Threat Hunting Fundamentals · Apply the Threat Hunting Maturity Model to an organization's environment, as it relates to the Pyramid of Pain
During a capability review of a regional bank's security operations center, a threat hunting lead maps the team's current detection practices against the Pyramid of Pain and the Threat Hunting Maturity Model. The team currently relies strictly on automated firewall and EDR rules that match known SHA-256 file hashes, static IP addresses, and domain names from external feeds, without collecting or analyzing host or network behavioral telemetry. Which statement accurately describes the operational impact of this posture?
Answer and explanation
Correct answer: D
In David Bianco's Pyramid of Pain, Hash Values (Trivial), IP Addresses (Easy), and Domain Names (Simple) occupy the bottom three layers. Because attackers can easily modify binary hashes or rotate IP and domain infrastructure, relying solely on automated matching of these atomic indicators keeps an organization at the lowest phases of the Threat Hunting Maturity Model. Forcing adversaries to abandon tools or rewrite protocols requires detecting at the Tools and TTPs layers. Furthermore, the TaHiTI methodology specifically focuses on the top three layers of the Pyramid of Pain (Network/Host Artifacts, Tools, and TTPs), not the bottom three.
Question 2
Intermediate
Threat Hunting Fundamentals · Apply the Threat Hunting Maturity Model to an organization's environment, as it relates to the Pyramid of Pain
While designing a roadmap to advance a healthcare provider's SOC to a higher phase of the Threat Hunting Maturity Model, a security architect evaluates how the team consumes threat intelligence across the Pyramid of Pain. The environment makes extensive administrative use of PowerShell for routine server maintenance. Recent threat intelligence indicates that a targeted adversary group abuses native PowerShell to execute credential harvesting without dropping custom binaries on disk. Which capability shift is required to effectively hunt and disrupt this adversary at the corresponding level of the Pyramid of Pain?
The Pyramid of Pain reflects both the pain caused to an attacker when indicators are denied and the detection difficulty for defenders. When an attacker abuses a legitimate, built-in administrative utility like PowerShell without dropping custom files on disk, static file hashes (SHA-1/MD5) and binary YARA signatures are ineffective. Advancing up the Threat Hunting Maturity Model to hunt at the Host Artifacts and TTPs layers requires collecting granular host telemetry (such as PowerShell script-block and command-line logs) and distinguishing malicious procedures from legitimate administrative baselines.
Question 3
Advanced
Threat Hunting Fundamentals · Apply the Threat Hunting Maturity Model to an organization's environment, as it relates to the Pyramid of Pain
A global manufacturing enterprise is restructuring its cybersecurity defense program after a post-incident review revealed that a sophisticated intrusion went undetected for four months. Currently, the organization's security operations center relies on a SIEM that ingests perimeter firewall connection logs and endpoint antivirus hash alerts. Whenever the team receives a threat intelligence bulletin, analysts manually search the SIEM for the listed MD5 hashes, IP addresses, and domain names, representing a basic indicator-driven maturity phase.
During the four-month intrusion, the threat actor rotated C2 IP addresses every 12 hours, switched to newly registered domains every 48 hours, and padded binary payloads on each host to generate unique cryptographic file hashes. However, forensic reconstruction showed that the actor's implant consistently transmitted a custom HTTP User-Agent string containing an extra semicolon, created a specific Windows registry Run key pattern on compromised hosts, and laterally moved across servers using Pass-the-Hash authentication.
Executive leadership has mandated an architectural and procedural overhaul to advance the organization's Threat Hunting Maturity Model phase. The CISO requires the team to proactively uncover adversaries who evade atomic indicators and to operationalize successful hunts so analysts do not manually repeat identical data queries every week. Which strategy fulfills these requirements?
Answer and explanation
Correct answer: B
Advancing through the phases of the Threat Hunting Maturity Model requires expanding routine data collection from basic network connection and antivirus alerts to comprehensive host and protocol telemetry, enabling hunters to operate at the top layers of the Pyramid of Pain. Collecting HTTP proxy headers exposes the distinctive User-Agent string (Network Artifact), registry telemetry exposes the persistence key (Host Artifact), and Windows authentication logs expose Pass-the-Hash behavior (TTPs). Finally, highest-maturity hunting programs automate and operationalize proven data analysis procedures into continuous detection rules so hunters can focus on new hypotheses rather than repeating manual searches.
Question 4
Intermediate
Threat Hunting Fundamentals · Describe threats and how to model them with standards such as MITRE ATT&CK, MITRE CAPEC, TaHiTI, and PASTA
Following the publication of a sector-specific threat advisory detailing novel credential access behaviors, a threat hunter at a financial clearinghouse initiates a formal investigation under the TaHiTI methodology. The hunter has already captured the advisory trigger in a hunting investigation abstract, selected the abstract from the hunting backlog, enriched it using the Diamond Model, and formulated a testable hypothesis with defined data sources. When the hunter queries the endpoint and SIEM data during the Execute step, the validation result is inconclusive because command-line auditing was disabled on a subset of domain controllers. According to the TaHiTI workflow, what is the immediate next action within Phase II?
Answer and explanation
Correct answer: A
In Phase II (Hunt) of the TaHiTI methodology, hunters move between two core steps: Define / refine and Execute. The final activity of Execute is hypothesis validation, which yields one of three outcomes: proven, disproven, or inconclusive. When omissions in data sources, scope, or techniques are discovered during execution—or when further iterations are needed—the methodology specifies cycling back to Define / refine to adjust the investigation parameters or updating the hunting backlog with follow-up abstracts before moving to Phase III (Finalize).
Threat Hunting Fundamentals · Describe threats and how to model them with standards such as MITRE ATT&CK, MITRE CAPEC, TaHiTI, and PASTA
When establishing a comprehensive threat modeling and hunting framework for a cloud-hosted enterprise platform, a security architect evaluates MITRE ATT&CK, MITRE CAPEC, TaHiTI, and PASTA. Which TWO statements accurately characterize how these standards model threats and guide defensive operations? (Select TWO)
Answer and explanation
Correct answers: D, E
MITRE CAPEC (Common Attack Pattern Enumeration and Classification) catalogs common attack patterns to help analysts and architects understand how adversaries exploit weaknesses in software applications and cyber-enabled capabilities. TaHiTI (Targeted Hunting integrating Threat Intelligence) structures threat hunting into three phases (Initiate, Hunt, Finalize) and uses the four features of the Diamond Model (actors, methods/capabilities, infrastructure, victims) to enrich TTP matches.
TaHiTI is a structured, intelligence-driven threat hunting methodology consisting of three phases (Initiate, Hunt, Finalize) and six steps, incorporating the Diamond Model (actors, methods/capabilities, infrastructure, victims) when enriching TTP matches. By contrast, MITRE D3FEND (not PASTA) is MITRE's knowledge base of defensive countermeasures, MITRE ATT&CK focuses on adversary tactics and techniques rather than CVSS software scoring, and TaHiTI focuses on the top three layers of the Pyramid of Pain rather than the bottom three.
Question 6
Beginner
Threat Hunting Fundamentals · Describe threats and how to model them with standards such as MITRE ATT&CK, MITRE CAPEC, TaHiTI, and PASTA
True or False: In the MITRE ATT&CK framework, tactics represent the adversary's tactical objective—the "why" behind an action, such as Initial Access (TA0001) or Command and Control (TA0011)—while the ATT&CK Navigator tool can be used to visualize and link attack techniques to specific APT groups.
Answer and explanation
Correct answer: A
In MITRE ATT&CK, tactics represent the "why" of an ATT&CK technique—the adversary's tactical goal or contextual reason for performing an action, identified by codes such as TA0001 (Initial Access) and TA0011 (Command and Control). Techniques represent "how" an adversary achieves that tactical goal, and the MITRE ATT&CK Navigator tool allows analysts and hunters to map, compare, and link attack techniques to known APT groups.
Register free for 6 more questions
Or unlock all 152 300-220 questions with explanations, timed mode and flashcards.
