EC-Council CSA · Domain 5 of 8

EC-Council CSA Domain 5: Proactive Threat Detection

Proactive Threat Detection is 12% of CSA v2. It combines cyber threat intelligence, covering types, strategies, sources, platforms and use in incident response, with threat hunting frameworks and hands-on hunting using PowerShell, YARA and dedicated tools.

Exam weight
12%
Official objectives
9
Estimated questions estimate
~12
Suggested study time estimate
9–12 hrs

About 13 min read Reviewed October 2026

Overview

Domain 5 moves the SOC from waiting for alerts to looking ahead. The first part is threat intelligence: what it is, how the intelligence lifecycle runs from planning and collection through processing, analysis and dissemination, and the four common types, strategic, tactical, operational and technical. You learn intelligence strategies and sources such as open-source feeds, commercial providers, ISACs, government advisories and internal telemetry, plus sharing standards like STIX and TAXII and threat intelligence platforms such as MISP or OpenCTI. The blueprint then asks how an intelligence-driven SOC benefits the team and how intelligence use cases sharpen incident response.

The second part is threat hunting. It covers why hunting matters, how hypothesis-driven, intelligence-driven and analytics-driven hunts differ, frameworks and maturity models for running a hunting program, and practical hunting with PowerShell queries, YARA rules and purpose-built tools. This combined domain is new in shape for v2.

How it's tested

Questions mix definitions with short practical items. Intelligence questions ask which type, source or standard fits a need. Hunting questions describe a hunt and ask which approach or framework it follows, or show a PowerShell command or YARA rule and ask what it finds. Expect several questions on how intelligence integrates with SIEM and response.

  • Classify the intelligence

    A piece of information and its audience are described, and you identify it as strategic, tactical, operational or technical.

  • Pick the hunt approach

    A hunt's starting point is described, and you decide whether it is hypothesis-driven, intelligence-driven or analytics-driven.

  • Read the hunting artifact

    A YARA rule or PowerShell command is shown, and you state what it will match or return.

Reasoning it through

A hunter reads an advisory that a ransomware group uses scheduled tasks named to look like updater services, then searches all endpoints for recently created scheduled tasks with that naming pattern. The hunt began from external reporting about a specific adversary's behavior. That makes it intelligence-driven hunting, even though it targets a technique, and confirmed findings should become a SIEM detection.

Objectives 9

Official objectives from the EC-Council outline, in outline order.

5.1 Learn Fundamental Concepts of Threat IntelligenceWhat threat intelligence is and how it is produced.
What it means
Threat intelligence is evidence-based knowledge about threats, including context, mechanisms, indicators and implications, that helps an organization make defensive decisions. Raw data becomes intelligence only after it is processed, analyzed and made relevant.
What to understand
The intelligence lifecycle runs planning and direction, collection, processing and exploitation, analysis and production, and dissemination and integration, with feedback guiding the next cycle. Good intelligence is timely, relevant, accurate and actionable. An indicator feed with no context is data, not intelligence, until someone assesses what it means for the organization.
How it shows up
Questions ask for the lifecycle phase that matches an activity or what turns data into intelligence.
Common confusion
Calling an unfiltered IP blocklist intelligence; it lacks analysis and context.
5.2 Understand Types and Strategies of Threat IntelligenceStrategic, tactical, operational and technical intelligence and how programs are planned.
What it means
Strategic intelligence is high-level, long-term information on threat trends and risk for executives. Tactical intelligence describes adversary TTPs for security managers and architects. Operational intelligence gives details of specific campaigns or imminent attacks. Technical intelligence is machine-readable indicators such as hashes, IPs and domains.
What to understand
A threat intelligence strategy starts with intelligence requirements tied to business risk, then decides sources, tools, staffing, sharing partners and how output reaches consumers. Each type serves a different audience and timescale. Technical intelligence ages fastest; strategic intelligence lasts longest.
How it shows up
Information and an audience are described, and you pick the intelligence type.
Common confusion
Mixing up tactical intelligence, which covers TTPs, with technical intelligence, which covers specific indicators.
5.3 Understand the Various Threat Intelligence SourcesWhere intelligence comes from.
What it means
Sources include open-source intelligence, commercial feeds, industry ISACs and ISAOs, government agencies and CERTs, vendor research, dark web monitoring, human sources and internal sources such as SIEM, EDR and past incidents.
What to understand
Internal intelligence is often the most relevant because it reflects attacks against your own environment. Open sources are cheap but noisy and vary in reliability. Analysts should assess source reliability and information credibility, deduplicate feeds and expire stale indicators. Sharing communities work best under agreed handling rules such as the Traffic Light Protocol.
How it shows up
Expect questions on which source fits a need or how to judge a source's value.
Common confusion
Assuming more feeds always improve detection; overlapping, stale feeds increase false positives.
5.4 Understand Threat Intelligence Platforms (TIP)Tools that collect, manage and share intelligence.
What it means
A threat intelligence platform aggregates feeds, normalizes and deduplicates indicators, enriches and scores them, supports analyst collaboration and pushes intelligence to SIEM, firewalls, EDR and SOAR.
What to understand
STIX is the standard language for describing threat information as objects such as indicators, malware and threat actors, while TAXII is the protocol for exchanging STIX over HTTPS. MISP and OpenCTI are open-source platforms; commercial options add curated feeds. TIP integration lets the SIEM flag events matching current indicators automatically.
How it shows up
Questions ask what a TIP does or which standard handles format versus transport.
Common confusion
Swapping STIX and TAXII; STIX is the content format, TAXII the transport.
5.5 Understanding Threat Intelligence-Driven SOC and Its Benefits to SOC TeamUsing intelligence across SOC operations.
What it means
An intelligence-driven SOC uses threat intelligence at every stage: prioritizing which use cases to build, enriching alerts, guiding hunts, scoping incidents and informing leadership about relevant threats.
What to understand
Benefits include faster triage because alerts carry context, fewer false positives through better prioritization, earlier detection of campaigns aimed at the sector, and better resource allocation. Intelligence also helps measure detection coverage against the TTPs of relevant adversaries, often mapped to MITRE ATT&CK.
How it shows up
A SOC problem is described, and you identify how intelligence would help.
Common confusion
Thinking intelligence only means blocking indicators, rather than guiding priorities and analysis.
5.6 Demonstrate the Use of Threat Intelligence Use Cases to Enhance Incident ResponseApplying intelligence during incident handling.
What it means
Intelligence use cases in incident response include enriching indicators found during triage, attributing activity to a known campaign, predicting next attacker steps from known TTPs, and hunting for related indicators across the environment.
What to understand
When responders know an adversary's usual tools and persistence methods, they can scope faster and check for footholds the initial alert missed. Indicators from the incident should be shared back to the TIP and, where appropriate, to sharing partners. Intelligence also informs containment choices, for example blocking all of a campaign's known infrastructure.
How it shows up
Questions describe an incident and ask how intelligence would speed scoping or containment.
Common confusion
Stopping the investigation at the first indicator instead of using intelligence to find related activity.
5.7 Understand Threat Hunting and its SignificanceProactive searching for threats that evaded detection.
What it means
Threat hunting is a proactive, human-led search through data for malicious activity that existing automated detections have not flagged. It assumes compromise may already exist.
What to understand
Hunting reduces dwell time, finds gaps in detection content and improves analyst knowledge of the environment. Approaches include hypothesis-driven hunts based on likely attacker behavior, intelligence-driven hunts based on indicators or reports, and analytics-driven hunts based on anomalies or baselines. Successful hunts should produce new or improved automated detections.
How it shows up
Expect questions distinguishing hunting from alert monitoring or identifying a hunt's approach.
Common confusion
Calling the review of SIEM alerts threat hunting; hunting starts without an alert.
5.8 Understand Threat Hunting FrameworksStructured models for running and maturing hunts.
What it means
Hunting frameworks give hunts a repeatable structure. Common references are the hunting loop of hypothesis, investigation, pattern discovery and automation, the Hunting Maturity Model from HM0 to HM4, TaHiTI and PEAK, along with MITRE ATT&CK for choosing techniques to hunt.
What to understand
The Hunting Maturity Model rates capability from HM0, relying on automated alerts only, to HM4, where most successful hunts are automated into detections. Frameworks require clear hypotheses, data requirements, documented results and handover to detection engineering. Mapping hunts to ATT&CK shows coverage across tactics.
How it shows up
A hunting program is described, and you identify its maturity level or the next framework step.
Common confusion
Assuming HM0 means no SOC; it means detection depends only on automated alerting.
5.9 Demonstrate Threat Hunting using PowerShell, Yara, and Threat Hunting ToolsPractical hunting techniques and tools.
What it means
PowerShell lets hunters query Windows hosts directly, for example Get-WinEvent for event logs, Get-Process and Get-CimInstance for processes, Get-ScheduledTask for persistence and Get-NetTCPConnection for network connections. YARA rules match patterns in files or memory.
What to understand
A YARA rule has a meta section for description, a strings section for text, hex or regex patterns, and a condition that decides a match, such as two of the strings plus a file size limit. Hunting tools include EDR query consoles, Sysinternals utilities such as Autoruns, and open-source frameworks. Remote PowerShell use should itself be logged and restricted.
How it shows up
A command or rule is shown, and you say what it returns or matches.
Common confusion
Thinking a YARA rule matches if any string appears; the condition decides, which may require several.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Intelligence lifecycle

    Planning, collection, processing, analysis, dissemination with feedback.

    Remember
    Requirements drive collection.
    Tested as
    Lifecycle questions.
    Trap
    Starting with collection before requirements.

  • Strategic intelligence

    Long-term threat trends and business risk for leadership.

    Remember
    Non-technical and lasting.
    Tested as
    Type questions.
    Trap
    Giving it to tier 1 analysts for blocking.

  • Tactical intelligence

    Adversary TTPs for security teams.

    Remember
    Describes how attackers operate.
    Tested as
    Type questions.
    Trap
    Confusing it with technical indicators.

  • Operational intelligence

    Details of specific campaigns or imminent attacks.

    Remember
    Who, when and what is targeted.
    Tested as
    Type questions.
    Trap
    Calling it strategic.

  • Technical intelligence

    Machine-readable indicators such as hashes and IPs.

    Remember
    Ages quickly.
    Tested as
    Type and SIEM integration questions.
    Trap
    Treating it as long-lasting.

  • STIX and TAXII

    STIX describes threat information; TAXII transports it.

    Remember
    Format versus exchange protocol.
    Tested as
    Standards questions.
    Trap
    Swapping the two.

  • Threat intelligence platform

    System that aggregates, enriches, scores and shares intelligence.

    Remember
    Feeds SIEM, EDR and firewalls.
    Tested as
    TIP questions.
    Trap
    Equating it to a single feed.

  • Traffic Light Protocol

    Labels that set how widely shared information may be passed on.

    Remember
    TLP:RED is most restricted.
    Tested as
    Sharing questions.
    Trap
    Reading TLP:CLEAR as restricted.

  • Hypothesis-driven hunting

    Starts from a testable idea about attacker behavior.

    Remember
    Often mapped to ATT&CK techniques.
    Tested as
    Hunt approach questions.
    Trap
    Confusing it with alert response.

  • Hunting Maturity Model

    HM0 initial to HM4 leading.

    Remember
    Higher levels automate successful hunts.
    Tested as
    Maturity questions.
    Trap
    Thinking HM0 means no detection at all.

  • YARA rule

    Meta, strings and condition sections that match file or memory content.

    Remember
    The condition controls the match.
    Tested as
    Rule reading questions.
    Trap
    Assuming any string triggers a match.

  • Get-WinEvent

    PowerShell cmdlet for querying Windows event logs.

    Remember
    Supports filtering by ID and time.
    Tested as
    PowerShell hunting questions.
    Trap
    Confusing it with Get-Process.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Threat intelligence types

ConceptMeaningKey differenceCommon trap
Strategic Trends and risk for executives Long-term, non-technical Using it for blocking
Tactical Adversary TTPs Guides defenses and detections Calling it indicator data
Operational Specific campaigns and attacks Near-term and targeted Confusing with strategic
Technical IoCs such as hashes and IPs Machine-readable, short-lived Treating as durable

Hunting approaches

ConceptMeaningKey differenceCommon trap
Hypothesis-driven Tests an idea about likely behavior Starts from reasoning Waiting for an alert
Intelligence-driven Starts from indicators or reports External or internal intel trigger Calling it hypothesis-only
Analytics-driven Starts from anomalies or baselines Data and statistics led Ignoring baseline quality

Sigma vs. YARA vs. STIX

ConceptMeaningKey differenceCommon trap
Sigma Log detection rule format Searches events in a SIEM Using it on files
YARA File and memory pattern rules Matches content Using it on logs
STIX Threat information format Shares intelligence objects Treating it as a detection rule

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Data is intelligence

    What candidates pick
    Call a raw indicator feed threat intelligence.
    Why it looks right
    Feeds are marketed as intelligence.
    Why it's wrong
    Without analysis and context relevant to the organization, a feed is only data.

    Clue to watch for The scenario lacks any assessment of relevance.

  2. STIX transports

    What candidates pick
    Choose STIX as the protocol to exchange intelligence between servers.
    Why it looks right
    STIX and TAXII are always mentioned together.
    Why it's wrong
    TAXII is the exchange protocol; STIX defines the content.

    Clue to watch for The question asks how intelligence is transmitted.

  3. Tactical means indicators

    What candidates pick
    Label a list of malicious hashes as tactical intelligence.
    Why it looks right
    Both are used by security teams.
    Why it's wrong
    Indicator lists are technical intelligence; tactical intelligence describes TTPs.

    Clue to watch for The content is machine-readable indicators.

  4. Hunting from an alert

    What candidates pick
    Call investigation of a SIEM alert a hunt.
    Why it looks right
    Both involve searching data.
    Why it's wrong
    Hunting is proactive and starts without an alert; alert investigation is triage.

    Clue to watch for An alert already fired in the scenario.

  5. Any string matches

    What candidates pick
    Assume a YARA rule fires when one listed string is present.
    Why it looks right
    Strings look like the detection logic.
    Why it's wrong
    The condition section decides, and it may require several strings or other checks.

    Clue to watch for The condition says all of them or 2 of them.

  6. More feeds, better SOC

    What candidates pick
    Subscribe to more feeds to improve detection quality.
    Why it looks right
    More data seems more complete.
    Why it's wrong
    Duplicate and stale indicators raise false positives; relevance and curation matter more.

    Clue to watch for Complaints about noisy intelligence matches.

Answer framework

For Domain 5 questions on intelligence or hunting, apply these steps in order.

  1. Decide whether the question is about producing intelligence, consuming it, sharing it or hunting with it, because each activity has its own vocabulary and tools.
  2. For type questions, identify the audience and timescale: executives and long term mean strategic, technical indicators mean technical.
  3. For standards and platforms, separate the format, STIX, from the transport, TAXII, and from the platform that manages both, such as MISP.
  4. For hunting questions, find the starting point of the hunt to classify it as hypothesis-driven, intelligence-driven or analytics-driven.
  5. For practical items, read the PowerShell cmdlet or YARA condition carefully, and remember that a successful hunt should become an automated detection.

Practice question

A SOC's threat intelligence team must deliver a quarterly briefing to the board about which threat actor groups target the company's industry and how that affects business risk. Which type of threat intelligence is this?

Want more like this? The EC-Council CSA practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Split your time evenly between intelligence and hunting. For intelligence, start with the lifecycle and the four types; write a short example of each type for your own organization or a fictional one, naming the audience. Then learn sources, the Traffic Light Protocol, and the STIX and TAXII pair until you can explain each in one sentence. If possible, explore a public MISP or OpenCTI demo to see how indicators, relationships and feeds look.

For hunting, learn why it exists and the three starting points, then the Hunting Maturity Model levels. Practice writing three hypotheses mapped to ATT&CK techniques, such as persistence through scheduled tasks or credential dumping from LSASS. In a Windows lab, run Get-WinEvent with a filter hash table, list scheduled tasks and network connections, and run Autoruns.

Write two or three YARA rules against harmless test files and change the condition to see how matching changes. With about twelve questions in this domain, aim to answer the practical items quickly so you have time for longer scenarios elsewhere.

FAQ

How much of CSA v2 is Proactive Threat Detection?

Proactive Threat Detection is 12% of the blueprint, about twelve of the 100 questions, combining threat intelligence and threat hunting.

What are the four types of threat intelligence?

Strategic for leadership and long-term risk, tactical for adversary TTPs, operational for specific campaigns, and technical for machine-readable indicators.

What is the difference between STIX and TAXII?

STIX is a structured language for describing threat information. TAXII is the protocol used to exchange STIX content between systems.

Is threat hunting the same as monitoring alerts?

No. Monitoring reacts to alerts from existing detections. Hunting proactively searches for threats those detections missed, starting from a hypothesis, intelligence or an anomaly.

Do I need to write YARA rules for the exam?

You should be able to read a simple YARA rule, understand its meta, strings and condition sections, and predict whether a file would match.

Which PowerShell cmdlets are useful for hunting?

Get-WinEvent for logs, Get-Process and Get-CimInstance for processes, Get-ScheduledTask for persistence, and Get-NetTCPConnection for network connections are good starting points.

What should happen after a successful hunt?

Document the findings, start incident response if needed, and convert the hunt logic into an automated SIEM or EDR detection.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 5 knowledge

You have covered threat intelligence types, sources, platforms and use in response, plus hunting frameworks and tools. Test whether you can classify intelligence and read hunting artifacts.

Take the EC-Council CSA practice test Check your EC-Council CSA readiness

Keep going