What is threat hunting and what artifacts would a TA look for to identify hidden threats?

• A. Anomalous authentications, unusual attestation failures, privilege elevation, and unexplained data movement
• B. Employee birthday lists
• C. Printer ink levels
• D. Software version numbers only

Answer: (A)

Threat hunting is the proactive, hypothesis-driven search for signs of adversary activity inside a network or host, aiming to find stealthy threats that automated alerts miss. A trusted agent looks for telltale artifacts that attackers often reveal through their behavior and tool use.

Anomalous authentications are a key signal: logins from unusual times, locations, devices, or unfamiliar patterns that don’t fit a user’s normal activity. These hints can indicate credential compromise or account takeover.

Unusual attestation failures involve integrity checks or trusted-device attestations that don’t behave as expected. When the system’s trust measurements fail or show tampering, it can be a sign that malware is trying to operate under the radar or that a rogue component has been introduced.

Privilege elevation is another important artifact. Attempts to gain higher privileges or bypass controls often precede further compromise, privilege abuse, or lateral movement, so spotting these unusual elevation attempts helps reveal hidden threats.

Unexplained data movement, especially large or unusual transfers to external destinations, points to data exfiltration or staging activities. This helps detect attackers trying to extract or move sensitive information out of the environment covertly.

Together, these artifacts form a focused picture of suspicious activity that can uncover hidden threats, beyond what standard alerts capture. By contrast, items like employee birthday lists or printer ink levels don’t relate to security activity, and software version numbers alone don’t indicate ongoing malicious behavior.