Participants apply Threat Hunting, Detection Hypotheses, Correlation, Enrichment, and Validation to a realistic operating case for Certified Cyber Threat Analyst (CCTA) (PECB). The activity uses a security operations team investigating coordinated phishing, credential abuse, malware, and cloud persistence and contributes to the wider objective to perform structured cyber threat analysis, intelligence production, hunting, prioritization, and operational communication.
The instructor traces a case involving a security operations team investigating coordinated phishing, credential abuse, malware, and cloud persistence. The demonstration links decisions to objective evidence, records the result in threat-hunting evidence workbook, and tests the condition where hunting results confuse benign administration with malicious persistence.
Complete a controlled exercise covering Threat Hunting, Detection Hypotheses, Correlation, Enrichment, and Validation. Confirm scope and responsibilities, examine the stated exception, reach a supported conclusion, and preserve the outcome in threat-hunting evidence workbook.
Start where expected practice and observed evidence first diverge. Separate a missing record from an ineffective process, distinguish unclear ownership from a control failure, and treat “hunting results confuse benign administration with malicious persistence” as a hypothesis until tested against the applicable criteria and intended outcome.
Learners can apply Threat Hunting, Detection Hypotheses, Correlation, Enrichment, and Validation, explain the reasoning used, and defend the result through threat-hunting evidence workbook.