Forming Threat Hunting Hypotheses TIE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   You are a threat hunter. You notice that a server in your DMZ is making outbound connections to an IP address that is not on any blocklist. You want to formulate a hypothesis. Which of the following is the most specific and testable hypothesis?

   • AThe server is compromised and communicating with a command-and-control server.
   • BThe server is misconfigured.
   • CThe server is doing something unusual.
   • DThe network is under attack.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   You have formulated a hypothesis that an attacker is using a specific MITRE ATT&CK technique (e.g., T1059.001 PowerShell) to execute malicious scripts on your Windows servers. You need to communicate this to a non-technical manager and a SOC analyst. What is the most effective way to document and communicate the hypothesis?

   • ACreate a one-page summary that states the hypothesis, the expected evidence (e.g., PowerShell execution logs), and the business risk, and present it in a short meeting.
   • BWrite a detailed technical report with all the raw logs and command lines, and email it to both stakeholders.
   • COnly share the hypothesis verbally with the SOC analyst and keep the manager out of the loop until you have results.
   • DPost the hypothesis on an internal wiki page with no explanation, and let stakeholders find it on their own.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is the best example of a well-formed threat hunting hypothesis?

   • AWe should check all logs for anything unusual
   • BThe firewall might be misconfigured
   • CAn attacker might be using PowerShell to execute malicious scripts on our Windows servers
   • DOur network might be compromised
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company has a small IT team and uses a cloud-based email service. They have never seen a ransomware attack. A threat intelligence feed reports a new ransomware strain that spreads via malicious email attachments. Which hypothesis is most realistic and testable for this environment?

   • AAn attacker will use a zero-day exploit to directly compromise the cloud email service.
   • BAn attacker will physically break into the office and install ransomware on the servers.
   • CAn attacker will send a malicious email attachment that, when opened, downloads and executes ransomware on a user's workstation.
   • DAn attacker will exploit a vulnerability in the company's on-premises file server, which is not present in the environment.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   When aligning a hypothesis with MITRE ATT&CK, what does the 'technique' component represent?

   • AThe overall objective the adversary is trying to achieve, such as persistence or exfiltration
   • BThe vulnerability that the adversary exploits to gain access
   • CThe tool or software used by the adversary, such as a specific malware family
   • DThe specific method an adversary uses to achieve a tactical goal
   Reveal Solution Discussion Select an answer first