Cybersecurity Analyst
Detection and threat hunting questions
200 questions on Detection and threat hunting for cybersecurity analysts, easiest first.
Easy 54
- IOC vs IOAeasy
- False positive or false negative?easy
- Safe use of VirusTotaleasy
- What detection as code gives youeasy
- The logsource block in a Sigma ruleeasy
- Reading a selection and filter conditioneasy
- What the contains modifier doeseasy
- Why match Image with endswitheasy
- Reading an ATT&CK ID like T1059.001easy
- Run keys and the Persistence tacticeasy
- Windows event for an account lockouteasy
- Windows event for a new serviceeasy
- Sysmon Event ID 13easy
- Sysmon Event ID 3easy
- Missing command lines in 4688easy
- What a benign true positive iseasy
- Strategic vs tactical threat inteleasy
- Order of the Cyber Kill Chaineasy
- What stats count by does in SPLeasy
- Grouping with summarize in KQLeasy
- Failed SSH logins on Linuxeasy
- What auditd is foreasy
- EDR compared with antiviruseasy
- Why logs go to a SIEMeasy
- Why normalise to a common schemaeasy
- Windows event for a new accounteasy
- A user added to Domain Adminseasy
- Sysmon Event ID 11easy
- Sysmon Event ID 22easy
- Entra sign-in logs vs audit logseasy
- Where sudo use is recordedeasy
- Why Sysmon needs a config fileeasy
- Collecting Windows logs with WEFeasy
- The parts of a YARA ruleeasy
- What uint16(0) == 0x5A4D checkseasy
- What level means in a Sigma ruleeasy
- The falsepositives section in Sigmaeasy
- Tagging a Sigma rule with ATT&CKeasy
- vssadmin delete shadowseasy
- What ATT&CK mitigations areeasy
- Why IP indicators expireeasy
- Sharing a TLP:AMBER reporteasy
- Threat hunting versus alertingeasy
- Why each Sigma rule has a UUIDeasy
- Using ATT&CK group pageseasy
- What a purple team exercise iseasy
- A Sigma rule with keywords onlyeasy
- Mapping a malicious attachmenteasy
- Someone stopped CloudTraileasy
- A new cron job piping curl to basheasy
- A new line in authorized_keyseasy
- Shell history wiped on a servereasy
- Many discovery commands in a minuteeasy
- Why build a baseline firsteasy
Medium 79
- Tactic vs technique in MITRE ATT&CKmedium
- Unusual DNS trafficmedium
- Spotting C2 beaconingmedium
- Security log cleared on a servermedium
- A suspicious scheduled taskmedium
- Why analysts defang URLsmedium
- Why write detections in Sigma?medium
- The Pyramid of Painmedium
- Sharing threat intel at scalemedium
- Odd queries in Zeek dns.logmedium
- Sigma contains|all with a listmedium
- How Sigma treats a list of valuesmedium
- Using 1 of selection_* in Sigmamedium
- The windash modifier in Sigmamedium
- Why pySigma needs a pipelinemedium
- Matching text hidden in base64medium
- Counting events with Sigma correlationsmedium
- Matching IP ranges in Sigmamedium
- regsvr32 loading a remote scriptletmedium
- Word starting PowerShellmedium
- PowerShell Script Block Loggingmedium
- Excluding a tool by name onlymedium
- Testing a rule with Atomic Red Teammedium
- Using ATT&CK data sourcesmedium
- Working out a rule's precisionmedium
- What ATT&CK Navigator is formedium
- WMI event subscription persistencemedium
- Mapping net group "Domain Admins"medium
- The four points of the Diamond Modelmedium
- mshta.exe loading a remote HTAmedium
- Why tstats is faster in Splunkmedium
- Bucketing time with bin() in KQLmedium
- has vs contains in KQLmedium
- Thresholds after stats in SPLmedium
- A new systemd service on Linuxmedium
- Changes to /etc/ld.so.preloadmedium
- Spotting a bash reverse shellmedium
- AWS root user console loginmedium
- A new inbox forwarding rulemedium
- An illicit OAuth consent grantmedium
- kubectl exec in audit logsmedium
- Detecting DLL sideloadingmedium
- Sysmon Event 8, CreateRemoteThreadmedium
- An auditd watch on /etc/shadowmedium
- Why use fuzzy hashesmedium
- New secret on an Entra appmedium
- Access keys created for another usermedium
- Latest row per device with arg_maxmedium
- Extracting a field with rexmedium
- Defender protection switched offmedium
- What wide and nocase do in YARAmedium
- Counting matches in YARAmedium
- Why add a filesize limitmedium
- Using a regex in Sigmamedium
- Reading all of selection_*medium
- What the related field recordsmedium
- One technique under several tacticsmedium
- rclone copying to cloud storagemedium
- bcdedit turning off recoverymedium
- bitsadmin downloading a filemedium
- reg save on the SAM hivemedium
- nltest /domain_trustsmedium
- The expected parent of lsass.exemedium
- svchost.exe in the wrong foldermedium
- Working out a rule's recallmedium
- The blind spots section of an ADSmedium
- Starting an intel-driven huntmedium
- What MISP warning lists domedium
- Reading an Admiralty code ratingmedium
- What an ATT&CK procedure ismedium
- AdministratorAccess attached to a usermedium
- A bucket policy opened to everyonemedium
- AdFind run on a workstationmedium
- certutil decoding a text filemedium
- The cased modifier in Sigmamedium
- What ATT&CK Campaigns describemedium
- Keeping exclusions out of upstream rulesmedium
- Using a decoy admin accountmedium
- Scoping after the first infected hostmedium
Hard 67
- Detecting Kerberoastinghard
- A good threat hunting hypothesishard
- Why a 99% accurate rule floods the SOChard
- Artefacts of PsExec lateral movementhard
- Detecting DCSynchard
- Why the JNDI rule missed attackshard
- Why JA4 replaced JA3hard
- A living-off-the-land downloadhard
- Trusting a green ATT&CK heatmaphard
- Suspicious access to LSASShard
- When a trusted update is malicioushard
- Why honeytokens are high fidelityhard
- rundll32 with no argumentshard
- Catching a renamed binaryhard
- Caret tricks in cmd.exehard
- Operator precedence in a Sigma conditionhard
- A spray slower than the windowhard
- Matching an empty field in Sigmahard
- When to accept a noisy rulehard
- ntdsutil creating an IFM copyhard
- Logon type 9 with seclogohard
- Catching broken rules before deployhard
- Stack counting across a fleethard
- Promoting a rule from test to stablehard
- An over-broad Sysmon exclusionhard
- Correlation broken by time zoneshard
- How durable is a named pipe rulehard
- Remote process via WMIChard
- Late logs and a 5-minute lookbackhard
- Seasonal anomaly detection in KQLhard
- EC2 role credentials used elsewherehard
- Catching encryption in progresshard
- An attacker blinding Sysmonhard
- An AMSI bypass in script logshard
- A fake kworker processhard
- A privileged pod mounting the hosthard
- Hunting rare user agentshard
- An attacker adding a Defender exclusionhard
- Bring your own vulnerable driverhard
- A process whose binary was deletedhard
- Why S3 object reads were not loggedhard
- Device code phishing in sign-in logshard
- Sysmon Event 25, process tamperinghard
- A YARA rule that slows every scanhard
- A YARA rule that matches half the fleethard
- Detecting service creation by any toolhard
- Lowering a brute-force thresholdhard
- A hunt that found nothinghard
- MSBuild run by a finance userhard
- A Debugger value for sethc.exehard
- A new InprocServer32 key under HKCUhard
- Browsers using DNS over HTTPShard
- Auto-blocking a shared hosting IPhard
- Why valid account abuse is hard to catchhard
- Atomic tests or an emulation plan?hard
- Matching a single-byte XOR stringhard
- A parent that is not the real parenthard
- Top level of the Hunting Maturity Modelhard
- An unexpected kernel module loadhard
- A new federated domain in the tenanthard
- A role trust policy that adds a strangerhard
- Worst-case time to alerthard
- C2 hidden in a trusted SaaS APIhard
- A host with thousands of NXDOMAINshard
- Spraying slower than the lockouthard
- A connection open for 30 hourshard
- Pivoting on a C2 certificatehard