Threat hunting techniques in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is threat hunting in cybersecurity?

Threat hunting is the proactive search for hidden cyber threats or attackers within a network before they cause harm or are detected by automated tools.

beginner

Name a common technique used in threat hunting that involves analyzing unusual patterns in network traffic.

Anomaly detection is a common technique where hunters look for unusual patterns or behaviors in network traffic that may indicate malicious activity.

intermediate

What role does hypothesis-driven hunting play in threat hunting?

Hypothesis-driven hunting involves forming educated guesses about potential threats based on knowledge of attacker behaviors, then searching for evidence to confirm or refute those guesses.

intermediate

How does threat hunting differ from traditional security monitoring?

Traditional security monitoring relies on automated alerts and known signatures, while threat hunting is proactive and looks for unknown or hidden threats by analyzing data and behaviors.

beginner

Why is endpoint data important in threat hunting?

Endpoint data provides detailed information about activities on devices like computers and servers, helping hunters detect suspicious actions such as unauthorized access or malware execution.

Which of the following best describes threat hunting?

A Proactively searching for hidden threats

B Installing antivirus software

C Waiting for alerts from security tools

D Backing up data regularly

Threat hunting is about actively looking for threats that automated tools might miss.

What is anomaly detection used for in threat hunting?

A To detect unusual patterns that may indicate threats

B To find normal network behavior

C To update software automatically

D To block all network traffic

Anomaly detection helps identify unusual activities that could be signs of an attack.

Hypothesis-driven hunting means:

A Ignoring alerts from security tools

B Randomly scanning all files

C Guessing potential threats and searching for evidence

D Only reacting to known malware

Hunters form educated guesses about threats and then look for proof.

Which data source is most useful for detecting suspicious activity on devices?

A Financial statements

B Public social media posts

C Weather reports

D Endpoint data

Endpoint data shows what is happening on computers and servers, crucial for threat hunting.

How does threat hunting complement traditional security monitoring?

A By replacing all automated tools

B By proactively finding threats that automated tools miss

C By ignoring network traffic

D By only focusing on backups

Threat hunting looks deeper and finds hidden threats beyond automated alerts.

Explain the main steps involved in a hypothesis-driven threat hunting process.

Think about how hunters guess and then check for threats.

Describe why endpoint data is critical for effective threat hunting.

Consider what information devices can reveal about attacks.