Indicators of Compromise and Threat Hunting
What this domain tests
Indicators of compromise and threat hunting tests whether you can distinguish atomic indicators from behavioral detection, manage indicator lifecycle and context, and run hypothesis-driven hunts that produce durable detections. Expect questions about the Pyramid of Pain, false positives, and ATT&CK mapping.
Indicator types and the Pyramid of Pain
- Atomic indicators: file hashes, IP addresses, domains, URLs, email addresses, and user-agent strings. Easy to change and easy to block.
- Behavioral indicators: command lines, registry keys, scheduled tasks, named pipes, service creation, and authentication patterns. Harder to change without disrupting the adversary.
- The Pyramid of Pain ranks hash values, IP addresses, domain names, network/host artifacts, tools, and TTPs; detection value and adversary cost rise toward the top. A hash blocklist is not a hunting strategy.
- Context determines meaning: a domain may be a shared CDN, a hash may belong to a signed legitimate binary, and an IP may be a VPN exit.
Indicator lifecycle
Generate or receive indicators, validate them, enrich with context, score by confidence and relevance, deploy to controls, monitor hits, age them out, and record provenance. Indicators have a shelf life; infrastructure is reused and reallocated. Track false positives and tune. A hit is not a compromise.
Threat hunting
Hunting is a structured, hypothesis-driven search for undetected adversary activity. Start from a question or an ATT&CK gap, identify the data sources, write queries, triage results, and convert validated findings into detections or hunts. Document the hypothesis, data, queries, findings, and gaps. Hunting differs from monitoring (alert-driven) and incident response (confirmed event).
Worked example
Hypothesis: an actor uses certutil to download payloads. Data source: process creation with command lines. Query for certutil with URL or -decode arguments, unusual parent processes, and execution from user-writable paths. Triage removes legitimate administrators and software deployment. A validated case reveals a loader; the output is a Sigma rule, an EDR analytic, and a follow-on hunt for the loader's persistence. The reasoning is that the behavior survives hash changes and is more valuable than the downloaded file's hash.
Traps that cost marks
- Treating blocklists as intelligence or as a complete defense.
- Ignoring indicator aging and shared infrastructure.
- Hunting without a hypothesis or success criterion.
- Confusing an ATT&CK technique with a ready detection.
- Failing to tune false positives and measure detection quality.
- Not feeding hunt findings back into detection engineering.