Fundamental Concepts of Cyber Threat Analyst and Threat Hunting
Domain 1 covers the fundamental concepts of the cyber threat analyst role and threat hunting. The exam tests whether you can separate proactive hunting from reactive monitoring, choose evidence that supports a hypothesis, and explain how common models structure analysis.
Core rules and concepts
- Threat intelligence informs hunting; a hunt begins with a testable hypothesis about adversary behavior, not with an alert queue.
- IOCs are atomic artifacts such as hashes or domains; IOAs describe behavior. IOCs expire quickly, so hunting should emphasize TTPs.
- MITRE ATT&CK maps adversary tactics and techniques; the Cyber Kill Chain stages an intrusion; the Diamond Model links adversary, infrastructure, capability, and victim.
- Hunting is iterative: scope, hypothesize, collect data, analyze, validate, and feed detections or knowledge back.
- Analyst judgment must be documented: data source, time range, query logic, exclusions, and confidence.
Worked example
Hypothesis: a financially motivated actor uses PowerShell to download payloads from newly registered domains. Scope 30 days of proxy and EDR data. Query for powershell.exe with encoded commands and outbound HTTP to domains less than 30 days old. Two hosts match. One is an administrator running a sanctioned script; the other has a Word parent process and a rare hash. Validate user role, parent process, domain reputation, and hash prevalence. The second host is escalated as a probable intrusion; the first is documented as benign with the exclusion rationale.
Traps that cost marks
Treating threat hunting as alert triage, vulnerability scanning, or IOC blocking. Accepting a hit without testing alternative explanations. Omitting scope and data-quality limits. Failing to record negative findings, which are valuable for future hunts.