CCD Threat Intelligence & Hunting Flashcards

What does 'TTP' stand for in the context of threat intelligence?

Answer: Tactics, Techniques, and Procedures

TTPs (Tactics, Techniques, and Procedures) describe how adversaries operate, making them the most valuable and hardest-to-change intelligence for defenders.

Which type of threat intelligence is most useful for security operations teams making real-time defensive decisions?

Answer: Tactical intelligence (IOCs and TTPs)

Tactical threat intelligence, including IOCs and TTPs, provides actionable information that SOC teams can use immediately to detect and respond to threats.

An analyst is threat hunting and notices PowerShell executing encoded commands via `powershell.exe -enc`. What is the attacker likely doing?

Answer: Obfuscating malicious commands to evade detection

Base64-encoded PowerShell commands (`-enc` flag) are commonly used by attackers to obfuscate malicious scripts and evade string-based detection.

What is the purpose of a threat intelligence 'feed' in a security operations environment?

Answer: To deliver automated streams of IOCs and threat data for ingestion into security tools

Threat intelligence feeds provide automated, continuously updated streams of IOCs and threat data that security tools like SIEMs and firewalls can ingest and act on.

Which hunting methodology searches for statistical anomalies in large datasets without a predefined hypothesis?

Answer: Machine learning / analytics-driven hunting

Analytics-driven threat hunting uses machine learning and statistical analysis to surface anomalies in data without requiring a predefined hypothesis.

A threat hunter wants to identify lateral movement in the environment. Which data source is MOST useful?

Answer: Windows Security Event logs (Event IDs 4624, 4648, 4672)

Windows Security Event IDs 4624 (logon), 4648 (explicit credential logon), and 4672 (special privileges) are key indicators of lateral movement activity.