Threat intelligence sources, indicators of compromise, and detection techniques tested on CompTIA CySA+.
40 cards · basic cards · AI-written, checked twice. Edit anything.
- What are the three main types of threat intelligence by time relevance?
- Strategic (long-term trends), tactical (current campaigns and techniques), operational (immediate threats and indicators)
- Define indicator of compromise (IoC).
- Observable evidence of a security incident or attack, such as a malicious IP address, file hash, or domain name
- What is OSINT in threat intelligence?
- Open-source intelligence; gathering data from publicly available sources like social media, news, forums, and public databases
- Name three common indicators of compromise.
- IP addresses, domain names, file hashes (MD5, SHA-1, SHA-256)
- What is a C2 channel in the context of detection?
- Command and control channel; the communication path an attacker uses to control compromised systems
- Define a false positive in threat detection.
- A legitimate activity or event incorrectly identified as a security threat
- What is behavioral analysis in endpoint detection?
- Monitoring system processes and user actions for patterns consistent with known attack techniques, rather than matching signatures
- Name the MITRE framework commonly used to map adversary tactics and techniques.
- MITRE ATT&CK
- What is the Cyber Kill Chain?
- A seven-step model describing the phases of a cyberattack: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives
- What log type is most useful for detecting lateral movement within a network?
- Windows Event Logs (especially event ID 4624 for logon events) or syslog from network devices
- Define a zero-day indicator.
- An observable artifact from an attack exploiting a previously unknown vulnerability that has no publicly disclosed fix
- What is threat hunting?
- Proactively searching network logs and data for signs of compromise or suspicious behavior that automated detection may have missed
- What does STIX stand for?
- Structured Threat Information Expression; a standardized format for representing and sharing threat intelligence data
- Name a common source of paid threat intelligence.
- Commercial threat intelligence vendors, dark web monitoring services, exploit databases, or intelligence-sharing communities
- What is a false negative in detection?
- A real security incident or malicious activity that the detection system fails to identify