Explain threat intelligence and threat-hunting concepts
Intelligence sources and confidence levels, threat actors and TTPs, indicators of compromise, and proactively hunting what no alert has flagged.
- Reading time
- 26 min read
- Flashcards
- 20 cards
- Practice questions
- 10 questions · 2 PBQs
Two related but distinct disciplines share this objective. Threat intelligence is knowing what is out there. Threat hunting is looking for it in your own environment before anything alerts.
The link between them is a single sentence worth memorising: intelligence gives you the hypothesis, hunting tests it against your data.
What makes intelligence intelligence
Raw data is not intelligence. A list of IP addresses is data. Intelligence is data that has been evaluated, contextualised, and made actionable for a specific consumer.
Confidence levels
An assessment of how reliable a piece of intelligence is, combining source reliability with the credibility of the information itself. Acting on low-confidence intelligence as though it were high-confidence is how SOCs block their own payroll provider.
Timeliness, relevance, accuracy
The three properties intelligence is judged on. Timeliness — is it still true? Relevance — does it apply to your sector, your stack, your threat model? Accuracy — is it correct? A feed can be accurate and current and still be worthless because none of it applies to you.
Where intelligence comes from
| Source | What it is | The catch |
|---|---|---|
| OSINT | Publicly available — reports, blogs, social media, public feeds | Free and broad; also noisy, and adversaries read it too |
| Closed / proprietary | Commercial vendor feeds | Higher fidelity, curated — and expensive |
| ISAC | Sector-specific sharing body (financial, health, energy) | The most relevant source available to most organisations |
| Government / CISA | National advisories and alerts | Authoritative, sometimes slower than commercial |
| Internal | Your own past incidents | The highest-relevance source you have, and the one most often ignored |
| Dark web | Criminal forums and markets | Early warning of leaked credentials and planned targeting; access and legality are non-trivial |
Threat actors, and what actually distinguishes them
Sort by motivation
- Nation-state — espionage, disruption, strategic advantage
- Organised crime — money, at scale
- Hacktivist — ideology and publicity
- Insider — grievance, money, or accident
Sort by capability
- Nation-state — zero-days, long dwell time, custom tooling
- Organised crime — professional, commoditised, ransomware-as-a-service
- Hacktivist — mostly defacement and DDoS
- Unskilled attacker — public tools, no development capability
The tellExam stems describe behaviour and ask you to attribute it. Patient, quiet, targeted, and custom-built points to a nation-state; loud, fast and monetised points to organised crime.
TTPs
Tactics, techniques and procedures — how an actor operates rather than what infrastructure they used this week. TTPs are the durable part of an adversary's identity, which is why ATT&CK catalogues them and why detections built on TTPs outlive detections built on IPs.
The Pyramid of Pain
This is the single most testable concept in the objective. It ranks indicator types by how much it hurts the adversary when you detect on them.
- Hash values — trivial. Recompile, change one byte, new hash.
- IP addresses — easy. Rent another server.
- Domain names — slightly annoying. Register another domain.
- Network and host artefacts — annoying. Requires changing the tooling's fingerprints.
- Tools — challenging. They must find or build a replacement.
- TTPs — hard. You are forcing them to change how they work.
The practical consequence: blocking a hash stops nothing, but detecting the behaviour — a Word process spawning PowerShell, a service account logging on interactively — catches every future variant.
Check yourself
A SOC blocks 40 file hashes from a threat report. Two weeks later the same actor is inside the network again. What went wrong?
Threat hunting
Threat hunting
Proactively searching for adversary activity that no alert has flagged. It assumes a compromise may already exist and that detections have gaps — which is the opposite of waiting for the queue to fill.
Hunts start from a hypothesis, not from a tool. The three that appear on the exam:
- Intelligence-driven — "This actor targets our sector and uses scheduled tasks for persistence. Do we have unexplained scheduled tasks?"
- Situational awareness / crown jewels — "What would matter most if it were compromised? Start there."
- Anomaly-driven — "What in this data is unusual, and is there an innocent explanation?"
Delivering the outcome is part of the process, not paperwork after it. A hunt should end with documented findings, new or tuned detections, and where possible an automated version of the query — so the next occurrence alerts rather than waiting for the next hunt.
Check yourself
Which of these is a genuine threat-hunting hypothesis?