City SOC has three open hunts: an unknown actor on the assessor net…

Question

City SOC has three open hunts: an unknown actor on the assessor network, a known campaign with ISAC IoCs, and a question of whether someone turned off Sysmon on a jump host. How should the analyst match techniques?

Accepted Answer

Use behavioral or modeling hunts for the unknown actor, indicator hunting for the known-campaign IoCs, and configuration hunting for the Sysmon question. — Pick the camera that matches what you already know: unknown actor gets behavior or a model, known campaign IoCs get an indicator sweep, and a killed Sysmon question is configuration. One hash search does not answer all three.

Answer

Use indicator sweeps for the unknown actor, configuration hunting for the ISAC IoCs, and modeling for Sysmon.

Answer

Use one index= hash search for all three questions.

Answer

Use configuration hunting for the unknown actor and behavioral analytics for the disabled Sysmon question.

City SOC has three open hunts: an unknown actor on the assessor network, a known campaign with ISAC IoCs, and a question of whether someone turned off Sysmon on a jump host. How should the analyst match techniques?

Short Explanation

Full Explanation