CAS-005 Exam Dumps | A threat hunter is identifying potentially malicious activity associated with an APT. When the threat

<< Prev Question Next Question >>

Question 65/82

A threat hunter is identifying potentially malicious activity associated with an APT. When the threat hunter runs queries against the SIEM platform with a date range of 60 to 90 days ago, the involved account seems to be typically most active in the evenings. When the threat hunter reruns the same query with a date range of 5 to 30 days ago, the account appears to be most active in the early morning. Which of the following techniques is the threat hunter using to better understand the data?

A. TTP-based inquiries

B. User behavior analytics

C. Adversary emulation

D. OSINT analysis activities

Question 65/82

LEAVE A REPLY

Download PDF File