You are threat hunting for an advanced group using campaign-specific infrastructure. You want detections based on behavior to detect whether they have attacked your org. What should you do?

• A. Identify exposed technologies used by your org and develop detections for signs of exploitation.
• B. Find intelligence reports in GTI related to the threat actor and use past behavior to design detections.
• C. Export IOCs for the threat actor into a SecOps list and develop detections referencing the list.
• D. Review the threat actor's TTPs in GTI and design detections based on those TTPs in SecOps.

Answer: (D)

Focusing on the attacker’s behavior is the key. When threat hunting an advanced group using campaign-specific infrastructure, you want detections that mirror how they operate—the techniques, techniques, and procedures they actually employ—so you can spot activity even if the exact tools or domains change. GTI provides threat actor TTPs (the methods they use to gain access, move laterally, establish persistence, communicate with infrastructure, exfiltrate data, etc.). Designing detections in SecOps around these TTPs lets you recognize the sequence and patterns of activity that indicate a compromise, not just a fixed indicator that may disappear.

This approach is more robust than building detections from exposed technologies alone, which may miss attacker behavior, or relying on past intelligence or a fixed list of IOCs, which can become outdated as the actor evolves. By mapping GTI-listed TTPs to your security tooling, you create behavior-based detections that adapt to campaign-specific infrastructure while accurately signaling whether the adversary has attacked your environment.