Threat Hunting Query Techniques for Security Analysts

1. What is the main advantage of using YARA rules in threat hunting?

Detect malware based on file patterns and characteristics

Manage user permissions

Configure network firewalls

Schedule system backups

2. Which approach combines automated detection with manual investigation in threat hunting?

Purely manual review only

Fully automated scanning without human input

Hybrid threat hunting methodology

Random log sampling

3. In threat hunting, what does 'baselining' involve?

Establishing normal network and system behavior for comparison

Removing all security controls

Deleting historical logs

Disabling user accounts

4. Which metric is used to evaluate a threat hunting tool's ability to detect actual threats?

False negative rate

Query execution speed

System memory usage

Network latency

5. What is the primary goal of creating a threat hunting hypothesis?

Ensure all queries return results

Define what threat you're looking for and how to detect it

Eliminate all security alerts

Backup all system files

6. Which network protocol analysis is most useful for identifying data exfiltration attempts?

ICMP ping analysis

HTTP/HTTPS and DNS traffic analysis

ARP broadcast analysis

DHCP lease analysis

7. In a threat hunting query, what does the term 'false positive' mean?

An alert indicating a real security threat

A benign event incorrectly flagged as malicious

A successful breach detection

A system patch installation

8. What is the primary benefit of correlation rules in SIEM systems?

Combine multiple events to detect complex attack patterns

Delete old log files

Reduce network bandwidth

Manage user passwords

9. Which data source is essential for tracking domain name system lookups and potential C2 communications?

Application logs

DNS logs

Printer logs

Calendar system logs

10. In threat hunting, what does pivoting refer to?

Rotating security team shifts

Following investigative leads from one IOC to related indicators

Changing network IP addresses

Updating antivirus definitions

11. What is the primary goal of threat hunting?

Respond to known security alerts only

Proactively search for undetected threats and adversaries

Patch all system vulnerabilities

Encrypt all network traffic

12. Which technique involves searching for suspicious file hashes across your environment?

Signature-based hunting

Anomaly detection

Behavioral analysis

Risk scoring

13. What is the primary purpose of endpoint detection and response (EDR) tools in threat hunting?

Monitor and investigate suspicious endpoint activity

Create firewall rules

Generate SSL certificates

Manage software licenses

14. In a threat hunting query, what does filtering by time range accomplish?

Reduces data volume and focuses analysis on relevant incidents

Encrypts sensitive information

Patches system vulnerabilities

Removes all user accounts

15. Which log type best captures process execution and command-line activity?

Web server access logs

Sysmon and Windows Event Log 4688

DHCP server logs

NTP logs

16. What does behavioral analysis in threat hunting focus on?

User communication patterns

Deviations from normal system and user activity

Email encryption protocols

Physical security access logs

17. Which query tool is commonly used to search large datasets of security logs?

Microsoft Word

Splunk SPL or similar SIEM query language

Apache Kafka

Git version control

18. In threat hunting, what is an indicator of compromise (IOC)?

A system patch update

Forensic evidence suggesting a breach occurred

A firewall rule configuration

A backup restoration process

19. What does MITRE ATT&CK framework primarily help security analysts accomplish?

Generate vulnerability patches

Map adversary tactics, techniques, and procedures

Encrypt sensitive data

Deploy intrusion prevention systems

20. Which data source is most useful for identifying lateral movement in a network?

Firewall logs

DNS query logs

Windows Event Logs and Sysmon data

Email gateway logs

Security Analyst Running a Threat Hunting Query Quiz