Domain 3 of 4 · Chapter 4 of 6

Threat Intelligence and Threat Hunting

Unlock the complete study guide.

Bundled into the existing CompTIA CySA+ premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Threat intelligence in one investigation
  • Threat actors: APTs and insider threats
  • TTPs and ATT&CK mapping
  • Attribution
  • Threat mapping with ATT&CK heat maps
  • Indicator types and the Pyramid of Pain
  • Confidence: timeliness, relevance, and accuracy
  • Collection methods and intelligence sources
  • The IoC lifecycle: collection, analysis, application
  • Applying an indicator to current and past activity
  • Sharing intelligence under handling rules
  • Threat modeling with STRIDE
  • Threat hunting
  • Cyber deception: decoys, honeypots, and honeytokens
  • Threat intelligence and threat-hunting concepts in scenarios

Indicator responses: log, monitor, or block

Decision factorLogMonitorBlock
What the control does with a matchRecords it for later analysis, no alertRaises an alert for an analyst to investigateStops the matching connection, file, or execution
Confidence in the indicatorAny assessed level after validation, when relevance to your environment is unclearLow or moderate, or high but not yet confirmed locallyHigh: validated source, corroborated, current
Relevance to your environmentUnclear or indirectApplies to your technologies or likely adversariesApplies directly to systems you run
Cost of a false matchLogging, processing, and storage overheadAnalyst timeLegitimate activity disrupted
Typical exampleAn indicator from a campaign against technologies you have not confirmed you runA fresh domain hosted on infrastructure shared with legitimate sitesThe hash of a payload your own analysis confirmed as malicious
Search retained logs for earlier matches?YesYesYes

Decision tree

Source and contentvalidated?Hold until validatednot deployed yetNoYesStill reflectsthe threat?Retire (end of life)remove from detectionNoYesRelevant to yourenvironment?Logrecord matches, no alertNo or unclearYesHigh confidence andfalse match tolerable?Monitoralert an analystNoYesBlockstop the matching activityAlways: search retained logs for earlier matches (retrospective search)
Cheat sheet

Cheat sheet

  • Persistent threat activity need not depend on exotic malware
  • Insider threats include harmful misuse that is intentional or unintentional
  • Tactics, techniques, and procedures describe different levels of adversary behavior
  • Shared techniques do not uniquely identify a threat actor
  • An APT combines substantial capabilities with sustained and adaptive objectives
  • Threat intelligence loses operational value when it arrives too late
  • Relevant intelligence matches the environment and threats being defended
  • Intelligence confidence should reflect correctness and remaining uncertainty
  • Open and closed intelligence sources both require evaluation
  • Threat sharing must preserve handling restrictions and sensitive context
  • Atomic indicators identify values while behavioral indicators describe activity
  • Indicator ingestion should preserve provenance and validate the supplied data
  • New intelligence can be used to search historical telemetry
  • Blocking and monitoring are different risk responses to an indicator
  • The Pyramid of Pain compares how hard detection makes adaptation for an adversary
  • A threat model needs the system's data flows and trust boundaries
  • STRIDE separates impersonation from obtaining additional privileges
  • STRIDE distinguishes unauthorized modification from unauthorized disclosure
  • STRIDE separates repudiation concerns from denial of service
  • ATT&CK mapping links observed behavior to techniques rather than guessing missing actions
  • Threat heat maps make coverage and priorities visible without proving effectiveness
  • Cyber decoys create opportunities to observe suspicious interaction
  • Honeytokens detect interaction with deliberately planted information
  • A decoy must be tested for alert delivery and benign triggers
  • Threat hunting proactively tests threat ideas against evidence

Unlock with Premium — includes all practice exams and the complete study guide.

References

  1. https://www.comptia.org/en-us/certifications/cybersecurity-analyst/v4/
  2. https://www.rfc-editor.org/rfc/rfc9424.html
  3. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-150.pdf
  4. https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html
  5. https://csrc.nist.gov/glossary/term/advanced_persistent_threat
  6. https://www.cisa.gov/sites/default/files/2025-03/Joint-Guidance-Identifying-and-Mitigating-LOTL508.pdf
  7. https://www.cisa.gov/topics/physical-security/insider-threat-mitigation/defining-insider-threats
  8. https://attack.mitre.org/
  9. https://www.cisa.gov/sites/default/files/2023-01/Best%20Practices%20for%20MITRE%20ATTCK%20Mapping.pdf
  10. https://attack.mitre.org/resources/versions/
  11. https://attack.mitre.org/groups/
  12. https://attack.mitre.org/resources/
  13. https://www.cisa.gov/sites/default/files/2026-09/using-cyber-decoys-to-strengthen-detection-and-response_508c.pdf
  14. https://www.sans.org/blog/security-intelligence-attacking-the-cyber-kill-chain/
  15. https://www.cisa.gov/sites/default/files/publications/Operationalizing_ATTACK_through_CISA_Alerts_508.pdf
  16. https://www.first.org/tlp/
  17. https://csrc.nist.gov/glossary/term/threat_modeling
  18. https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats
  19. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
  20. https://attack.mitre.org/docs/ATTACK_Design_and_Philosophy_March_2020.pdf
  21. https://www.sans.org/blog/from-alerts-to-adversaries-a-pragmatic-guide-to-launching-and-maturing-your-threat-hunting-program
  22. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v2r1.pdf