hard20 pts · first answer countsthreat-huntingmitre-attack

A good threat hunting hypothesis

Which of these is the best starting hypothesis for a structured threat hunt?

A.Look through all the logs and see if anything seems strangeB.Adversaries may be using WMI or PsExec from non-admin workstations to move laterally; check for remote process creation from hosts outside the IT admin groupC.Run every SIEM rule again with a lower thresholdD.Check if the antivirus is up to date on all machines

Discussion 0

Join free to post in the discussion.

A good threat hunting hypothesis

Discussion 0

Related questions