CCNA Cyber Threats And Attack Frameworks Questions

A command-line execution sequence captures attacker behaviour in progress, such as suspicious process chains, rather than a static artefact left behind. IOAs focus on active tactics and techniques, distinguishing them from IOCs like file hashes or IP addresses.

Exploitation is the phase where the adversary takes advantage of a vulnerability to gain access to the target system. In this scenario, the adversary exploited a vulnerability in a public-facing web server to gain a foothold, which directly matches the Exploitation phase. This phase follows Delivery and precedes Installation. It is the moment the adversary's code executes on the victim's system, often via a remote exploit.

Adversary is the actor or group responsible for the intrusion. It is a core feature of the Diamond Model. The analyst must identify the adversary to attribute the attack and understand their motivation. Along with capability, it completes the model when victim and infrastructure are known.

The Command and Control phase is when the adversary establishes a communication channel with the compromised system. After delivery and exploitation, the attacker needs to control the malware. The scenario states the adversary is establishing a C2 channel, which directly matches this phase.

Clearing Windows Event Logs is classified as Defense Evasion (Indicator Removal) because it erases forensic artefacts that defenders rely on. Destroying audit evidence impedes detection and investigation, matching the technique's defining trait of avoiding observation rather than gaining access.

Registered domains and fast-flux DNS form part of the Infrastructure axis because they are adversary-controlled resources used for delivery and command and control. Fast flux rapidly rotates IP addresses behind changing DNS records to complicate takedown and tracking. These domains are not the capability itself but the operational platforms that support it, making Infrastructure the correct Diamond Model classification.

Using PowerShell with Base64 encoding is a technique (T1059.001 and T1027) within the Execution and Defense Evasion tactics. It describes a specific method the adversary uses to run code and avoid detection. This is a TTP because it reflects a behavioral pattern that can be detected and mitigated.

In the Diamond Model, Capability refers to the tools, techniques, and malware used by the adversary. A custom backdoor is a distinctive capability that can serve as a pivot point to correlate with other incidents where the same or similar tool was used. This helps attribute activity to a specific threat group by matching their toolset.

T1547.001 specifically covers Registry Run Keys, which load programs automatically at user logon. Writing to the HKLM Run key establishes persistence machine-wide, matching the stem's custom script exactly. Other T1547 sub-techniques address different autostart locations, such as Startup folders or Winlogon helpers, so they do not fit this registry path.

Threat actor aliases sit within the Adversary vertex, which describes the actor conducting the intrusion. Aliases are the alternate names by which an adversary is tracked, alongside the operator and customer roles that the vertex also encompasses.

Reconnaissance is the first phase of the Cyber Kill Chain and involves harvesting information about the target, such as employee names, email addresses, and technical infrastructure. The scenario explicitly states the adversary spent weeks performing open-source research on employees and infrastructure before any exploitation, which maps directly to this phase. No payload, delivery, or exploitation activity is described, confirming this is the correct phase.

Reconnaissance covers the attacker researching and selecting targets, harvesting email addresses, and identifying weaknesses. It satisfies the pre-target criterion because all activity happens externally, before any payload is built or delivered to the victim environment.

Monitoring anomalous process execution patterns detects living-off-the-land abuse, where attackers wield native tools such as PowerShell, WMI or certutil instead of malware. This satisfies the stem's constraint by focusing on behavioural anomalies in legitimate binaries, mapping to ATT&CK's Execution and Defense Evasion tactics, rather than relying on signature-based indicators that such techniques deliberately avoid.

The Installation phase covers malware being placed and persisted on the victim host. Endpoint Detection and Response monitors process, file and registry activity on that host, so it detects and blocks the installation attempt before the attacker proceeds to command-and-control.

Double extortion involves both encrypting data and exfiltrating it, then threatening to leak the stolen data if the ransom is not paid. This increases pressure on victims, especially those with regulatory or reputational concerns, such as hospitals. The scenario aligns with this tactic because the group targets healthcare organizations where data sensitivity is high.

Running PowerShell with an encoded command is adversary behaviour that results in code running on the victim system, which maps to the Execution tactic. The framework classifies the technique by its immediate goal — executing the payload — not by the later download or persistence steps.

A SHA-256 file hash uniquely identifies known malicious files, so it functions as a host-based artefact IOC. It satisfies the stem's requirement by being a concrete, observable indicator type that detection tooling can match against during compromise investigations.

Indicators of behavior (IOBs) focus on the adversary's tactics, techniques, and procedures, such as how the backdoor establishes persistence or communicates with C2. Mapping these to MITRE ATT&CK techniques allows the analyst to create detection rules that are resilient to minor changes in the malware. This approach captures the operational behavior the analyst seeks, making it the most effective for detecting a previously unknown backdoor.

DGA generates many domain names that the malware cycles through until it finds an active C2 server. This makes it difficult for defenders to blacklist all possible domains, as the set is large and changes frequently. The primary purpose is to evade detection and blocking, ensuring resilient C2 communication even if some domains are taken down.

Process hollowing unmaps a legitimate process's memory and injects malicious code into that suspended host, so execution appears to originate from a trusted binary. This masquerading defeats host defences and analysts, placing the technique under Defense Evasion rather than Execution or Persistence.

Within the Diamond Model, the C2 server IP address is a physical or logical resource the adversary uses to communicate with and control victims, which is the Infrastructure vertex. Capability covers tools and malware, while Adversary and Victim are the other two vertices.

The Diamond Model treats Infrastructure, Capability, Adversary and Victim as interconnected vertices. Discovering a new IP lets the analyst pivot along the Infrastructure-Capability or Infrastructure-Adversary edge to attribute the activity and expand the intrusion set.

Scheduled Task/Job is a persistence technique where adversaries schedule tasks to execute malicious code at specific times or on certain events. In this scenario, the adversary uses scheduled tasks to maintain persistence, which aligns with this technique. It allows them to survive reboots and re-establish access.

Capability is one of the four Diamond Model vertices, representing the adversary's tools, techniques and malware used in an intrusion. It satisfies the question's requirement for a primary vertex, pairing with adversary, infrastructure and victim to describe each event.

Weaponization couples an exploit with a deliverable payload, producing the tailored malware itself. Custom-compiling a Trojan to evade EDR is precisely this pairing step, occurring before delivery, so it sits in the Weaponization phase rather than Exploitation or Command and Control.

Initial Access is the tactic that describes how adversaries gain an entry point into the network. Using valid VPN credentials to access the corporate network is an example of the Valid Accounts technique under Initial Access. This matches the scenario where the adversary used compromised credentials to enter the environment, making Initial Access the correct tactic.

AppInit DLLs is a specific MITRE ATT&CK technique under Persistence and Privilege Escalation. It involves modifying the AppInit_DLLs registry key to load a malicious DLL into every process that loads User32.dll, providing persistence and often privilege escalation. The scenario exactly matches this technique, making it the correct answer.

Lateral Movement consists of techniques that enable an adversary to enter and control remote systems on a network. Using WMI to create processes on other domain hosts is the textbook example of Windows Management Instrumentation (T1047) being used for lateral movement, allowing the adversary to expand access from one compromised host to others without deploying additional tooling.

Defense Evasion qualifies because adversaries obscure their tooling and activity to avoid detection while resident, for example by clearing logs, masquerading files or disabling security controls. This tactic supports staying hidden on the compromised host, complementing Persistence and Privilege Escalation in maintaining a foothold.

ATT&CK techniques and sub-techniques describe specific adversary behaviors, such as how initial access was gained or how execution was achieved. Mapping to this level provides actionable intelligence for detection and mitigation. In this scenario, identifying the novel exploit as Exploit Public-Facing Application and the malware delivery as a specific technique allows defenders to implement targeted controls.

T1018 maps to Remote System Discovery, covering enumeration of networked systems via commands such as `net view`. The stem's constraint—internal reconnaissance through `net view`—falls squarely within this technique's scope, since the command lists domain computers and shares rather than credentials or accounts.

In the Pyramid of Pain, TTPs are at the top, meaning they are the most difficult for an adversary to change. Blocking TTPs forces the adversary to alter their behavior significantly, causing the most pain. This is because TTPs represent the adversary's operational methods, which are costly and time-consuming to modify.

Registry key modification is a host-based artefact, recorded in the Windows registry on an infected endpoint. It satisfies the stem's requirement for a Host-based IOC, unlike network-based indicators such as IP addresses or domain names. Registry persistence keys, for example Run entries, commonly reveal APT footholds during forensic triage.

Command and Control (C2) is the phase where the adversary establishes a communication channel with the compromised system to issue commands and exfiltrate data. The unusual outbound traffic to a known malicious IP indicates the workstation is beaconing to a C2 server, which is a classic sign of this phase. This aligns with the Cyber Kill Chain's C2 stage.

Spearphishing Attachment is a technique under the Initial Access tactic in MITRE ATT&CK. It involves sending a phishing email with a malicious attachment to gain an initial foothold in the target network. This matches the scenario where the adversary is using this technique to enter the environment. Therefore, Initial Access is the correct tactic.

APTs combine advanced tradecraft, sustained persistence and a specific target, distinguishing them from opportunistic or mass-market malware. The defining axis is duration plus targeting: attackers maintain long-term access to exfiltrate data or hold position, rather than executing a single quick compromise.

Domain fronting exploits CDNs that route based on the HTTP Host header while the TLS SNI indicates a different domain. The attacker sets the SNI to a legitimate high-reputation domain and the Host header to the malicious domain, both served by the same CDN. This makes network monitoring see only the legitimate SNI, effectively hiding the true destination.

APTs are distinguished by their ability to maintain long-term access to victim networks while remaining undetected, and to exfiltrate data over extended periods. This persistence and stealth are core characteristics that separate APTs from other threat actors. The scenario describes exactly this behavior.

Reconnaissance involves external scanning, OSINT gathering and probing of exposed services, all visible in network telemetry. Firewalls, IDS and threat intelligence feeds can detect and disrupt scanning activity, making network-level controls effective for this phase as the stem requires.

Phishing email addresses and spoofed sender domains are part of the adversary's Infrastructure because they are the delivery and communication mechanisms used to reach victims. Infrastructure encompasses all the resources that enable the adversary to operate, including email accounts and domains. This option correctly identifies a type of infrastructure used in the attack.

Delivery covers transmitting the weaponised payload to the victim, typically via phishing email or malicious link. Security awareness training teaches employees to recognise and avoid these lures, directly interrupting delivery before exploitation occurs, which is the phase the stem asks about.

Protocol Tunneling describes using legitimate tunnels to hide traffic.

Exfiltration is the culminating activity of Actions on Objectives, where attackers extract the data they have gathered. This phase satisfies the goal of achieving the intrusion's purpose, since stealing information directly fulfils the adversary's mission after prior stages established access and persistence.

Persistence consists of techniques that adversaries use to maintain their foothold in a network, such as creating scheduled tasks, services, or registry run keys. In this scenario, the attacker used a scheduled task to maintain access, which is a classic Persistence technique (T1053.005 Scheduled Task/Job: Scheduled Task). This tactic ensures the adversary can re-establish access even after a reboot or credential change, making it a correct classification.

Periodic heartbeat pings to an external domain are beaconing, the hallmark of the Command and Control tactic. Implanted malware checks in at regular intervals to receive instructions, which the MITRE ATT&CK framework classifies under Command and Control rather than Exfiltration or Persistence.

In the Diamond Model, Infrastructure represents the physical and logical resources an adversary uses, such as domain names, IP addresses, and email servers. The look-alike domains registered to impersonate partners are clearly adversary-controlled resources used to deliver phishing emails and potentially host command-and-control, making Infrastructure the correct classification for this observable.

Timeliness ensures the indicator still describes an active or recent threat, so defenders can act before the adversary changes infrastructure. An IOC shared weeks after the campaign ended has little operational value, making freshness a core quality criterion for threat intelligence sharing.

Infrastructure encompasses the physical and logical resources used by the adversary, such as servers, domains, and IP addresses. The malicious website is a logical resource used to deliver the exploit and payload, making it part of the Infrastructure axis. This axis helps analysts track and attribute adversary infrastructure.