Threat Intelligence in Incident Response and Hunting
This domain tests whether you can use intelligence to shorten an intrusion, and whether you can distinguish real hunting from an indicator sweep with a marketing name.
Intelligence across the IR lifecycle
- Preparation: actor playbooks, sector-relevant TTPs, and detection coverage mapped to ATT&CK.
- Detection and scoping: intelligence turns one alert into a hypothesis about the actor's full toolkit - what else to look for, which persistence they favour, which credentials they target.
- Containment: actor intent drives urgency; a hands-on-keyboard operator staging ransomware justifies immediate isolation, commodity malware may not.
- Eradication and recovery: known infrastructure and tooling guide sweeping for leftovers.
- Lessons learned: what the actor did that you could not see becomes a detection requirement.
Hunting is hypothesis-driven
The hunting loop: form a hypothesis from intelligence → identify data sources that can test it → query → validate findings → convert to a detection → feed gaps back to collection. A hunt without a hypothesis is data fishing; a scheduled scan for known hashes is indicator matching, and hunting maturity models place it at the lowest level.
IOC sweep versus TTP hunt
Atomic indicators catch only the exact sample and decay quickly. Behavioural hunts - rundll32 loading a .dat argument, LSASS access by a non-security process - survive tool changes and catch variants. Retro-hunting applies a new detection to historical telemetry to surface earlier, missed compromise.
Detection engineering
Every hunt should produce an artefact: a Sigma rule, a KQL or Splunk query, a YARA rule, or a documented data gap. A rule that fires thousands of times in production was not validated.
Worked example
Intelligence reports a sector peer hit by a loader persisting via a scheduled task that runs a signed binary with a proxy-execution argument. Hypothesis: if the actor is present, we will see a scheduled task invoking a signed system binary with an unusual parent or a remote argument. Data: EDR process creation with command lines, plus task scheduler logs. The query returns 40 hits; 37 are legitimate update tasks; three invoke a binary from a user-writable path with an external argument. Two are a known admin tool; one is unexplained with an Office parent. Escalate to IR, isolate the host, write a Sigma rule excluding the update tasks and the admin tool, and log the data gap that command-line logging is off on two server groups.
Traps
Calling an IOC sweep threat hunting. Hunting without confirming the data source exists or retains enough history. Shipping detections never tested against production volume. Ignoring non-technical intelligence - actor intent and tempo should shape containment priority, not just technical artefacts.