OffSec Threat Hunter flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Ransomware-as-a-Service (RaaS)

A criminal business model where core operators develop ransomware and a leak site, and affiliates pay a cut to use the payload. LockBit and ALPHV operated this way, which lets affiliates rebrand payloads and complicates attribution.

Double extortion

A ransomware tactic where attackers first exfiltrate sensitive data, then encrypt and demand payment for both decryption and non-disclosure. CLOP popularized data-theft-only extortion without encryption.

LockBit Black builder leak

In 2022 the LockBit 3.0 builder was leaked, allowing copycats to generate custom payloads. Hunting must therefore rely on behavior (recovery disabling, shadow copy deletion) rather than hash or extension alone.

BlackCat/ALPHV Rust ransomware

BlackCat was the first widely documented Rust-based ransomware, notable for fast, cross-platform encryption and command-line flags controlling encryption percentage. ALPHV was the affiliate brand and negotiation panel.

CLOP MOVEit exploitation

CLOP mass-exploited CVE-2023-34362, a SQL injection in MOVEit Transfer leading to remote code execution, dropping web shells such as human2.aspx to stage and exfiltrate files from many victims at once.

Pyramid of Pain

A model ranking IoCs by how much cost they impose on an adversary. Hashes are lowest, then IPs, domains, host artifacts, tools, and TTPs highest. Hunting TTPs yields durable detections; atomic IoCs decay quickly.

Living-off-the-land binary (LOLBin)

A signed, legitimate OS binary such as certutil, bitsadmin, or mshta abused to download, execute, or evade controls. Because it is signed and common, allowlisting alone will not stop it; command-line context is required.

JA3 and JA3S fingerprints

TLS client and server fingerprints derived from ClientHello and ServerHello fields such as version, ciphers, and extensions. They identify malware TLS stacks even when domains and IPs rotate, making them structural IoCs.

Sysmon Event ID 10

ProcessAccess event, logged when one process opens a handle to another. Repeated access to lsass.exe by non-security processes is a primary credential-dumping signal (MITRE T1003.001).

Sysmon Event ID 8

CreateRemoteThread event, logged when a process creates a thread in another process. It is a key signal for process injection techniques such as remote thread injection used by many loaders and ransomware affiliates.

Windows event 4769

A Kerberos service ticket (TGS) was requested. A burst of 4769 events using RC4 encryption for many service accounts indicates Kerberoasting, where attackers request tickets to crack service account passwords offline.

Beaconing jitter analysis

Detecting command-and-control by measuring the interval between outbound connections to a destination. Low-variance intervals, especially with small random jitter, indicate automated beaconing rather than human browsing.

Zerologon (CVE-2020-1472)

A critical Netlogon privilege escalation allowing an unauthenticated attacker to impersonate a domain controller. Hunting signal is event 4742, a machine account password change outside normal rotation.

ProxyLogon and ProxyShell

Exchange Server vulnerability chains (CVE-2021-26855 and CVE-2021-34473/34523/31207) allowing pre-auth remote code execution. Hunting signal is w3wp.exe spawning cmd.exe or powershell.exe.

Log4Shell (CVE-2021-44228)

A JNDI lookup injection in Log4j 2 allowing remote code execution. Hunt for JNDI strings in headers and logs, and outbound LDAP, RMI, or DNS traffic from Java processes to unusual destinations.

Suricata drop action

The rule action that blocks matching traffic. It only takes effect in inline IPS mode; in IDS mode drop behaves like alert. Reject additionally sends a TCP reset to terminate the session.

Suricata sid option

A required unique signature identifier in every rule. Without it the engine rejects the rule. Local rules conventionally use a high range such as 1000000+ to avoid collisions with vendor rule sets.

Suricata flowbits

A state-tracking mechanism letting one rule set a named flag and another test it, enabling multi-packet logic such as alerting only after a request and response pair is observed in the same flow.

Suricata eve.json

The unified JSON output containing alerts plus protocol metadata for flow, dns, tls, http, and fileinfo events. It is the primary data source for SIEM ingestion and post-hoc hunting.

Suricata fast_pattern

A content modifier that tells the engine to use that content string as the initial prefilter. Choosing a distinctive, rare string improves rule performance by reducing expensive subsequent checks.

Falcon ProcessRollup2

A CrowdStrike Falcon event recording process execution, with fields for ImageFileName, ParentBaseFileName, CommandLine, SHA256HashData, UserName, and RawProcessId. It is the core event for parent-child anomaly hunting.

Falcon Query Language (FQL)

The search syntax for Falcon event data. It uses field=value pairs, wildcards, regex in slashes with flags, and pipes to aggregations such as stats count by ComputerName. Field names are case-sensitive.

Falcon Real Time Response (RTR)

A live investigation capability that runs commands such as ps, netstat, and reg query on an endpoint, and can retrieve files for triage. Sessions are audited and gated by role-based permissions.

Falcon custom IOA

An indicator of attack that matches behavioral sequences, such as credential dumping followed by network egress, rather than static hashes. It can be deployed in monitor or block mode.

Falcon correlation by RawProcessId

Joining ProcessRollup2 to NetworkConnectIP4 on agent ID and RawProcessId within a short time window identifies which process made a network connection, a core technique for attributing egress to malware.

Hypothesis-driven hunting

A methodology that starts with a testable statement linking an ATT&CK technique to an expected observable in a named data source and time window, then queries to confirm or refute it.

MITRE ATT&CK

A curated knowledge base of adversary tactics and techniques organized by goal, such as execution or persistence. It provides the taxonomy for writing hypotheses and measuring detection coverage per technique.

Sqrrl Hunting Loop

A four-stage cycle: hypothesis, investigate via queries, uncover patterns, and automate the successful detection. Automation converts one-off hunt findings into standing analytics for continuous coverage.

Purple teaming

A collaborative exercise where red team executes a technique and blue team verifies whether it was detected. Gaps become new detections, producing measurable ATT&CK coverage rather than a pass-fail score.

Mean time to detect (MTTD)

The average elapsed time between an adversary action and its detection. It is a core defender metric, tracked as a trend per technique or data source rather than as a single-point value.

Honeytoken

A decoy credential, file, or account that legitimate users should never access. Any interaction generates a high-fidelity alert with a low false positive rate, making it useful for detecting lateral movement.

Challenge Lab evidence chain

A graded deliverable requiring a hypothesis, the query used, exported evidence, a UTC timeline, extracted IoCs, a testable detection rule, and a containment recommendation, chaining at least three related events.