CCOA Adversarial Tactics — 10 Questions

Question 1

An adversary performs a 'Pass-the-Hash' attack. Which tactic does this primarily fall under?

Accepted Answer

Credential Access. Pass-the-Hash is used to authenticate as a user without needing the original password, serving the goal of Credential Access.

Answer

Initial Access

Answer

Exfiltration

Answer

Persistence

Question 2

You are auditing an environment for 'T1083 File and Directory Discovery'. Which log source provides the most visibility into this activity?

Accepted Answer

Sysmon Event ID 11. File and Directory Discovery often involves listing files, which generates audit events when monitoring directory access via Sysmon Event ID 11 or Windows Security logs.

Answer

NetFlow

Answer

DHCP logs

Answer

Firewall logs

Question 3

While analyzing an EDR alert, you observe a process modifying 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. What is the primary adversary objective at this stage?

Accepted Answer

Persistence. Modifying registry run keys is a standard technique to ensure a program executes automatically upon system startup, which defines Persistence.

Answer

Discovery

Answer

Execution

Answer

Privilege Escalation

Question 4

In the context of the MITRE ATT&CK framework, what distinguishes 'T1059 Command and Scripting Interpreter' from 'T1204 User Execution'?

Accepted Answer

T1059 describes the execution mechanism, T1204 describes the delivery. T1059 focuses on the interpretation of code (PowerShell, Bash), while T1204 focuses on the user-driven triggering of the malicious file.

Answer

There is no distinction

Answer

T1059 is for Windows, T1204 is for Linux

Answer

T1059 is the technique, T1204 is the outcome

Question 5

You are configuring a YARA rule for CrowdStrike Falcon to detect Cobalt Strike Beacon traffic. Which specific technique should you look for in the process memory that indicates process hollowing?

Accepted Answer

WriteProcessMemory to a remote process. Process hollowing involves creating a legitimate process in a suspended state and replacing its memory with malicious code, a hallmark of execution techniques.

Answer

CreateServiceW

Answer

GetSystemTime

Answer

RegCreateKeyEx

Question 6

You are reviewing logs in Splunk and identify a suspicious process spawning 'cmd.exe' from 'wsmprovhost.exe'. Which MITRE ATT&CK tactic does this behavior most directly align with?

Accepted Answer

Lateral Movement. The spawning of a command shell from a remote management process is a classic indicator of Lateral Movement using remote execution.

Answer

Credential Access

Answer

Exfiltration

Answer

Persistence

Question 7

An adversary uses 'vssadmin.exe delete shadows /all /quiet' during an attack. Which tactic is this technique categorized under?

Accepted Answer

Impact. Deleting shadow copies is a specific technique used to hinder forensic analysis and recovery, categorized under Impact.

Answer

Credential Access

Answer

Defense Evasion

Answer

Initial Access

Question 8

You are configuring Microsoft Defender for Endpoint. Which feature is most effective against 'T1566 Phishing'?

Accepted Answer

Email filtering policies. Defender for Office 365 / MDE integration provides specialized filtering for malicious attachments and URLs linked to phishing.

Answer

Network Isolation

Answer

Attack Surface Reduction (ASR) rules

Answer

Device Control

Question 9

Which action constitutes 'Discovery' as defined by the MITRE ATT&CK framework?

Accepted Answer

Running 'whoami' or 'net view'. Discovery involves gathering information about the system and network to plan subsequent steps.

Answer

Installing a backdoor

Answer

Deleting logs to hide traces

Answer

Encrypting files for ransom

Question 10

What is the purpose of 'T1027 Obfuscated Files or Information'?

Accepted Answer

To evade detection by signature-based tools. Obfuscation is used to hide code or scripts from static analysis and security tools, aiding Defense Evasion.

Answer

To escalate privileges

Answer

To increase execution speed

Answer

To facilitate lateral movement