Uncover chapter quiz
Uncover chapter quiz
No grades. The point is to push your thinking. Tap an option to see if it lands.
A threat intel feed says a particular domain is associated with a known campaign. The analyst sees the same domain in firewall logs from one host. What is the right next step?
Threat intelligence is most useful as a hypothesis. The matched domain is a starting point, not a verdict. Validate against the actual telemetry (which process, which user, which pattern) before acting.
A dropper hash matches a known campaign's tooling, and nothing else links the case to that actor. What confidence label can attribution carry in the case file?
Need a nudge?
The match is exact. The question is what else could explain it.
One indicator in one category is LOW, and the reason is not hash collisions: shared, sold, and leaked tooling means the same dropper turns up in unrelated hands, so the overlap can be coincidental even though the match is exact. What lifts the label is correlation across diverse categories: if the C2 infrastructure and the TTP chain also match the same campaign, the claim earns MEDIUM. Attribution stays in the case file at its honest label, because promoting low-confidence attribution into operational decisions is the most common attribution failure mode.
Which level of MITRE ATT&CK changes most often?
Procedures (specific implementations) change rapidly as adversaries adapt their tooling. Techniques (the methods) change more slowly. Tactics (the goals) are nearly stable over years. This is why TTP-based hunting beats indicator matching for durability.
An investigation needs to know whether a file was executed on an endpoint earlier this week. Which data source answers this most directly?
EDR captures process creation events that show whether a file was executed, and a few days is comfortably inside a typical retention window. FIM tells you the file exists or was modified, but not whether it ran. SIEM aggregates from other sources. One caveat worth knowing: for questions like did this ever run, beyond the EDR retention window, the answer lives in whatever long-term store (SIEM or data lake) archives the EDR telemetry.
An investigation needs both an EDR process timeline and a SIEM-wide authentication search. Which query runs first?
The tooling pattern is cheapest or most specific first. The EDR query is scoped to one host and returns fast, and its result narrows the time window and the entities, which turns the SIEM search from an everything-scan into a targeted pull. Running both at once sounds efficient, but the broad query's parameters depend on the narrow query's result: launched unanchored, the SIEM search returns a haystack that costs more analyst time than the parallelism saved.
A suspected intrusion may have started six weeks ago, but the SOC's EDR retains 14 days of telemetry. Which data-source principle is at stake?
Retention shapes what is even possible to investigate. Sophisticated intrusions unfold over weeks or months, and a source holding 14 days cannot answer 'did this start before the alert?' no matter how well the query is written. The practical moves are knowing where the longer archive lives (the SIEM or data lake that retains the EDR feed) and, where none does, recording the unanswerable window as a coverage gap instead of treating silence as evidence of absence.
The Uncover narrative concludes with a chain of MITRE techniques. Why is the chain more useful than free-form prose?
ATT&CK turns analyst observations into a portable artifact. The same chain of techniques is meaningful to the IR responder, the detection engineer who decides what to tune, and the leader who wants to see threat trends over time.
An analyst is investigating a possible compromise on a macOS developer workstation. The user's role legitimately involves scripting, IDE plugin processes, and encrypted outbound traffic. What does the methodology require Uncover to produce if the evidence supports a benign verdict?
A benign verdict that meets the methodology's standard is not dismissed. It is documented, evidenced, and bounded — including which axis cleared it: here the rule detected exactly the behavior it describes, and the disposition is benign, a benign true positive. That documentation is what lets the case re-open with full context if new signals appear, and what produces the detection-engineering feedback that prevents the same alert from firing repeatedly.
Risk receives an Uncover handoff. Which of these decisions is Risk authorized to make?
Need a nudge?
Risk is not response.
Risk is the analytical checkpoint, not the response phase. Its job is to evaluate whether Uncover's evidence is sufficient to close the case, warrants escalation, or means the investigation needs to expand back through Scope. Containment, notification, and detection tuning happen in later phases (Escalation, Documentation) once Risk's verdict supports them.
EDR records powershell.exe (PID 4416) opening an outbound connection at 14:22:31Z. The proxy logs a TLS session from the same host to a newly registered domain at 14:22:31Z. What makes treating these as one event defensible?
Need a nudge?
One matching field is coincidence-prone. Which fields together identify the event?
Correlation is defensible when independent sources agree on the keys that identify the event: the host, the time, and the connection endpoints. A timestamp alone can collide, hosts make many simultaneous connections, and the proxy adds what EDR cannot see (the URI, TLS details, and bytes transferred). The worked example does exactly this: the firewall session matching the EDR network event to the second is what turns two log lines into one attributed action.
GuardDuty flags an engineer's 02:14 UTC AssumeRole into a role normally used only by CI, with read access to a regulated bucket. CloudTrail shows eight reads of quarterly-export files, no ListBucket reconnaissance, no writes, corporate VPN egress throughout. The IdP shows a FIDO2 login from the registered device with no token-replay or consent-grant indicators. What does Uncover conclude?
Need a nudge?
Separate two questions the evidence answers differently: who authenticated, and who authorized.
The clean identity surface does real work: it makes token theft, consent-grant abuse, and AiTM phishing less likely, because each would leave marks that are absent. But it answers who authenticated, not who authorized. A human interactively using a CI-only role against regulated data is a control violation in every branch, including the friendly one, and a fresh STS session is still a replayable credential while it lives. The subject's own Slack confirmation is a lead, not closure; what closes the case is an approved work item verified with its owner, the data owner's authorization, and where the 120 MB went after the laptop. Compromise-confirmed overclaims the same evidence in the other direction, and there is no endpoint in the story to image.
The case needs to answer one question before Risk: did data actually leave the environment? Which evidence combination answers it?
Exfiltration is proven at the boundary, not on the endpoint. EDR shows a process read files and sent bytes, but volume, destination, and content classification live in the egress path: proxy or firewall session sizes, DLP verdicts, and cloud-side data events for storage services. Aligning those against the endpoint timeline is what turns 'the process could have exfiltrated' into 'this much data moved to this destination at this time', or into a documented negative finding.