tool being run, even if the executable is renamed, as long as the command line includes the name. This is the most dependable hunting query because credential dumping requires process execution, and process creation logs are the primary telemetry for that activity.

Ingesting threat intelligence indicators into Microsoft Sentinel and mapping them to analytics rules lets hunters build custom detections for DLL side-loading observables, such as malicious file hashes or loaded modules, matching the requirement to use the latest threat intelligence proactively.