CCOA Adversarial Tactics — 10 Questions

Question 1

In the context of the MITRE ATT&CK framework, what distinguishes 'T1059 Command and Scripting Interpreter' from 'T1204 User Execution'?

Accepted Answer

T1059 describes the execution mechanism, T1204 describes the delivery. T1059 focuses on the interpretation of code (PowerShell, Bash), while T1204 focuses on the user-driven triggering of the malicious file.

Answer

There is no distinction

Answer

T1059 is for Windows, T1204 is for Linux

Answer

T1059 is the technique, T1204 is the outcome

Question 2

You are configuring a YARA rule for CrowdStrike Falcon to detect Cobalt Strike Beacon traffic. Which specific technique should you look for in the process memory that indicates process hollowing?

Accepted Answer

WriteProcessMemory to a remote process. Process hollowing involves creating a legitimate process in a suspended state, unmapping its original code, and writing malicious code into its memory space before resuming it. The WriteProcessMemory API call to a remote process is the key indicator: it is used to inject the payload into the hollowed process's address space. Detecting WriteProcessMemory targeting another process's memory — especially combined with CreateProcess in a suspended state and ResumeThread — is a strong signal of process hollowing.

Answer

CreateServiceW

Answer

GetSystemTime

Answer

RegCreateKeyEx

Question 3

An adversary performs a 'Pass-the-Hash' attack. Which tactic does this primarily fall under?

Accepted Answer

Credential Access. Pass-the-Hash is used to authenticate as a user without needing the original password, serving the goal of Credential Access.

Answer

Initial Access

Answer

Exfiltration

Answer

Persistence

Question 4

During a simulation, you notice a process spawning child processes from 'wmic.exe'. What is this technique often used for?

Accepted Answer

Execution. WMIC is often used for remote execution and discovery in Windows environments.

Answer

Exfiltration

Answer

Collection

Answer

Impact

Question 5

Which TWO of the following are considered 'Defense Evasion' techniques?

Accepted Answer

Masquerading. Masquerading (A) is a Defense Evasion technique because an adversary manipulates, names, or renames legitimate system tools, files, or processes to make malicious activity appear benign, thereby bypassing security controls and evading detection. Indicator removal on host (D), such as clearing Windows Event Logs (e.g., wevtutil cl) or deleting files, is also Defense Evasion because it erases forensic artifacts that defenders and monitoring tools rely on to detect intrusions. Account manipulation (B) belongs to the Persistence tactic (creating or modifying accounts to maintain access), not Defense Evasion. Data staging (C) is part of the Collection tactic, where data is gathered and consolidated prior to exfiltration. Remote service creation (E) is a Persistence/Execution technique (e.g., creating a service via sc.exe or PsExec) used to run code, not primarily to evade defenses.

Answer

Account manipulation

Answer

Data staging

Answer

Remote service creation

Question 6

A threat hunter is reviewing logs for potential Defense Evasion techniques. Which TWO of the following activities are categorized under the Defense Evasion tactic in MITRE ATT&CK? (Choose two.)

Accepted Answer

Using rundll32.exe to execute a malicious DLL. Deleting event logs and using rundll32.exe for execution are both Defense Evasion techniques. They aim to remove evidence or bypass security controls by leveraging trusted binaries. The other options are Discovery, Process Injection (which can be Defense Evasion but is not the best fit here), and Persistence, respectively.

Answer

Enumerating local administrators using net localgroup

Answer

Scheduling a task to run a malicious script at logon

Answer

Injecting code into a remote process using CreateRemoteThread

Question 7

An analyst observes that an attacker has used the 'at' command to schedule a job that runs a reverse shell every hour on a compromised Linux server. Which tactic does this represent?

Accepted Answer

Persistence. Scheduling a recurring job with 'at' is a Persistence technique. It allows the adversary to maintain access by ensuring their payload executes at regular intervals, even after system restarts. This is a common method on Linux systems to keep a foothold without interactive access.

Answer

Defense Evasion

Answer

Privilege Escalation

Answer

Execution

Question 8

A security analyst is investigating an alert where a user received a document that, when opened, immediately spawned a child process of WINWORD.EXE. The child process then made a network connection to an external IP address. The analyst suspects a specific MITRE ATT&CK technique. Which technique is most likely being used?

Accepted Answer

T1203 Exploitation for Client Execution. The scenario describes a document that, when opened, spawns a child process of WINWORD.EXE and makes a network connection. This behavior is typical of exploiting a vulnerability in the client application (Word) to execute arbitrary code, which aligns with Exploitation for Client Execution. The other techniques, such as User Execution, Command and Scripting Interpreter, and Phishing, do not specifically capture the exploitation of the client software to achieve code execution.

Answer

T1059 Command and Scripting Interpreter

Answer

T1204 User Execution

Answer

T1566 Phishing

Question 9

A security analyst is reviewing DNS logs and observes a workstation repeatedly querying subdomains such as 'a1b2c3.data.evilcorp.com' and 'd4e5f6.data.evilcorp.com' at regular intervals, with each subdomain resolving to the same IP address. The workstation has no legitimate business need to contact evilcorp.com. Which ATT&CK technique is MOST likely being used?

Accepted Answer

T1071.004 Application Layer Protocol: DNS. The consistent, automated-looking DNS queries to subdomains of a single suspicious domain, with no business justification, are a classic indicator of DNS-based command and control. Attackers use the DNS protocol because it is often allowed through egress filtering and can carry encoded beaconing data. The technique is categorized under Application Layer Protocol: DNS, which covers using DNS for C2 communications.

Answer

T1204.002 User Execution: Malicious File

Answer

T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Answer

T1568.002 Dynamic Resolution: Domain Generation Algorithms

Question 10

A security operations center (SOC) analyst is reviewing alerts related to credential dumping. The analyst observes several suspicious activities on a Windows endpoint. Which TWO of the following activities are considered Credential Access techniques according to MITRE ATT&CK? (Choose two.)

Accepted Answer

Accessing the Local Security Authority Subsystem Service (LSASS) process memory. Accessing LSASS process memory and dumping the Windows Registry hive containing password hashes are both direct methods of obtaining credential material. LSASS memory contains credentials such as NTLM hashes and Kerberos tickets, while the SAM/SECURITY hives store password hashes. These activities are classified under Credential Access in MITRE ATT&CK. The other activities are related to Persistence or Discovery, not Credential Access.

Answer

Capturing network traffic to extract cleartext credentials

Answer

Using WMI to query installed antivirus products

Answer

Creating a scheduled task to run a script at system startup