Forming Threat Hunting Hypotheses TIE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A threat intelligence report describes a campaign that uses spear-phishing emails with a malicious Excel macro to drop Cobalt Strike, followed by lateral movement via SMB and eventual data staging in a cloud storage share. The security team wants to hunt for this activity in their environment. Which hypothesis best leverages this intelligence?

   • AOur users are at risk of phishing attacks and should be trained.
   • BOur users may receive phishing emails with malicious macros that execute Cobalt Strike, leading to lateral movement and data staging.
   • CCobalt Strike is present in our environment and should be detected.
   • DThe threat actor is using cloud storage for data staging, so we should monitor cloud logs.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a valid way to use threat intelligence to form a hypothesis?

   • ADeleting all files that match a known malware signature from the threat report
   • BIgnoring the report because it is about a different industry
   • CSharing the report with all employees to raise awareness
   • DSearching for a specific file hash from a threat report in the organization's endpoint logs
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security team has limited resources and must choose between two hypotheses: (1) a known APT group is targeting the organization's research and development team via spear-phishing, and (2) a disgruntled employee is exfiltrating sensitive data via personal cloud storage. The team has threat intelligence on the APT group but no evidence of insider activity. Which hypothesis should be prioritized?

   • ANeither should be prioritized until more evidence is collected.
   • BBoth should be prioritized equally, because each represents a significant risk.
   • CThe insider exfiltration hypothesis, because it has high impact and is a common threat.
   • DThe APT spear-phishing hypothesis, because it is supported by threat intelligence and targets high-value assets.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A threat hunting team has three hypotheses to investigate: (1) a known ransomware group is using a specific phishing campaign, (2) an insider is stealing intellectual property via email, and (3) a vulnerable VPN appliance is being exploited. The team has limited time and must choose one hypothesis to hunt. Which hypothesis should they choose?

   • AThe vulnerable VPN appliance, because it is directly exposed to the internet and has a known exploit, making the likelihood high and the impact significant.
   • BThe insider email exfiltration, because it has high impact and is a common insider threat scenario.
   • CThe ransomware phishing campaign, because it is based on recent threat intelligence and has high impact.
   • DAll three should be hunted simultaneously, because each represents a different threat vector.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A threat hunting team has limited time and resources. They have three hypotheses: (1) a known APT group is using a specific phishing lure against executives, (2) an insider is exfiltrating data via USB drives, and (3) a vulnerable internet-facing application is being exploited for initial access. Which hypothesis should the team prioritize first?

   • AThe vulnerable internet-facing application, because it has a known exploit and is directly exposed, making the likelihood high and the potential impact significant.
   • BThe APT phishing lure against executives, because it is based on recent threat intelligence and targets high-value users.
   • CThe insider USB exfiltration, because it has high impact and is a common insider threat scenario.
   • DAll three should be hunted simultaneously, because each represents a different threat vector.
   Reveal Solution Discussion Select an answer first