English
Menu

Cyber Attacks and Defense in Practice

MITRE ATT&CK is a knowledge base that organizes the methods observed in real attacks into "tactics", which represent the attacker's goals, and "techniques", which represent the concrete methods for achieving those goals. Which of the following correctly pairs an observed action with the tactic it falls under?

  1. ARemotely connecting to another internal server with stolen administrator credentials falls under exfiltration
  2. BCompressing internal files and sending large amounts of them to external cloud storage falls under initial access
  3. CRegistering itself as an OS service so that it runs automatically even after a reboot falls under persistence
Show answer and explanation

Answer: C. Registering itself as an OS service so that it runs automatically even after a reboot falls under persistence

ATT&CK tactics express "why" an attacker takes an action (the goal) and techniques express "how"; for example, the persistence tactic includes techniques such as registering a service, scheduled tasks and changing settings that run at startup. Extending connections to other servers falls under the lateral movement tactic, and sending data outside falls under the exfiltration tactic. Defenders map which techniques their detections and controls cover onto ATT&CK to find weak spots. Because techniques have identifiers, threat intelligence reports and detection rules can refer to the same method by the same number.

  • A. Extending connections to another server falls under the lateral movement tactic.
  • B. Sending data outside falls under the exfiltration tactic. Initial access is the stage of first getting into the organization's network.
  • C. Correct. Actions that keep access even after a reboot or a change of credentials fall under the persistence tactic.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. Which of the following is an "initial access" method, by which an attacker first gets into an organization's network?
  2. An examination of the records of traffic on an internal network found the following traffic. Which of them most strongly suggests that malware is communicating with an external command server (C2 server)?
  3. An attacker who exploited a vulnerability in a web application can now run commands with the same ordinary user privileges as the web server program. Which of the following is an example of the "privilege escalation" the attacker carries out next?
  4. Which of the following is the most appropriate control for making "lateral movement" difficult, that is, the spread of a compromise from one hijacked employee PC to other PCs and servers inside the company?
  5. The technique in which an intruder avoids using custom malware as far as possible and works with legitimate tools already present in the OS, such as PowerShell, WMI and the standard remote administration features, is called "living off the land". Which of the following is the most appropriate way of thinking about countermeasures to this technique?

Comparisons in this topic