CCD CCD Threat Intelligence & Hunting 2 — Questions and Answers
Question 1: What is the Pyramid of Pain in threat intelligence?
- A model ranking IOC types by how difficult they are for adversaries to change (Correct answer)
- A patch prioritization framework
- A risk scoring system for CVEs
- A network segmentation model
Correct answer: A model ranking IOC types by how difficult they are for adversaries to change
The Pyramid of Pain ranks indicators from hash values (easy to change) to TTPs (very hard to change), showing what hurts adversaries most when defenders act on each level.
Question 2: Which open-source platform is commonly used to aggregate and share threat intelligence feeds using a MISP format?
- Splunk
- MISP (Malware Information Sharing Platform) (Correct answer)
- Wireshark
- Zeek
Correct answer: MISP (Malware Information Sharing Platform)
MISP is an open-source threat intelligence platform designed for sharing, storing, and correlating indicators of compromise and threat intelligence.
Question 3: During a threat hunt, an analyst finds a process running from `%AppData%\Roaming` with no parent process signature. What attack technique does this most suggest?
- SQL injection
- Living-off-the-land (LOLBins) persistence or malware execution (Correct answer)
- DDoS attack
- DNS poisoning
Correct answer: Living-off-the-land (LOLBins) persistence or malware execution
Processes running from user-writable directories like AppData with unsigned or missing parent chains are classic indicators of malware persistence or LOLBin abuse.
Question 4: What is a 'hypothesis-driven' threat hunt?
- Running automated scans without analyst input
- Starting a hunt based on an assumed adversary behavior or TTP (Correct answer)
- Reviewing compliance audit logs
- Blocking all unknown executables
Correct answer: Starting a hunt based on an assumed adversary behavior or TTP
Hypothesis-driven hunting starts with an assumption about adversary behavior informed by threat intelligence and then searches for evidence to confirm or deny it.
Question 5: Which ATT&CK tactic involves an adversary trying to avoid detection by security controls?
- Execution
- Persistence
- Defense Evasion (Correct answer)
- Collection
Correct answer: Defense Evasion
Defense Evasion in MITRE ATT&CK covers techniques adversaries use to avoid detection, such as obfuscation, disabling security tools, and masquerading.
Question 6: A threat intelligence report lists an APT group using spearphishing with macro-enabled documents. Which ATT&CK Initial Access technique does this map to?
- T1078 - Valid Accounts
- T1566.001 - Spearphishing Attachment (Correct answer)
- T1190 - Exploit Public-Facing Application
- T1133 - External Remote Services
Correct answer: T1566.001 - Spearphishing Attachment
T1566.001 covers spearphishing attachments, where adversaries send emails with malicious attachments like macro-enabled Office documents.
CCD CCD Threat Intelligence & Hunting 2
What is the Pyramid of Pain in threat intelligence?