Design a threat hunt to find lateral movement in a Windows Active Directory environment.

What the interviewer wants to hear

• Start with a clear, ATT&CK-based hypothesis
• Identify data sources: Windows security logs, Sysmon, EDR, network flows
• Define a baseline of normal admin behaviour
• Look for specific patterns like remote service creation, WMI, RDP and unusual logon types
• Document findings and turn them into detections

Model answer

I would start with a hypothesis, for example: an attacker with stolen credentials is moving between hosts using remote services like PsExec, WMI, WinRM or RDP (ATT&CK TA0008). Data sources are Windows Security logs from servers and domain controllers, Sysmon or EDR process and network events, and network flow data. First I baseline normal behaviour: which admin accounts and jump hosts usually connect to which servers. Then I look for outliers: network logons (4624 type 3) or RDP logons (type 10) from workstations to other workstations, new service installs (7045) with random names, WmiPrvSE or wsmprovhost spawning cmd or PowerShell, and one account logging into many hosts in a short time. Rare parent-child process pairs are useful too. I document each finding, escalate anything malicious, and convert the reliable patterns into SIEM detections so the hunt keeps value after it ends.

More hard Cybersecurity Analyst questions

• Ransomware is spreading across your network on a Friday night. Walk me through how you would handle it.
• Your CISO wants to move to zero trust. What does that mean in practice and where would you start?
• A developer accidentally pushed AWS access keys to a public GitHub repository two hours ago. How do you respond?
• How would you build, test and maintain a new detection rule, for example for credential dumping from LSASS?
• Several employees fell for an adversary-in-the-middle phishing site that stole their session cookies despite MFA. How do you respond and harden the environment?
• You are building detection for a cloud-first company with a limited SIEM budget. Which log sources do you onboard first and why?
• HR tells you an engineer who just resigned may be taking source code and customer data. How do you investigate fairly and legally?
• A production Linux server is suspected to be compromised and may lead to legal action. How do you collect evidence in a forensically sound way while limiting business impact?
• How would you measure whether a SOC is effective? Which metrics would you use, and what are their pitfalls?