No alert fired. Hunt through weeks of quiet telemetry to prove or disprove a stealthy, low-and-slow intrusion, then write a detection precise enough to matter.
No alert has fired at Vantle Financial, a regional financial services firm, but a Financial Sector Intelligence Exchange (FSIX) advisory warns that peer institutions were breached by an actor tracked as GRAY LEDGER, known for abusing signed remote-support binaries, disguised scheduled-task persistence, LOLBins, and deliberately slow beaconing. Form a hypothesis, pull four quiet weeks of EDR, scheduled-task, and proxy/DNS telemetry from the Treasury Ops workstations, and prove or disprove compromise before writing a detection that will actually hold up.
5 evidence pulls · 878-event hunt corpus · 5 hypotheses
A fixed-interval outbound TLS pattern on a Treasury Ops workstation looks exactly like the textbook definition of a C2 beacon. Before this becomes an incident, work out whether the hypothesis holds up against what is actually making the connection.
hunt corpus unlocks with premium · 140 case pts
A new detection rule for LOLBin abuse lit up across the print-heavy branch floor the moment it went live. Separate the genuine print-management traffic from the one execution that doesn't belong in it.
hunt corpus unlocks with premium · 150 case pts
Threat intelligence names WMI-based lateral movement against a legacy server group. The hunt for it comes back completely clean. Work out whether that means nothing happened, or whether the telemetry could never have shown it either way.
hunt corpus unlocks with premium · 150 case pts
A law-enforcement notification places a credential-theft incident weeks before any log the SOC still holds. Determine exactly what can, and cannot, be established from telemetry that never reached back that far, and what would have to change to answer it next time.
hunt corpus unlocks with premium · 150 case pts