City SOC has three open hunts: an unknown actor on the assessor network, a known campaign with ISAC IoCs, and a question of whether someone turned off Sysmon on a jump host. How should the analyst match techniques?
Select an answer to reveal the explanation.
Short Explanation
Pick the camera that matches what you already know: unknown actor gets behavior or a model, known campaign IoCs get an indicator sweep, and a killed Sysmon question is configuration. One hash search does not answer all three.
Full Explanation
Domain 6.1 hunting techniques map to the knowledge available for each open question. An unknown actor on the assessor network has no reliable IoC, so behavioral analytics or anomaly modeling is the fit; a known campaign with ISAC IoCs calls for indicator hunting across matching telemetry; and whether someone turned off Sysmon on a jump host is a configuration or state hunt. Matching techniques that way lets the city SOC pursue all three hunts without forcing every question through the same search pattern. Using indicator sweeps for the unknown actor, configuration hunting for the ISAC IoCs, and modeling for Sysmon inverts those assignments and wastes the best available signal for each case. Collapsing all three questions into one index=* hash search ignores unknown-actor behavior, known-campaign domains that may not be hashes, and Sysmon configuration state entirely. Using configuration hunting for the unknown actor and behavioral analytics for the disabled-Sysmon question likewise mis-maps state versus identity-sequence techniques. Exam caveat: technique selection is a tested skill—pair unknown/no-IoC with behavior or modeling, known IoCs with indicator hunting, and settings questions with configuration hunting. Operational check: label each open hunt with its knowledge type, pick one representative search per technique (behavior/model for assessor, IoC for ISAC indicators, config for Sysmon), and verify each search answers its labeled question before sharing results with leadership.