Log Analysis and Threat Hunting in Security Data Questions

Understand how to analyze security logs to identify suspicious activity. Know what different types of logs show (firewall, proxy, DNS, endpoint, application). Be able to correlate logs from multiple sources to trace attacker activity. Discuss threat hunting methodologies and how analysts proactively search for unknown threats in data.

MediumTechnical

100 practiced

You find a base64-encoded PowerShell string in a proxy query parameter. Describe step-by-step how you would safely decode and analyze it, including safe analysis environment setup, static analysis steps, behavioral checks, and ways to hunt for other hosts exhibiting the same payload or command patterns.

Sample Answer

**Situation & goal**I’m an InfoSec analyst who discovers a base64 PowerShell string in a proxy URL. My goal: decode and analyze safely, determine intent, and hunt for other hosts with the same indicators.

**1) Safe analysis environment**- Isolate: use an air-gapped VM or dedicated analysis lab (Windows VM with no domain access, snapshotable).- Harden: disable networking (or use controlled Internet via proxy), enable host-only snapshots, revert after tests.- Tools: Sysinternals, Procmon, Wireshark, PowerShell 5/7 in ConstrainedLanguage mode, FLARE VM or REMnux for supporting tools.

**2) Safe decoding (offline)**- Never run raw decoded script on production. Decode locally in a safe VM or on an isolated analysis workstation.- Example decoders:

powershell

# PowerShell decode to file (do not execute)
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("BASE64")) > decoded.ps1

python

# Python decode to stdout/file
import base64; print(base64.b64decode("BASE64").decode('utf-8',errors='ignore'))

**3) Static analysis**- Inspect decoded.ps1: look for obfuscation, encoded payloads, cmdlets (Invoke-Expression, IEX), reflection, download/execute patterns, WMI/COM abuse.- Search for IoCs: domains, IPs, mutex names, file paths, registry keys, obfuscated strings (re-decode).- Use yara, Strings, and PowerShell AST parsing (PowerShell -NoProfile -Command "ParseScript").

**4) Behavioral / dynamic analysis (controlled)**- In isolated VM, enable full logging (Sysmon, Procmon, PowerShell transcription/Module logging).- Run with defensive controls: ConstrainedLanguage or -NoProfile, start with non-destructive flags, or run under a debugger/sandbox (Cuckoo, Any.Run).- Monitor: process tree, network connections (Wireshark), file system and registry changes, child processes, persistence attempts.- Capture memory for analysis (DumpIt) to extract injected payloads.

**5) Hunting for other hosts**- Extract IOCs and observable patterns: exact decoded commands, unique token strings, specific cmdlets sequence, domains, URIs.- SIEM searches: - Search proxy / web logs for the base64 parameter value or the remote domain/URI. - Query endpoint logs for PowerShell execution with similar command-line flags: e.g., "-EncodedCommand", "IEX", "DownloadString".- EDR: hunt for child process chains, network beacons, created files/registry keys matching IoCs.- Network: IDS signatures for repeated patterns, use regex to find similar base64 in HTTP GET/POST.- Use pivoting: threat intel (VirusTotal, Hybrid Analysis) for hashes or domains; share IoCs with SOC and update detection rules.

**6) Reporting & remediation**- Document steps, artifacts, indicators, and impact. Quarantine affected hosts, revoke credentials if needed, block domains/IPs, and add detection signatures.- Lessons: add proxy-level base64 detection, enable PowerShell logging/org-wide EDR, and schedule hunts for recurrence.

HardTechnical

87 practiced

Write a complex Splunk SPL or Elasticsearch query (describe in pseudo-query form) that correlates DNS logs, proxy logs, and process telemetry to identify hosts that resolved untrusted domains, then within 5 minutes made an HTTP POST uploading more than 1MB of data to an external IP. Explain how you would structure the joins/transactions and the performance considerations for running this query at scale.

Sample Answer

**Approach (brief)** Correlate DNS that shows resolution of untrusted domains → find subsequent proxy HTTP POSTs to external IPs within 5 minutes with upload >1MB → verify process telemetry on same host around those events. Use transactions/windowed joins keyed by host and client_ip; enrich with threat list for “untrusted” domains.

**Splunk SPL (pseudo-SPL)**

splunk

index=dns OR index=proxy OR index=process
| eval src_host=coalesce(host, client_host)
| where index=dns OR (index=proxy AND http_method="POST") OR index=process
| eval ts=_time
| transaction src_host startswith=(index=dns AND dns_qtype="A" AND domain IN (lookup_untrusted)) endswith=(index=proxy AND http_method="POST") maxspan=5m
| search eventcount>1
| where proxy_bytes_out > 1048576
| table src_host, domain, resolved_ip, dest_ip, proxy_bytes_out, process_name, _time

**Elasticsearch (pseudo-DSL)**

json

POST /logs/_search
{ "query": { "bool": { "must": [ {"terms": {"event.type":["dns","http","process"]}},
                                   {"terms":{"dns.domain.keyword": ["...untrusted..."]}} ]}},
  "aggs": { "by_host": { "terms":{"field":"host"}, "aggs": {
     "by_time": { "date_histogram":{"field":"@timestamp","fixed_interval":"1m"}, "aggs": {
       "dns": {"filter":{"term":{"event.type":"dns"}}},
       "http_post": {"filter":{"bool":{"must":[{"term":{"event.type":"http"}},{"term":{"http.method":"POST"}},{"range":{"http.request.body.bytes":{"gt":1048576}}}]}}},
       "join_window": {"bucket_selector": { ... }} }}}}}

**Joins / Windowing**- Use transaction or date_histogram buckets per host with maxspan=5m.- Key on host/client_ip; include resolved_ip to catch C2 via IP.- Validate with process telemetry by joining on pid/parent_pid within ±1min.

**Performance considerations**- Pre-filter by untrusted domains and HTTP POST to reduce dataset.- Use indexed fields (host, @timestamp, http.method, dns.domain) and summary/tsdb rollups.- Run as scheduled search with saved lookups; consider streaming joins or index-time enrichment.- Limit time range; use early rejection filters; shard-aware aggregations in ES; monitor memory for transactions.

HardSystem Design

92 practiced

Design a testing framework that continuously validates SIEM detections and hunting queries against realistic adversary behavior. Explain how you would map ATT&CK techniques to tests, generate telemetry safely (using tools like Atomic Red Team, Caldera), run tests in non-production or controlled environments, and integrate results into CI/CD pipelines for detection rules and playbooks.

MediumTechnical

75 practiced

Explain how Windows Sysmon and Linux auditd can be used to detect obfuscated PowerShell execution and suspicious binary launches. For each platform, list the specific event types/IDs and fields you would monitor, and propose 2-3 analytic rules (pseudo-SPL or plain-English) that would flag suspicious behavior.

MediumTechnical

96 practiced

You observe many clients resolving an unusual domain and subsequently making web requests to a small set of IPs that appear in a threat-intel feed. Describe step-by-step how you would correlate DNS logs, proxy logs, and endpoint telemetry to determine scope, pivot to affected hosts, and decide on escalation. Include what timestamps, fields, and joins you would perform.

Sample Answer

**Approach (high level)** I would perform triage in three stages: confirm malicious activity (scope), pivot to affected hosts/users, then decide escalation/remediation based on impact.

**Step-by-step correlation**

1. Validate threat-intel hit - Query threat feed for IOC IPs/domain; record first_seen, confidence. - Fields: intel_ip, intel_domain, intel_score, first_seen.

2. DNS logs: identify resolvers and clients - Query DNS logs for domain and unusual NXDOMAIN/A answers. - Important fields/timestamps: query_time, client_ip, client_port, query_name, query_type, response_answers, ttl. - Join on query_name = intel_domain to get all client_ip and earliest/latest query_time.

3. Proxy/web logs: confirm connections to intel IPs - Query proxy/HTTP logs for destination_ip in intel IP list and for Host header matching domain. - Fields: request_time, src_ip, src_user, dest_ip, dest_port, url, host_header, http_status, user_agent, bytes_in/out. - Join DNS results client_ip = proxy.src_ip to tie resolution to web access; use timestamps (allow small window, e.g., DNS within 60s before request).

4. Endpoint telemetry: validate process and user context - Query EDR for src_ip hostnames, process_parent, process_name, cmdline, file_hashes, network events. - Fields: event_time, host_name, host_ip, user, process, parent_process, cmdline, file_path, hash. - Join proxy.src_ip = endpoint.host_ip and filter event_time within DNS/request windows (±5 minutes).

**Pivoting to affected hosts/users** - Build list of unique hostnames, user accounts, and MACs from endpoint and DHCP. - Enrich with asset criticality, owner, last_patch, MFA status. - Look for lateral movement: failed logins, SMB/RDP connections from affected hosts.

**Escalation criteria & actions** - Escalate to Incident Response if: confirmed malicious payload (malware hashes), data exfil indicators, privileged account compromise, or multiple critical assets impacted. - Immediate actions: isolate affected endpoints, block intel IPs at firewall/proxy, sinkhole domain in DNS. - Document timeline, evidence (logs, file hashes), and containment steps; notify SOC lead and affected business owners.

**Why these joins and timestamps** - Correlating query_time → request_time → event_time establishes causality (DNS then HTTP then process). - Joins on client/src IP and host identifiers map network activity to user/process context, enabling accurate scope and confident escalation.

Unlock Full Question Bank

Get access to hundreds of Log Analysis and Threat Hunting in Security Data interview questions and detailed answers.

Join thousands of developers preparing for their dream job.