Adversarial Tactics

You are auditing an environment for 'T1083 File and Directory Discovery'. Which log source provides the most visibility into this activity?

While analyzing an EDR alert, you observe a process modifying 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. What is the primary adversary objective at this stage?

In the context of the MITRE ATT&CK framework, what distinguishes 'T1059 Command and Scripting Interpreter' from 'T1204 User Execution'?

You are configuring a YARA rule for CrowdStrike Falcon to detect Cobalt Strike Beacon traffic. Which specific technique should you look for in the process memory that indicates process hollowing?

You are reviewing logs in Splunk and identify a suspicious process spawning 'cmd.exe' from 'wsmprovhost.exe'. Which MITRE ATT&CK tactic does this behavior most directly align with?

An adversary uses 'vssadmin.exe delete shadows /all /quiet' during an attack. Which tactic is this technique categorized under?

You are configuring Microsoft Defender for Endpoint. Which feature is most effective against 'T1566 Phishing'?

Which action constitutes 'Discovery' as defined by the MITRE ATT&CK framework?

What is the purpose of 'T1027 Obfuscated Files or Information'?

Which of the following is considered an 'Execution' tactic in the MITRE ATT&CK framework?

You are reviewing a Purple Team exercise involving 'T1003 OS Credential Dumping'. What is the most reliable way to detect credential dumping via LSASS process access?

What is the primary difference between a Red Team and a Blue Team in a security simulation?

You see a process performing DNS queries for unusually long subdomains. Which tactic is the adversary likely exercising?

You detect an adversary attempting to clear Windows Event Logs using 'wevtutil cl'. This falls under which tactic?

Which technique is most effective for an adversary to perform 'T1078 Valid Accounts'?

What is the primary goal of the 'Command and Control' (C2) tactic?

Which of these is a typical 'Lateral Movement' technique?

You are implementing threat hunting for 'T1562 Impair Defenses'. Which activity are you searching for?

What is the primary function of a 'C2 Beacon'?

An adversary is using a living-off-the-land (LotL) binary to execute commands. Why is this preferred over a custom malware?

Which of these is a 'Defense Evasion' technique?

You are investigating a breach where the attacker used 'T1555 Credentials from Password Stores'. Where would they look?

You suspect an adversary is performing 'T1005 Data from Local System'. Which of these actions is relevant?

An attacker uses 'T1133 External Remote Services' to gain access. What does this involve?

Which tactic is associated with 'T1537 Transfer Data to Cloud Account'?

During a simulation, you notice a process spawning child processes from 'wmic.exe'. What is this technique often used for?

Which TWO of the following are examples of 'Initial Access' tactics?

You are assessing an attacker's use of 'T1203 Exploitation for Client Execution'. What does this imply?

Which TWO of the following are examples of 'Persistence' tactics?

Which TWO of the following behaviors are typical of 'Lateral Movement'?

Which TWO of the following are considered 'Credential Access' techniques?

Which TWO of the following are examples of 'Discovery' techniques?

Which TWO of the following are considered 'Defense Evasion' techniques?

Which THREE of the following are common 'Exfiltration' techniques?

Which THREE of the following are considered 'Execution' techniques?

Which THREE of the following are common 'Impact' techniques?

Which THREE of the following are 'Command and Control' techniques?

Which THREE of the following are 'Privilege Escalation' techniques?

Which THREE of the following are considered 'Collection' techniques?