I85PREP
⌘ K
ATT&CK Threat Hunting study materials
ATT&CK Threat Hunting study resources

ATT&CK Threat Hunting: Telemetry Sources and Data Quality (Windows, Linux, macOS, Cloud, Network)

ATT&CK Threat Hunting · Work through your exam, one topic at a time.

All guide sections

Telemetry Sources and Data Quality (Windows, Linux, macOS, Cloud, Network)

What this domain tests

This domain tests whether you know which telemetry can answer which behavior, and where visibility, retention, parsing, and fidelity limits create false confidence.

Core rules

  • Windows: Security 4688 gives process creation only when command-line auditing is enabled; 4624 and 4625 show logon outcomes; 4672 shows special privileges; 4698 shows scheduled task creation; 4697 shows service installation. Sysmon adds process, network, image load, process access, file, registry, and DNS events. PowerShell 4104 provides script block content.
  • Linux: auditd execve, authentication logs, and EDR or eBPF telemetry are stronger than shell history. macOS: Unified Log and Endpoint Security framework telemetry cover process and launchd activity; shell history is low fidelity.
  • Cloud: control-plane audit logs such as CloudTrail, Azure Activity, and GCP Audit Logs show API actions; data-plane and identity logs are separate. Network: Zeek, proxy, DNS, firewall, and NetFlow reveal connections but often not full content.
  • Quality dimensions include completeness, timeliness, field fidelity, parsing, clock synchronization, retention, and coverage. A log source can exist but lack the field needed for the hunt.

Worked example

A hunt for T1059.001 PowerShell needs script-block or process command-line evidence. Security 4104 plus 4688 or Sysmon event 1 can show the script and the invoking process. A 4624 logon event alone cannot confirm PowerShell execution. If 4104 is disabled and EDR script-block logging is absent, record a coverage gap rather than claiming the behavior is absent.

Traps that cost marks

Assuming default Windows logging includes command lines, treating Sysmon as universal, confusing cloud control-plane and data-plane logs, and ignoring retention or time-zone mismatches.