Threat Hunting

You are hunting for evidence that an adversary is using scheduled tasks to maintain persistence on Windows endpoints. Which TWO data sources or artifacts should you prioritize reviewing in Splunk for this hunt? (Choose two.)

During a proactive hunt for Kerberoasting in an Active Directory environment, you ingest Windows Security Event Code 4769 with the service ticket options field available as Ticket_Options. You want to isolate requests made with weak RC4 encryption rather than AES. Which Splunk search best surfaces these potentially malicious service ticket requests?

When drafting a threat hunting playbook, which of the following sections is most critical for ensuring the hunt is repeatable and auditable by other analysts?

You are hunting for evidence of pass-the-hash lateral movement in your environment. Which Windows Security event and field combination is most indicative of this technique?

Which phase of the proactive threat hunting methodology involves identifying the specific threat actor or technique to be investigated?

You are hunting for living-off-the-land binary (LOLBin) abuse on Windows endpoints. You have Sysmon EventCode 1 process creation logs. Which search best surfaces suspicious use of a signed Microsoft binary to download or execute remote content?

When designing a threat hunting playbook, which TWO components must be included to ensure the hunt is actionable?

You are hunting for evidence of data exfiltration over HTTP. You have web proxy logs ingested into Splunk and want to identify internal hosts that have uploaded an unusually large amount of data to external sites in the past week. Which field in the proxy logs is most relevant for measuring outbound data volume?

You are hunting for anomalous PowerShell activity. Which THREE indicators or behaviors should you look for in your Splunk data?

An analyst is hunting for evidence that an adversary used the Windows command shell to spawn a script interpreter in a suspicious parent-child relationship. The endpoint telemetry is in Splunk via Sysmon EventCode 1. Which search most directly surfaces processes whose parent is cmd.exe and whose image is a scripting engine?

When utilizing the Splunk Common Information Model (CIM), which field name is standard for identifying the destination IP address across different data sources?

You are hunting for Kerberoasting activity in your Windows environment. You have Splunk ingesting Windows Security event logs. Which Event ID and field combination best supports identifying accounts requesting service tickets with weak encryption?

Which TWO actions should be performed during the 'Data Preparation' phase of a threat hunt to ensure accurate results?

In a threat hunting workflow, what is the primary purpose of a 'Lookback' period?

You are hunting for evidence of credential dumping. You have access to Sysmon logs. Which EventCode should be the primary focus for detecting memory access to lsass.exe?

You are hunting for persistence via Windows scheduled tasks. You have Splunk ingesting Windows Event Logs and Sysmon. Which Event ID and field should you prioritize to detect a newly created scheduled task that runs a suspicious binary?

While hunting for Kerberos-based attacks, you notice a service account requesting service tickets for many distinct SPNs across multiple servers within a short window. You want to correlate this with the account's normal baseline to confirm abnormal breadth. Which approach most directly supports that analysis in Splunk?

Which THREE techniques can be used in Splunk to reduce the noise of false positives during a threat hunt?

You are conducting a threat hunt for data exfiltration over DNS. Which TWO Splunk search techniques are most effective for identifying anomalous DNS tunneling activity in your DNS logs? (Choose two.)

Which Splunk feature allows an analyst to save a specific search query, parameterize it with variables, and reuse it across different time ranges and entities?

You are hunting for DNS-based data exfiltration using Splunk, where malware encodes stolen data in subdomain labels of queries to an attacker-controlled domain. Which two search constructs most directly help you quantify abnormally long or high-entropy query names and identify the destination domain being abused? (Choose two.)

You are preparing a hunt for suspicious PowerShell execution and want to search only the accelerated data model rather than raw events to return results faster across a large environment. Which Splunk construct should you use?

You are investigating a suspicious PowerShell script. You suspect the script is using Base64 encoding. Which SPL function can you use to decode the string within Splunk?

You are performing a hypothesis-driven hunt and suspect that an attacker is using lateral movement via WMI. Which command in Splunk would best assist in identifying anomalous process creation events associated with WMI (wmiprvse.exe) spawning shells?

You are hunting for suspicious PowerShell activity on endpoints. You have PowerShell Script Block Logging (Event ID 4104) ingested into Splunk. Which search best identifies scripts that download and execute remote content, a common attacker technique?

You are hunting for beaconing activity in proxy logs ingested into Splunk, where an implant contacts its command-and-control server at regular intervals with small jitter. Which analytic approach best identifies a host exhibiting this periodic communication pattern?

You suspect an attacker is using 'living-off-the-land' (LotL) techniques. Which Sysmon event should you analyze to see command-line arguments of suspicious utilities?

During a proactive threat hunt, you want to quickly identify processes that were executed from a temporary directory such as C:\\Users\\Public on Windows endpoints, using Sysmon data. Which Splunk search is most appropriate to surface this activity?

Which TWO Splunk features are best for automating the execution of recurring threat hunts?

During a hunt for compromised accounts, you want to distinguish a legitimate helpdesk password reset from an attacker resetting credentials to retain access. Which correlation of events in Splunk would best support that distinction?

During a threat hunt for data exfiltration, you want to identify endpoints that transferred an unusually large volume of data to external IP addresses compared to their normal baseline. Which Splunk approach best accomplishes this using the Network_Traffic data model?