Surveillance & Intelligence Gathering Flashcards

A red team simulates an advanced persistent threat by living off the land—using only tools already present on the target system. Which of the following best describes the intelligence value of this approach?

Answer: It reveals whether existing detection controls can identify abuse of legitimate system tools

Living-off-the-land simulations test whether SIEM rules and EDR solutions can detect misuse of built-in tools like PowerShell, WMI, or certutil, which evade signature-based defenses.

Certificate Transparency (CT) logs are useful for reconnaissance because they:

Answer: Publicly record all TLS certificates issued, exposing subdomains and internal hostnames

CT logs require CAs to publicly log every issued certificate, enabling attackers and defenders alike to discover subdomains and infrastructure that organizations may not have intended to expose.

Which OPSEC principle is violated when a threat analyst's research activities leave detectable patterns in server logs that could alert a threat actor to being investigated?

Answer: Covert research discipline

Covert research discipline requires analysts to conduct investigations without tipping off subjects; visiting attacker infrastructure directly from agency IPs creates log entries that can burn the investigation.

What role does 'pivoting on an IOC' play in a threat intelligence investigation?

Answer: Using one indicator to discover related infrastructure, malware, or actor clusters

IOC pivoting uses a known artifact (such as a C2 IP) as a starting point to query threat intelligence platforms and passive DNS databases, uncovering related domains, IPs, and malware families.

An organization deploys a network of high-interaction honeypots across its DMZ. The primary intelligence value of this deployment is to:

Answer: Capture attacker TTPs and tools in a controlled environment for later analysis

High-interaction honeypots fully emulate real systems, allowing attackers to proceed with their TTPs while defenders collect forensic artifacts, tools, and behavioral intelligence without risk to production systems.

Which attribute of threat intelligence is described as 'the degree to which intelligence is applicable to the specific organization's environment and threat landscape'?

Answer: Relevance

Relevance measures how applicable threat intelligence is to the consuming organization's specific industry, technology stack, and adversary profile, filtering out noise that doesn't affect them.

During a counterintelligence investigation, a security team suspects an insider threat is exfiltrating data. Which monitoring approach is most appropriate while preserving admissibility of evidence?

Answer: Conduct monitoring under a legally sanctioned program with proper logging, chain of custody, and management approval

Legally sanctioned monitoring programs with documented authorization, proper evidence handling, and chain of custody ensure that collected evidence remains admissible and protects the organization from legal liability.