312-39 · Question #28
As a Threat Hunter at a cybersecurity company, you notice several endpoints experiencing unusual outbound traffic to an unfamiliar IP address. The traffic is encrypted and occurs in small bursts at…
The correct answer is A. Unstructured hunting. Unstructured hunting is best suited when you have a weak but concerning signal (like unusual encrypted bursts to an unfamiliar IP) without a clear hypothesis tied to a known technique or indicator. In this scenario, there are no known IoCs and no alert from traditional tools…
Question
As a Threat Hunter at a cybersecurity company, you notice several endpoints experiencing unusual outbound traffic to an unfamiliar IP address. The traffic is encrypted and occurs in small bursts at irregular intervals. There are no known IoCs associated with the destination, and traditional security tools have not flagged it as malicious. You decide to launch a threat-hunting initiative to determine whether this is an advanced persistent threat (APT) using sophisticated techniques to evade detection. The goal is to identify potential Indicators of Attack (IoAs) and map them against known adversary behaviors. What type of threat hunting approach is best suited for this situation?
Options
- AUnstructured hunting
- BSituational or entity-driven hunting
- CReactive hunting
- DStructured hunting
How the community answered
(31 responses)- A61% (19)
- B6% (2)
- C23% (7)
- D10% (3)
Explanation
Unstructured hunting is best suited when you have a weak but concerning signal (like unusual encrypted bursts to an unfamiliar IP) without a clear hypothesis tied to a known technique or indicator. In this scenario, there are no known IoCs and no alert from traditional tools, so the hunt starts from an intuition-driven anomaly and develops into hypotheses through exploration: examining which hosts are involved, what processes initiate connections, whether destinations vary, persistence or credential access signals. This is characteristic of unstructured hunts-analyst-driven exploration based on suspicious observations. Structured hunting typically starts with a defined hypothesis or known adversary behavior mapped to a framework and uses planned queries to confirm or refute it. Situational/entity-driven hunting focuses on a specific entity (a VIP user, crown- jewel server) or a known incident context. Reactive hunting is driven by alerts or confirmed incidents. Here, the hunt is prompted by an anomaly without predefined IoCs or alerts, making unstructured hunting the most appropriate approach to uncover IoAs and then map findings to adversary behaviors.
Topics
Community Discussion
No community discussion yet for this question.