CCD Threat Intelligence & Hunting Flashcards

What is the Pyramid of Pain in threat intelligence?

Answer: A model ranking IOC types by how difficult they are for adversaries to change

The Pyramid of Pain ranks indicators from hash values (easy to change) to TTPs (very hard to change), showing what hurts adversaries most when defenders act on each level.

Which open-source platform is commonly used to aggregate and share threat intelligence feeds using a MISP format?

Answer: MISP (Malware Information Sharing Platform)

MISP is an open-source threat intelligence platform designed for sharing, storing, and correlating indicators of compromise and threat intelligence.

During a threat hunt, an analyst finds a process running from `%AppData%\Roaming` with no parent process signature. What attack technique does this most suggest?

Answer: Living-off-the-land (LOLBins) persistence or malware execution

Processes running from user-writable directories like AppData with unsigned or missing parent chains are classic indicators of malware persistence or LOLBin abuse.

What is a 'hypothesis-driven' threat hunt?

Answer: Starting a hunt based on an assumed adversary behavior or TTP

Hypothesis-driven hunting starts with an assumption about adversary behavior informed by threat intelligence and then searches for evidence to confirm or deny it.

Which ATT&CK tactic involves an adversary trying to avoid detection by security controls?

Answer: Defense Evasion

Defense Evasion in MITRE ATT&CK covers techniques adversaries use to avoid detection, such as obfuscation, disabling security tools, and masquerading.

A threat intelligence report lists an APT group using spearphishing with macro-enabled documents. Which ATT&CK Initial Access technique does this map to?

Answer: T1566.001 - Spearphishing Attachment

T1566.001 covers spearphishing attachments, where adversaries send emails with malicious attachments like macro-enabled Office documents.