CoreQ Academy4.3 Given a scenario, apply threat-hunting and threat intelligence concepts.
Threat hunting assumes the attacker is already in and goes looking. Threat intelligence tells you what to look for and is shared in standard formats.
Internal intelligence sources
- Adversary emulation engagements
- Red team exercises emulating specific threat actors to test detection.
- Internal reconnaissance
- Mapping your own environment as an attacker would.
- Hypothesis-based searches
- Hunts that start from a hypothesis (e.g. "an attacker is using WMI for lateral movement") and test it against data.
- Honeypots
- Decoy systems that reveal intruders.
- Honeynets
- Networks of decoys.
- User behavior analytics (UBA)
- Detecting anomalous user activity against baselines.
External intelligence sources
- Open-source intelligence (OSINT)
- Public reports, blogs, advisories.
- Dark web monitoring
- Watching criminal forums for leaked data or targeting.
- Information sharing and analysis centers (ISACs)
- Sector groups sharing threat information among members.
- Reliability factors
- Judging intelligence by source reliability, timeliness, accuracy and relevance.
Counterintelligence and platforms
- Counterintelligence and operational security
- Preventing adversaries from learning about your defences and investigations.
- Threat intelligence platforms (TIPs)
- Tools that collect, deduplicate, score and distribute intelligence.
- Third-party vendors
- Commercial intelligence providers.
Indicator sharing
- Indicator of compromise (IoC) sharing
- Exchanging hashes, IPs, domains and other indicators.
- Structured Threat Information eXchange (STIX)
- Standard language for describing threat intelligence objects and relationships.
- Trusted automated exchange of indicator information (TAXII)
- Protocol for exchanging STIX data between systems.
Rule-based languages
- Sigma
- Generic, vendor-neutral format for SIEM detection rules that converts to many query languages.
- Yet Another Recursive Acronym (YARA)
- Pattern rules to identify and classify malware files.
- Rita
- Real Intelligence Threat Analytics: analyses network logs (Zeek) for beaconing and C2 behaviour.
- Snort
- Network IDS/IPS rule language and engine.
Indicators of attack
- Indicators of attack
- Behavioural signs of an attack in progress, regardless of specific tools.
- TTPs
- Tactics, techniques and procedures: how adversaries operate, more durable than individual IoCs.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 4.3 of the publicly available CompTIA SecurityX CAS-005 exam objectives (Exam objectives V5, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.