Forming Threat Hunting Hypotheses TIE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team is new to threat hunting and wants to adopt a structured approach. They have a large amount of log data and want to avoid random searches. Which approach best exemplifies hypothesis-driven hunting?

   • ARun a broad search for any suspicious file hashes from public threat feeds.
   • BFormulate a specific question about potential adversary behavior, then search logs for evidence that would confirm or refute it.
   • CUse an automated tool to detect all anomalies and then investigate each one.
   • DWait for an alert from the SIEM and then investigate the alert.
   Reveal Solution Discussion Select an answer first
2. 22application · medium · select all that apply

   A threat hunter has formulated a hypothesis about potential lateral movement using PsExec. The hunter needs to document and communicate this hypothesis effectively. Which of the following elements should be included in the documentation? (Select all that apply.)

   • AThe name of the threat hunter who formulated the hypothesis.
   • BThe rationale, including why this hypothesis is plausible based on observed anomalies or threat intelligence.
   • CThe relevant MITRE ATT&CK techniques, such as T1021.002 (Remote Services: SMB/Windows Admin Shares).
   • DThe expected evidence, such as event ID 4688 with PsExec in the command line or network connections to port 445.
   • EThe specific hypothesis statement, such as 'An attacker is using PsExec to move laterally within the network.'
   Check answers Discussion Select an answer first
4. 23application · medium

   A threat hunter is investigating a potential credential theft incident. They observe that a user account is being used to access multiple systems in a short period, which is unusual for that user. Which MITRE ATT&CK technique should be central to the hypothesis?

   • ACredential Dumping (T1003)
   • BValid Accounts (T1078)
   • CLateral Movement (TA0008)
   • DBrute Force (T1110)
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A threat hunter has formulated a hypothesis that a specific user account is being used for unauthorized access based on unusual logon patterns. The hunter needs to communicate this to the incident response team and management. What is the most effective way to document and communicate the hypothesis?

   • AAdd the hypothesis to the ticketing system as a low-priority task, without further explanation.
   • BVerbally explain the hypothesis to the incident response team during a meeting, without written documentation.
   • CCreate a formal document that includes the hypothesis, the rationale, the expected evidence, and the relevant MITRE ATT&CK techniques, and share it with stakeholders.
   • DSend a brief email to the incident response team with the hypothesis and ask them to start investigating.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   When prioritizing hypotheses, which factor should be considered to focus hunting efforts effectively?

   • AThe likelihood that the hypothesized activity is occurring and the potential impact if it is
   • BThe length of the hypothesis text, with longer hypotheses being more important
   • CThe order in which the hypotheses were created, with older ones being more important
   • DThe number of keywords in the hypothesis that match known malware names
   Reveal Solution Discussion Select an answer first