Quiz — ATT&CK Hunting
10 APPLY items on ATT&CK mapping, technique hypotheses, and hunt queries on $HUNT_LAB.
ATT&CK Hunting — Module Quiz
Ten APPLY items. Name ATT&CK hunt concepts on YOUR $HUNT_LAB jsonl — never stranger cluster access, production queries, or offensive playbooks. Original Cyberlium. Next: SPL Literacy.
APPLY: MITRE ATT&CK helps defenders:
APPLY: True or False: Technique hypotheses must tie ATT&CK IDs to observable lab telemetry.
APPLY: T1110 in defender context often means:
APPLY: Tutorial runs live lateral movement for hunt practice — you:
APPLY: jq on lab jsonl helps practice:
APPLY: First step in good hunt query:
APPLY: Cyberlium NEVER allows:
APPLY: True or False: Refuted technique hypotheses still document coverage gaps.
APPLY: chmod 600 on ATT&CK notes means:
APPLY: Next lesson after this quiz: