GRID - GIAC Response and Industrial Defense Threat Hunting in ICS Questions and Answers

Question 1

An ICS threat hunter is following a structured, hypothesis-driven methodology.
After reviewing recent threat intelligence about adversaries targeting their industry, what is the most logical first step for the hunter to take?

Accepted Answer

Formulate a specific, testable question about potential adversary activity in their environment.

Answer

Immediately deploy new firewall rules based on the intelligence report's IOCs.

Answer

Begin a full packet capture on all network segments to gather new data.

Answer

Scan all HMIs and engineering workstations for the malware hashes mentioned in the report.

Question 2

A threat hunting team at a large electric utility needs to prioritize its efforts to protect the most critical operational processes. Which of the following methodologies provides a structured approach for identifying the systems whose compromise would cause the most significant operational impact?

Accepted Answer

Crown Jewel Analysis

Answer

Vulnerability Assessment

Answer

Penetration Testing

Answer

MITRE ATT&CK for ICS Mapping

Question 3

While hunting in a well-established and baselined process control network, a security analyst observes an engineering workstation (EWS) initiating an RDP session to another EWS within the same Purdue Level 2 segment. This activity is not associated with any scheduled maintenance or known operator task. This is an example of which potential adversary tactic?

Accepted Answer

Lateral Movement

Answer

Initial Access

Answer

Data Exfiltration

Answer

Inhibit Response Function

Question 4

To effectively hunt for anomalies in an ICS network, it is crucial to first understand what constitutes normal operations. Which of the following is the MOST fundamental prerequisite for successful anomaly-based threat hunting?

Accepted Answer

A well-defined and established baseline of network traffic and device behavior.

Answer

A comprehensive list of known malware signatures.

Answer

An up-to-date inventory of all network hardware and software.

Answer

Access to external threat intelligence feeds.

Question 5

A threat hunter hypothesizes that an attacker is attempting to discover active devices and open ports on the process control network. Which of the following data sources would provide the MOST direct evidence to prove or disprove this hypothesis?

Accepted Answer

Network traffic captures from a SPAN port or network tap inside the OT network

Answer

Process data from the historian server

Answer

Firewall logs from the IT/OT boundary

Answer

Authentication logs from an HMI

Question 6

A threat hunter observes a PLC in a manufacturing facility sending small, encrypted packets to an unknown external IP address every 15 minutes. This communication pattern does not match any known vendor protocol or legitimate traffic baseline. Which threat hunting hypothesis is MOST likely supported by this observation?

Accepted Answer

An attacker has established a command-and-control (C2) or data exfiltration channel.

Answer

The PLC is experiencing a software fault and sending error reports.

Answer

A new remote maintenance connection has been configured by the vendor.

Answer

The device is attempting to synchronize its time with an unauthorized NTP server.