CompTIA · CySA+ CS0-004
Threat intelligence and threat hunting
CySA+ CS0-004 · Lesson 9 of 22 · 1:11:54
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the CySA+ CS0-004 exam (CompTIA Cybersecurity Analyst (CySA+)). In this lesson: threat actors and their TTPs, MITRE ATT&CK, the Pyramid of Pain, intelligence sources judged by timeliness, relevance, and accuracy, sharing with STIX and TAXII, atomic and behavioral indicators, threat modeling with STRIDE, hunting from hypotheses, and decoys like honeypots. Includes three original practice questions.
Preview the topics
- A free feed lists an IP address as malicious, but the entry is fourteen months old, and today the address belongs to a large cloud provider used by thousands of services. What is the main problem with this indicator?
- A user denies having approved a large transfer in the mobile app, and the app keeps no trustworthy log that could prove who approved it. Which STRIDE category does this weakness fall into?
- Tidewell wants an alert with almost no false positives, which fires when an intruder explores the network, even with stolen credentials. Which approach fits best?