Indicators are attacker owned artifacts (hashes, addresses, domains) that are cheap for them to change; behaviors are the techniques they depend on, which are expensive to change. Indicator matching is fast and precise but expires quickly. Behavioral hunting is noisier and slower but survives infrastructure rotation. Run both, with indicators driving immediate blocking and retrospective searches, and behaviors driving durable detection coverage.
Why interviewers ask this
The interviewer is probing whether you understand the pyramid of pain in practice rather than as a diagram. They want the tradeoff stated honestly: behavioral detections cost more analyst time and produce more noise, which is exactly why teams default to indicator feeds and then wonder why they miss things. A good answer assigns each approach a job rather than declaring one of them superior.
How to structure your answer
- Define both in terms of cost to the attacker.
- Assign each one a specific operational job.
- Be honest about the false positive tradeoff.
- Give an example where an indicator hunt alone would have failed you.
Example answer
Indicators are the things an attacker can change in an afternoon: a hash, an address, a domain. Behaviors are how they operate, and changing those means retooling. So I use them for different jobs. When threat intel drops indicators I run them as a retrospective search across ninety days and push blocks, because that is cheap and occasionally catches something dormant. But I do not count that as detection coverage, because the same actor will have rotated infrastructure by next week. Behavioral hunting is where the durable wins are: start from a hypothesis, say an attacker using a signed binary to proxy execution, then hunt the parent child relationships that would show it. It is slower and it produces more to sift through, so I timebox hunts and write up negative results too, because knowing you looked matters. The clearest example I have had was an indicator list that matched nothing, while a behavioral hunt on service creation from a non administrative process found the same actor on two hosts.
Walking into this interview soon? GhostPilot listens to your live call, spots the question the moment it is asked, and puts a structured answer on your screen in real time. Try it on your next mock, or grab a $29 Session Pass, no subscription, for the real thing.
See how it worksFollow-up questions to expect
- How do you turn a successful hunt into a detection rule?
- How do you measure whether your hunting program is working?
- Where do you get behavioral hypotheses from?
Related cybersecurity analyst questions
Your interviewer will ask their own version of this. Paste your actual job description into the free Question Predictor and get the 20 questions that role is most likely to ask, with what each one is really probing.
Predict my questions