PECB Certified Cyber Threat Analyst cheat sheet

Threat hunting is a hypothesis-driven, iterative search through networks and endpoints for undetected adversary activity; it is proactive and analyst-led, unlike alert-driven monitoring.

Threat intelligence is evidence-based knowledge about an existing or emerging menace, including context, mechanisms, indicators, implications, and actionable advice sufficient to inform decisions.

The intelligence cycle: direction/planning, collection, processing, analysis, dissemination, and feedback; each stage is repeatable and the loop restarts when requirements change.

Data quality hierarchy: data (raw events) to information (correlated events) to intelligence (context, assessment of adversary intent and capability); each level adds interpretation and cost.

Pyramid of Pain ranks indicators by difficulty for an adversary to change: hash values, IP addresses, domain names, network/host artifacts, tools, TTPs; TTPs cause the greatest pain to change.

Diamond Model describes every intrusion event by four vertices: adversary, capability, infrastructure, and victim; edges represent their relationships and pivot points for analysis.

MITRE ATT&CK organizes adversary behavior into tactics (the why, e.g., persistence) and techniques (the how, e.g., scheduled task); tactics are goals, techniques are methods.

F3EAD loop (Find, Fix, Finish, Exploit, Analyze, Disseminate) couples threat intelligence with operations; Analyze and Disseminate feed new requirements back into Find.

Threat hunting maturity model levels: initial (relying on automated alerting), minimal (searching for IOCs), procedural (using TTP-based hypotheses), innovative (automated analytics, continuous improvement).

Hunt hypothesis sources: intelligence requirements, ATT&CK gap analysis, new threat reporting, incident lessons learned, and anomalous telemetry; a hunt without a testable hypothesis is exploratory analytics, not a hunt.

Hunt lifecycle: trigger/scope definition, hypothesis formulation, data collection and validation, analysis, finding classification (benign, suspicious, malicious), response, and documentation of lessons.

Data readiness checks before hunting: log source coverage, retention window, time synchronization accuracy, field normalization, and known blind spots from asset inventory gaps.

Incident management plan phases per NIST SP 800-61: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity.

Containment strategy selection criteria: potential damage and theft, evidence preservation needs, service availability, time and resources, and effectiveness of the chosen strategy.

Severity classification drives escalation; typical inputs are data sensitivity, number of affected assets, business criticality, adversary capability, and containment difficulty.

A runbook differs from a playbook: a playbook is a high-level decision flow for a scenario type, a runbook lists concrete step-by-step commands and owners for execution.

Tabletop exercises validate the plan without production impact; success criteria include time to detect, escalation accuracy, decision latency, and communication completeness.

Evidence handling: maintain chain of custody, hash acquired images, record collector identity and time, and store copies on write-once or access-controlled media.

Analysis of competing hypotheses (ACH): enumerate hypotheses, list evidence, rate consistency, refute rather than confirm, and report the hypothesis surviving least refutation.

Indicator pivoting uses shared attributes (same C2 domain, same certificate, same user agent) to cluster related activity; pivoting on TTPs yields longer-lived detections than pivoting on hashes.

Intrusion analysis timeline reconstruction requires normalized UTC timestamps; clock skew between sources must be quantified before ordering events.

Knowledge base content: hunt hypotheses and results, detection rules with rationale, false-positive notes, actor profiles, and mapping of detections to ATT&CK coverage.

Detection rule quality metrics: true positive rate, false positive rate, mean time to detect, rule age, and coverage per technique; a rule with no documented owner is a maintenance liability.

TTP-based detection is more durable than IOC-based detection because techniques persist across campaigns while infrastructure and hashes rotate.

Kill chain stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives; mapping findings to stages reveals defense gaps.

Analysis output must state confidence level and supporting evidence; separate observed facts from analytic judgments to keep reports defensible.

Post-hunt knowledge capture: convert successful hunts into automated detections, update threat model, and feed coverage gaps into the next hunt backlog.

Control types: preventive (blocks), detective (identifies), corrective (restores), compensating (alternative when primary control is infeasible); controls are also classified as administrative, technical, or physical.

Defense in depth layers controls across perimeter, network, endpoint, identity, data, and application tiers so a single control failure does not expose the asset.

Least privilege and separation of duties limit blast radius; privileged access should be time-bound, logged, and reviewed on a defined cadence.

Logging baseline: authentication events, privilege changes, process creation, network connections, and configuration changes; retention must satisfy both investigation and legal hold needs.

Change management steps: request, risk assessment, approval, test, scheduled implementation, verification, and rollback plan; emergency changes require retroactive review.

Configuration drift is detected by comparing live state to a hardened baseline (e.g., CIS Benchmarks); unmanaged drift invalidates detection assumptions built on expected state.

Vulnerability management prioritization uses exploitability, exposure, asset criticality, and known exploitation in the wild, not CVSS score alone.

Incident-to-change linkage: eradication actions (patching, reimaging, firewall changes) must flow through change records so the environment remains documented and auditable.

Business continuity and disaster recovery metrics: RTO is maximum tolerable downtime, RPO is maximum tolerable data loss; both must be tested, not merely documented.

Security culture dimensions (Schein-inspired practice): visible artifacts, espoused values, and underlying assumptions; surveys measure perception while behavior metrics measure practice.

Culture indicators: phishing simulation report rate and click rate, helpdesk reports of suspicious email, policy attestation completion, and near-miss reporting volume.

A blame-free reporting model increases detection speed; punishing reporters suppresses reporting and lengthens attacker dwell time.

KPI examples: mean time to detect, mean time to respond, percentage of assets with logging, hunt hypotheses executed per quarter, patch compliance within SLA.

KRI examples: rising unpatched critical vulnerabilities, increase in anomalous authentication failures, growth of unmanaged devices, expired certificates or detections.

SMART criteria for security objectives: specific, measurable, achievable, relevant, time-bound; each objective needs an owner, data source, and reporting cadence.

Maturity assessment models (e.g., CMMI-style levels 1-5) provide a repeatable scale; scoring must be evidence-based, not self-declared.

PDCA (plan-do-check-act) underpins continual improvement: measure against baseline, identify gaps, implement corrective action, verify effectiveness, re-baseline.

Post-incident review produces corrective actions with owners and due dates; effectiveness is verified by re-testing, not by closing the ticket.