Threat Hunt Cheat Sheet Threat Hunt Cheat Sheet
CySA+ Domain 1: Threat and Vulnerability Management
CYBER SENTRY TRAINING
Resource ID: TVM-SG-01
Student Name ________________________________
Date ________________
Core Concepts & Definitions
Threat Intelligence
The process of gathering and analyzing information about potential or current attacks. It categorized into Strategic (broad trends), Operational (specific attacks), and Tactical (IOCs like IPs/hashes).
Vulnerability Management
A continuous cycle of identifying, classifying, prioritizing, remediating, and mitigating software vulnerabilities. Key metrics include MTTR (Mean Time to Remediate) and scan coverage.
Asset Discovery
The first step in any security program. You cannot protect what you don't know exists. Involves active scanning, passive listening, and integration with CMDBs.
Remediation vs. Mitigation
Remediation fully fixes the vulnerability (e.g., applying a patch). Mitigation reduces the risk or impact when a patch isn't available (e.g., blocking a port at the firewall).
Domain Glossary
CVSS Common Vulnerability Scoring System
A framework for communicating the characteristics and severity of software vulnerabilities. Example: A vulnerability with a CVSS score of 9.8 is considered Critical, likely remotely exploitable without authentication.
STIX/TAXII Interoperability Standards
STIX is the language for describing cyber threat information; TAXII is the transport mechanism. Example: An ISAC sharing IP blacklists with members automatically via a TAXII feed.
False Positive Detection Error
When a security tool incorrectly flags a legitimate activity as malicious. Example: A vulnerability scanner flagging a custom internal application as having a "known SQL injection" because it uses similar syntax for a different purpose.
Credentialed Scan Authenticated Scanning
A scan performed using valid login credentials for the target system. Example: Using a service account to log into a Windows server to check for missing registry keys or non-running security services.
The Vulnerability Management Lifecycle
1
Discover
Inventory assets
2
Prioritize
Categorize risk
3
Assess
Scan for flaws
4
Report
Document findings
5
Remediate
Patch or fix
Vulnerability Scan Scenarios Vulnerability Scan Scenarios
Domain 1: Threat and Vulnerability Management Practice
Practice Lab
CYSA-LAB-01
Candidate Name ________________________________
Date ________________
1
Scenario: The Compliance Ghost
A junior security analyst runs a monthly vulnerability scan against the corporate web server. The report shows zero critical or high vulnerabilities. However, a manual audit two days later reveals that the server is missing three critical security patches released four months ago.
Analysis Question:
What is the most likely cause for this discrepancy, and what scanning adjustment should be made?
2
Scenario: The CVSS Dilemma
Your team discovers a vulnerability with a CVSS score of 8.2 (High) in an internal legacy database server. The database contains non-sensitive inventory data and is only accessible via a VPN used by 5 employees. Simultaneously, a vulnerability with a CVSS score of 6.5 (Medium) is found on the public-facing e-commerce web server.
Analysis Question:
Explain why you might prioritize the Medium vulnerability over the High one. What environmental factors are at play?
3
Scenario: Agent vs. Agentless
Your organization is expanding its cloud presence and adding 500 transient virtual instances per day. Network-based scanning is causing performance issues and missing instances that are powered down during the scan window.
Analysis Question:
Recommend a scanning strategy that addresses transient instances and reduces network overhead. Justify your choice.
Analytical Depth
Technical Accuracy
Total Grade: ____ / 30
Threat Landscape Mind Map Threat Landscape Mind Map
Domain 1: Mapping the Threat Environment
Graphic Organizer
Analyst Name
Date
THREAT
Intelligence Sources
OSINT Sources...
Industry ISACs...
Proprietary Feeds...
Vulnerability Types
Software Flaws
Misconfigs
Legacy Systems
Third-Party
Threat Actors
Nation-State
Organized Crime
Hacktivists
Intelligence Levels
Strategic (Executive)
Operational (Attack-Specific)
Tactical (IOCs)
Mapping Instructions:
Populate the dashed boxes with specific examples or characteristics relevant to your organization. Focus on identifying the links between threat intelligence (how we know) and vulnerability types (what is at risk).
Scan Scenarios Key Vulnerability Scan Scenarios
Instructor Answer Key & Facilitation Guide
Instructor Use Only
KEY-LAB-01
Scenario 1: The Compliance Ghost
Correct Technical Cause:
The most likely cause is a Non-Credentialed (Unauthenticated) Scan . Without credentials, the scanner only sees the server's external "attack surface" (open ports and version banners) and cannot inspect the internal registry or file system to see that specific security patches are missing.
Adjustment:
Switch to a Credentialed Scan using a service account with appropriate permissions.
Scenario 2: The CVSS Dilemma
Prioritization Logic:
Priority should go to the Medium (6.5) on the public server. In the CVSS Temporal and Environmental groups, Exploitability and Scope are critical. The High score is on a legacy server behind a VPN (low accessibility), while the Medium is public-facing (high exposure). The public server represents a higher Business Risk and a more likely attack vector.
Scenario 3: Agent vs. Agentless
Recommended Strategy:
Agent-Based Scanning .
Justification:
Agents reside on the host and report back when the instance is powered on, solving the transient instance issue.
Reduces network overhead by eliminating the need for large network sweeps.
Provides deep visibility (credentialed by default) without needing to manage scan credentials across cloud VPCs.
Instructor Facilitation Notes
Encourage students to think beyond the numerical score. In CySA+, the correct answer often depends on the context (Environmental metrics) rather than just the Base score. Ensure they use technical terms like "Attack Surface," "VPC," and "Credentialed" correctly.
Secure Systems Guide Secure Systems Guide
CySA+ Domain 2: Software and Systems Security
CYBER SENTRY TRAINING
Resource ID: SSS-SG-02
Student Name ________________________________
Date ________________
System Architecture & Design
Zero Trust Architecture (ZTA)
A security model based on the principle of "never trust, always verify." It requires strict identity verification for every person and device trying to access resources, regardless of whether they are sitting inside or outside the network perimeter.
Segmentation & Isolation
Dividing a network into smaller, distinct parts (subnets/VLANs) to limit "East-West" lateral movement by attackers. Micro-segmentation goes further by creating zones for individual workloads.
SDLC Security
Integrating security into every phase of the Software Development Life Cycle. Includes SAST (Static Analysis - code review) and DAST (Dynamic Analysis - runtime testing).
Infrastructure as Code (IaC)
Managing and provisioning infrastructure through machine-readable definition files. This allows for version control, automated security linting, and consistent deployments.
Domain Glossary
Containerization Resource Isolation
Packaging software and its dependencies into a single unit that can run consistently across environments. Example: A Docker container running an Nginx server, isolated from the host OS kernel.
CASB Cloud Access Security Broker
Software or hardware that sits between cloud service consumers and providers to enforce security policies. Example: Using a CASB to prevent users from uploading unencrypted PII to a public Dropbox account.
Fuzzing Input Testing
An automated testing technique that provides invalid, unexpected, or random data as inputs to a computer program. Example: Using a fuzzer to send thousands of malformed HTTP requests to a web API to find memory leaks or crashes.
Shared Responsibility Model
On-Premises
Customer manages EVERYTHING
IaaS / PaaS
Shared management of OS/Apps
SaaS
Provider manages Apps/Hardware
NOTE: CUSTOMER ALWAYS REMAINS RESPONSIBLE FOR DATA
Software Security Scenarios Software Security Scenarios
Domain 2: System Architecture & Secure SDLC
Case Study Lab
SSS-LAB-02
Candidate Name ________________________________
Date ________________
1
Scenario: The Agile Breach
A company adopts a fast-paced Agile development model. To speed up deployments, they decide to skip Static Application Security Testing (SAST) in favor of post-deployment Dynamic Testing (DAST). A month later, a SQL injection vulnerability in a legacy module is exploited, leading to a massive data leak.
Analysis Question:
Identify the flaw in this testing strategy. How would shifting left have prevented this specific incident?
2
Scenario: Zero Trust Migration
Your organization is migrating its internal payroll application to a public cloud (SaaS). Employees access it from both office and home. The CTO wants to move away from VPN-based access to a Zero Trust Architecture (ZTA).
Analysis Question:
Describe three core components or signals you would use to authenticate a user's request under a Zero Trust model before granting access to payroll.
3
Scenario: Hardening the Image
A DevOps team is using containerized microservices for their application. During a security audit, it is found that many containers are running as 'root' and include unnecessary packages like 'curl', 'ping', and 'net-tools'.
Analysis Question:
Apply the Principle of Least Privilege and Attack Surface Reduction here. What specific changes would you recommend for the Dockerfile?
Architecture Logic
SDLC Awareness
Total Grade: ____ / 30
Software Scenarios Key Software Security Scenarios
Instructor Answer Key & Facilitation Guide
Instructor Use Only
KEY-LAB-02
Scenario 1: The Agile Breach
Testing Strategy Flaw:
The flaw is relying solely on DAST (runtime) while ignoring SAST (source code) . DAST often misses flaws in "dead" or rarely used code paths and legacy modules that aren't actively triggered during a scan.
Shift Left Benefit:
Shifting Left (integrating SAST/code review earlier) would have identified the SQL injection pattern in the source code before it was ever compiled or deployed, regardless of whether a runtime scanner "hit" that page.
Scenario 2: Zero Trust Migration
Core Signals/Components:
User Identity: Multi-Factor Authentication (MFA) or biometric verification.Device Health: Checking for up-to-date antivirus, OS patches, and managed/unmanaged status via EDR.Contextual Signals: IP reputation (is it a known VPN/Tor?), geo-velocity (impossible travel), and time-of-day access patterns.
Scenario 3: Hardening the Image
Dockerfile Recommendations:
User Definition: Use the USER instruction to switch from 'root' to a non-privileged system user (e.g., USER appuser).Base Image: Use a Minimal/Distroless base image (e.g., Alpine Linux) that doesn't include shell utilities like curl/ping.Package Removal: Explicitly uninstall or exclude unnecessary network utilities to reduce the attack surface. SOC Monitoring Guide SOC Monitoring Guide
CySA+ Domain 3: Security Operations and Monitoring
CYBER SENTRY TRAINING
Resource ID: SOM-SG-03
Student Name ________________________________
Date ________________
Continuous Monitoring & Analysis
SIEM (Security Information & Event Management)
A tool that provides real-time analysis of security alerts generated by applications and network hardware. Key functions: Log Aggregation , Correlation , and Alerting .
SOAR (Security Orchestration, Automation & Response)
Technology that enables organizations to collect data about security threats and respond to low-level security events without human assistance using Playbooks .
Log Analysis & Correlation
The process of finding patterns across multiple log sources (e.g., matching a failed login on a server with an unusual traffic spike on the firewall).
Point-in-Time vs. Continuous
Point-in-time is a snapshot (like a manual scan). Continuous monitoring provides ongoing visibility into the security posture, essential for detecting advanced persistent threats (APTs).
Domain Glossary
Heuristics Experience-Based Analysis
A technique designed to solve a problem more quickly when classic methods are too slow. In security, it refers to identifying threats based on patterns or behavioral rules rather than exact signatures. Example: Flagging an account that logs in from three different countries within 10 minutes.
NetFlow Network Telemetry
A protocol for collecting IP traffic information and monitoring network flow. It records metadata (Source, Destination, Port, Bytes) rather than the packet contents. Example: Using NetFlow data to identify an internal host sending 50GB of data to an unknown external IP at 2 AM.
Data Exfiltration Unauthorized Transfer
The unauthorized transfer of data from a computer. Example: An insider threat compressing a database and uploading it to a personal cloud storage site via HTTPS.
The SOC Data Flow
SOURCES
COLLECTOR
SIEM ENGINE
ALERTING
SOAR
SOC Analysis Scenarios SOC Analysis Scenarios
Domain 3: Monitoring & Log Interpretation
Analysis Lab
SOM-LAB-03
Analyst Name ________________________________
Date ________________
1
Scenario: The Distributed Brute
A SIEM alert triggers for "Account Lockout" on a sensitive database server. However, the firewall logs show no single IP address making more than 3 failed attempts. An analyst notices that 20 different external IP addresses are each making exactly 2 failed login attempts against the same account over a 1-hour window.
Analysis Question:
Identify the specific type of attack being described. How should the SIEM correlation rule be modified to detect this "low and slow" distributed attempt?
2
Scenario: The Backup Noise
A new behavioral monitoring tool flags a "Massive Outbound Data Transfer" every Sunday at 2 AM from the main file server to an off-site IP. The SOC team treats this as a Critical incident, but after investigation, they find it is the scheduled encrypted backup.
Analysis Question:
Is this a False Positive or a False Negative? What specific tuning action (e.g., whitelisting, thresholding, or tagging) would you take to prevent future alerts for this legitimate activity?
3
Scenario: Encrypted Exfiltration
An attacker has established a command-and-control (C2) channel using HTTPS (Port 443). Because the traffic is encrypted, the Deep Packet Inspection (DPI) tool cannot read the contents. However, the SOC has access to NetFlow data for the perimeter router.
Analysis Question:
List three specific flow metadata fields (e.g., packet size, flow duration, byte count) you would analyze to identify suspicious C2 "beaconing" behavior in this encrypted stream.
Correlation Logic
Data Interpretation
Total Grade: ____ / 30
IR Lifecycle Guide IR Lifecycle Guide
CySA+ Domain 4: Incident Response
CYBER SENTRY TRAINING
Resource ID: IR-SG-04
Student Name ________________________________
Date ________________
The Incident Response Lifecycle
1. Preparation
The foundation of IR. Includes training the team (CSIRT), establishing communication channels, and developing playbooks and incident response plans (IRP).
2. Detection & Analysis
Identifying and verifying an incident. Involves monitoring logs, identifying IOCs, and determining the scope, severity, and impact of the event.
3. Containment & Eradication
Containment stops the "bleeding" (e.g., isolating a VLAN). Eradication removes the threat (e.g., deleting malware, disabling compromised accounts).
4. Recovery & Post-Incident
Restoring systems to normal operation and conducting a Lessons Learned session to improve the IRP and prevent future occurrences.
Domain Glossary
IOC Indicator of Compromise
Evidence that a security breach has occurred. Example: A specific file hash of a known ransomware strain or a connection to a known-bad command and control (C2) IP address.
Chain of Custody Evidence Integrity
Documentation that tracks the chronological handling of evidence. Example: A signed log showing exactly who took a hard drive from a server, when, and where it was stored under lock and key.
Order of Volatility Forensic Priority
The sequence in which data should be captured during forensics, from most to least fragile. Example: Capturing CPU cache and RAM before imaging the hard drive, as the former will be lost if the power is cut.
The NIST SP 800-61 Cycle
PREPARATION
DETECTION & ANALYSIS
CONTAINMENT & ERADICATION
POST-INCIDENT ACTIVITY
Ops Response Scenarios Ops & Response Scenarios
Domain 3 & 4: Monitoring, Detection, and Recovery
Advanced Scenarios
CYSA-ADV-01
Candidate Name ________________________________
Date ________________
1
Scenario: The Silent SIEM
During a red team exercise, an attacker successfully exfiltrates 10GB of data via DNS tunneling. The SIEM did not generate any alerts. Upon investigation, you find that the SIEM is receiving firewall logs but does not have a correlation rule for excessive DNS traffic or "long" DNS queries.
Analysis Question:
Propose two specific correlation rules or threshold-based alerts that could have detected this exfiltration. What log source is most critical here?
2
Scenario: Ransomware Response
An analyst detects a workstation communicating with a known-malicious C2 IP address. Within minutes, files on the local drive begin showing '.crypt' extensions. The user is currently logged in and connected to the corporate LAN and a cloud-synced file share.
Analysis Question:
What is the immediate priority for containment? Contrast the risks of 'pulling the plug' versus 'disconnecting the network' in the context of forensic evidence preservation.
3
Scenario: The Post-Mortem
Following a major incident where an unpatched vulnerability was exploited, the IR team is conducting a Lessons Learned session. The vulnerability was known and reported by the scanner 3 months prior, but the Patch Management team was never notified because the report was 500 pages long and sent to a generic security inbox.
Analysis Question:
Identify the process failure. What SOAR or workflow automation could bridge the gap between 'Detection' and 'Remediation' to prevent this in the future?
Cyber Sentry Certification Prep Confidential Training Material
Evidence Trail Lab Evidence Trail Lab
Domain 4: Digital Forensics & Chain of Custody
Forensic Practice
IR-LAB-03
Investigator Name ________________________________
Case Number ________________
Part 1: The Volatility Race
As an IR responder, you have just arrived at a compromised server. Time is of the essence. Rank the following data sources from 1 (Most Volatile/First to capture) to 6 (Least Volatile/Last to capture) .
System RAM (Main Memory)
Hard Drive (Physical Disk Image)
CPU Cache and Registers
Remote Log Server Entries (SIEM)
Network Routing & ARP Tables
Temporary File Systems (Virtual Swap)
Part 2: Chain of Custody Draft
You have just removed a physical SATA SSD from a suspected insider-threat laptop. Fill out the chain of custody entry below as you prepare to transport it to the forensic lab.
Evidence Documentation Form
Item Description & Serial #
Location Collected
Date/Time Released By (Name/Sign) Received By (Name/Sign) Purpose of Transfer
Reflection: The Forensic Imaging Choice
A server is actively under a brute-force attack. You need to capture the state of the system. Do you perform a Live Image capture or pull the power to perform a Static Image ?
Explain your reasoning based on the current attack status...
IOC Hunter Worksheet IOC Hunter Worksheet
Domain 4: Analyzing Indicators of Compromise
Incident Detective
IR-LAB-04
Analyst Name ________________________________
Date ________________
IOC 1: The Unusual Connection
# Web Server Access Log Snippet 10.0.0.45 - - [25/Feb/2026:14:22:01 +0000] "GET /admin/login.php?user=' OR 1=1 -- HTTP/1.1" 200 1542 10.0.0.45 - - [25/Feb/2026:14:22:05 +0000] "GET /admin/db_export.php HTTP/1.1" 200 450123 10.0.0.45 - - [25/Feb/2026:14:22:15 +0000] "POST /admin/config_upload.php HTTP/1.1" 200 892
Analysis:
What attack pattern do you identify in the first log line?
Significance:
What is concerning about the second and third log lines?
IOC 2: The Rogue Process
PID Process Name User Path 452 svchost.exe SYSTEM C:\Windows\System32\ 1204 lsass.exe User01 C:\Users\User01\AppData\Local\Temp\ 2231 chrome.exe User01 C:\Program Files\Google\Chrome\
Detection Question:
Compare PID 1204 with standard system behavior. Identify two specific reasons why this is a high-confidence Indicator of Compromise.
IOC 3: The Suspicious Sender
From: "IT Support" support@m-icrosoft.co j.doe@company.com security-desk@gmail.com
Please click here to verify your password immediately:https://company.login.secure-portal.net/verify
Vulnerability Analysis:
List three indicators from this email header that prove this is a phishing attempt.
Incident Playbook Template Incident Playbook Template
Domain 4: Standardizing Response Procedures
Graphic Organizer
Analyst Name
Incident Type
1. Detection & Identification
Triage Phase
Primary IOCs to Watch
Initial Verification Steps
2. Containment Strategy
Immediate Action
Isolation & Mitigation Procedures
3. Eradication & Recovery
Remediation
Threat Removal Steps
Restoration Tasks
4. Post-Incident Activities
Review Phase
Key Questions for Lessons Learned
Visibility
"Can you see the logs?"
Velocity
"How fast is containment?"
Veracity
"Is it a false positive?"
Ops Response Key Ops & Response Scenarios
Instructor Answer Key & Facilitation Guide
Instructor Use Only
KEY-ADV-01
Scenario 1: The Silent SIEM
Proposed Correlation Rules:
Rule 1 (DNS Tunneling Detection): Alert on any DNS query where the character length of the subdomain exceeds 100 characters (common in data encoding).Rule 2 (Beaconing/Volume): Alert on any host sending more than 5,000 DNS queries per hour to an external IP not in the "Safe" list.
Critical Log Source:
Internal DNS Server Logs (showing the actual query strings) or DNS Proxy Logs . Firewall logs alone only show port 53 traffic, not the query content.
Scenario 2: Ransomware Response
Immediate Priority:
Network Isolation (Containment) . The workstation must be disconnected from the LAN and the cloud-sync account must be disabled/revoked immediately to prevent the encrypted files from syncing and corrupting the cloud backup or spreading to network shares.
Forensic Comparison:
Pulling the plug: Likely loses all data in RAM (volatility), including encryption keys or active malware code. Only recommended if the system is "self-destructing" or wiping itself.Disconnecting network: Preserves the live state (RAM) for forensic imaging while stopping the lateral spread/C2 communication. This is the preferred method for CySA+.
Scenario 3: The Post-Mortem
Process Failure:
A failure in reporting and communication . Specifically, the lack of an automated hand-off between the security scanning tool and the IT patch management ticketing system.
SOAR Solution:
Implement an automated ticketing workflow . The SIEM/Vulnerability Scanner should automatically open a "Critical" ticket in JIRA/ServiceNow for any CVSS 9.0+ vulnerability, assigning it directly to the relevant system owner and notifying them via Slack/Email.
Evidence Trail Key Evidence Trail Lab
Instructor Answer Key
Instructor Use Only
KEY-LAB-03
Part 1: The Volatility Race (Order of Volatility)
1
CPU Cache and Registers Lost in nanoseconds
2
System RAM (Main Memory) Lost on power cycle
3
Network Routing & ARP Tables Active connections
4
Temporary File Systems (Virtual Swap) Paging files
5
Hard Drive (Physical Disk Image) Persistent storage
6
Remote Log Server Entries (SIEM) Off-site, highly persistent
Part 3: Reflection Key
Correct Approach:
The investigator should perform a Live Image capture first.
Reasoning: Since the server is actively under a brute-force attack, pulling the power would terminate the active network connections and clear the memory (RAM). Memory is likely to contain critical evidence such as the attacker's source IP, active shell sessions, and potentially plain-text credentials being used in the brute-force attempt.
Instructor Note: Ensure students understand that RAM is almost always captured before the HDD.
IOC Hunter Key IOC Hunter Worksheet
Instructor Answer Key
Instructor Use Only
KEY-LAB-04
IOC 1: The Unusual Connection
Analysis Key:
SQL Injection (SQLi) . The string ' OR 1=1 -- is a classic tautology attack used to bypass authentication bypass filters.
Significance Key:
The status code is 200 OK , meaning the attack succeeded. The export and upload actions indicate Data Exfiltration and Web Shell Upload .
IOC 2: The Rogue Process
Detection Key (Two Specific Reasons):
Path Mismatch: lsass.exe is a critical system process that should only run from C:\Windows\System32\. Running from a User Temp folder is a clear sign of malware masquerading as a system process.User Context: lsass.exe must run as SYSTEM. Here it is running as User01, indicating a user-level process mimicking a system service.
IOC 3: The Suspicious Sender
Indicators List:
Display Name vs. Domain: Support name but domain is m-icrosoft.co (typosquatting).Reply-To Header: Different from sender; uses a public gmail.com address for a corporate IT desk.URL Mismatch: The link says company.login but the actual domain is secure-portal.net (a lookalike domain). 
