CCD Threat Intelligence & Hunting Flashcards

Which threat intelligence framework uses a matrix of tactics and techniques based on real-world adversary behavior?

Answer: MITRE ATT&CK

MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations.

What is the primary goal of threat hunting in a security operations context?

Answer: Proactively search for hidden threats before alerts fire

Threat hunting is the proactive practice of searching through networks and systems to detect threats that evade existing automated security controls.

Which threat intelligence indicator type refers to known malicious file hashes, IPs, and domains?

Answer: IOCs

Indicators of Compromise (IOCs) are forensic artifacts such as file hashes, IP addresses, and domain names associated with known threats.

What does the 'Diamond Model' of intrusion analysis primarily focus on?

Answer: Relationships between adversary, capability, infrastructure, and victim

The Diamond Model maps the four core features of every intrusion event: adversary, capability, infrastructure, and victim.

Which STIX/TAXII concept is used to share threat intelligence between organizations in a standardized format?

Answer: TAXII as transport protocol and STIX as data format

STIX (Structured Threat Information eXpression) defines the data format while TAXII (Trusted Automated eXchange of Intelligence Information) is the transport protocol.

A threat hunter notices beaconing traffic at regular 5-minute intervals to an external IP. What technique should be used to confirm C2 communication?

Answer: Analyze beacon jitter, packet size consistency, and DNS lookups to the IP

Analyzing beacon regularity, jitter, packet size, and associated DNS queries helps confirm command-and-control (C2) communication patterns.