Forming Threat Hunting Hypotheses TIE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A threat intelligence feed reports a new malware family that uses PowerShell to download additional payloads and then establishes persistence via scheduled tasks. The security team has limited logging on endpoints, but has network logs and Active Directory logs. Which hypothesis is most practical and testable given the available data?

   • AThe malware uses PowerShell, so we should search Active Directory logs for PowerShell execution.
   • BThe malware creates scheduled tasks, so we should search Active Directory logs for new scheduled tasks.
   • CThe malware may be communicating with command-and-control servers, so we should search network logs for connections to known malicious domains or unusual patterns.
   • DThe malware is present on endpoints and executing PowerShell commands, so we should search endpoint logs for PowerShell activity.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In hypothesis-driven threat hunting, what role does the hypothesis play in the investigation process?

   • AIt replaces the need for any additional data collection because the hypothesis itself is the answer
   • BIt acts as a filter to focus data collection and analysis on specific behaviors or techniques
   • CIt is used only to justify the hunt to management and has no technical impact on the investigation
   • DIt provides a final conclusion that is confirmed by the first piece of matching evidence
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company has a policy that all administrative tasks must be performed from a dedicated jump host. A threat hunter notices that an administrator account is logging in directly to a domain controller from a workstation. Which hypothesis is most aligned with environmental knowledge?

   • AThe workstation is infected with malware that is performing the logon.
   • BThe administrator is violating policy, but it is not a security threat.
   • CThe administrator account may be compromised, and the attacker is using it to access the domain controller directly, bypassing the jump host.
   • DThe domain controller is misconfigured and allowing unauthorized access.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A threat intelligence report indicates that a specific adversary group is known to use living-off-the-land binaries (LOLBins) like certutil.exe to download payloads. The security team wants to hunt for this activity. Which hypothesis is best aligned with this intelligence?

   • AAn attacker may be using certutil.exe to download malicious payloads, so we should search for certutil.exe executions with network connections.
   • BThe adversary group is using LOLBins, so we should block all LOLBins.
   • CWe should search for any use of certutil.exe in the environment.
   • Dcertutil.exe is a legitimate tool, so it is unlikely to be used by attackers.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How does the MITRE ATT&CK framework help in forming threat hunting hypotheses?

   • AIt replaces the need for threat intelligence by providing all necessary information about adversaries
   • BIt provides a structured taxonomy of adversary tactics and techniques that can be used to generate and align hypotheses
   • CIt provides a list of known malware signatures to search for in the environment
   • DIt automatically detects all threats in real time without the need for manual hunting
   Reveal Solution Discussion Select an answer first