Cyber Threats And Attack Frameworks practice questions

The organizational structure of the security team

Why it fails: This is outside the scope of threat modeling.

The victim's hardware specifications

Why it fails: The Diamond Model tracks the attacker's resources, not the victim's hardware.

The budget of the threat actor

Why it fails: The Diamond Model does not track actor funding.

Exploitation

Why it fails: Exploitation is the phase where the adversary takes advantage of a vulnerability to execute code on the target system. Credential dumping is not about exploiting a vulnerability but rather extracting credentials from memory or files after initial access. It represents a later stage of the intrusion where the adversary is deepening their foothold.

Weaponization

Why it fails: Weaponization involves creating the malicious payload, such as coupling an exploit with a backdoor, before delivery. Credential dumping occurs after the adversary has already gained access and is attempting to escalate privileges or move laterally. This phase is too early in the kill chain and does not align with the post-compromise activity described.

Installation

Why it fails: Installation refers to the adversary installing malware or a backdoor on the victim's system to maintain persistence. Credential dumping is not typically an installation activity; it is a post-exploitation action aimed at obtaining credentials for privilege escalation and lateral movement. It occurs after the adversary has already established a presence.

Persistence

Why it fails: Persistence consists of techniques to maintain foothold, like creating accounts or scheduled tasks. While an RMM tool could be used for persistence, the scenario describes the attacker leveraging an already-present tool for command execution and lateral movement, not establishing long-term access. The core behavior here is evading detection by using a trusted, signed application, which is a Defense Evasion concern.

Lateral Movement

Why it fails: Lateral Movement covers techniques used to move through a network, such as remote services or internal spearphishing. Although the attacker did move laterally, the specific action of using a signed RMM tool already in the environment is a defense evasion technique because it avoids triggering security controls. The primary tactic supported is therefore Defense Evasion, with lateral movement being a secondary effect.

Execution

Why it fails: Execution covers techniques that run adversary-controlled code, such as command interpreters or scheduled tasks. Here the attacker did not introduce new code but abused an existing trusted tool for stealthy command-and-control and lateral movement, so the primary tactic is not Execution. The signed RMM tool was already installed and functioning, making its unauthorized use better classified under a stealth-oriented tactic.

Adversary

Why it fails: The Adversary feature represents the actor or organization conducting the intrusion, including their motivations and capabilities. In this scenario, the spear-phishing email is the method used by the adversary, not the adversary itself. The email is a capability or infrastructure element, so it does not map to the Adversary vertex of the Diamond Model. The analyst would document the threat actor separately.

Victim

Why it fails: The Victim feature represents the target of the intrusion, such as an organization, individual, or asset. The spear-phishing email is not the victim; it is the tool used against the victim. The analyst would document the recipient or their system under Victim, while the email itself falls under Capability. Therefore, this option does not correctly identify the feature.

Infrastructure

Why it fails: Infrastructure refers to the physical or logical systems used to deliver the attack, such as command-and-control servers, domains, or email servers. While the spear-phishing email is delivered via infrastructure (e.g., an SMTP server), the email itself with its malicious attachment is the capability. The infrastructure would be the sending mail server or the domain used in the phishing campaign, not the email content.

Exploitation

Why it fails: Exploitation is the phase where the delivered payload triggers a vulnerability to execute code on the target. It tempts because the Trojan does eventually run. Crafting and compiling the custom tool to bypass EDR happens earlier, during Weaponisation, before any delivery or execution occurs.

Delivery

Why it fails: Delivery covers transmitting the weaponised payload to the victim, such as phishing email or USB drop. The option tempts because the Trojan eventually reaches the target. Developing a custom-compiled tool to evade EDR belongs to Weaponisation, where the adversary builds the deliverable.

Installation

Why it fails: Installation covers establishing persistence on the compromised host, such as creating services or scheduled tasks. It tempts because Trojans often install themselves. Compiling a bespoke tool to evade EDR is Weaponisation, which precedes delivery, exploitation and installation in the Cyber Kill Chain.

User-Agent string in HTTP header

Why it fails: A User-Agent string is a network-based artefact observed in HTTP traffic, not evidence resident on an endpoint. Host-based IOCs are file hashes, registry keys, processes or scheduled tasks. It is tempting because User-Agent values can fingerprint attacker tooling, making them useful network IOCs during C2 analysis.

Domain name for C2 beaconing

Why it fails: A C2 domain name is a network-based IOC seen in DNS and proxy logs, not host-resident evidence. Host-based IOCs include file hashes, registry keys and running processes. It is tempting because C2 domains are high-value APT indicators, and would be correct when the question asks for network-based IOCs instead.

Source IP address in firewall logs

Why it fails: Firewall logs record network-layer traffic, so a source IP address is a network-based IOC, not a host artefact. It is tempting because IPs are easy to collect and block, and would be the right choice when hunting infrastructure-level indicators such as command-and-control servers or scanning sources.

Reconnaissance of the target

Why it fails: Reconnaissance is the first Kill Chain phase, harvesting target information before any intrusion; Actions on Objectives instead occurs last, when the attacker fulfils the mission. It is tempting because understanding the target underpins success, but reconnaissance precedes weaponisation rather than concluding the campaign.

Establishing a backdoor

Why it fails: A backdoor is installed during Installation, which establishes persistent remote access; Actions on Objectives instead covers the attacker achieving their actual goal, such as exfiltration or destruction. It is tempting because persistence feels like the endgame, yet it merely enables later objective fulfilment.

Sending phishing emails

Why it fails: Phishing emails belong to the Delivery phase, which transports the weapon to the victim; Actions on Objectives instead executes the attacker's intended outcome, such as data exfiltration or encryption. It is tempting because delivery often triggers the compromise, but phishing is the vector, not the goal.

Capability

Why it fails: An IP address identifies the infrastructure the adversary operates, so it belongs to the Infrastructure axis, not Capability. Capability covers the tools, malware or exploits the adversary wields. The analyst is tempted because a C2 server delivers malicious functionality, but the server itself is a host, not the weapon it serves.

Adversary

Why it fails: The Adversary vertex holds the actor — the operator, organisation or persona — not the infrastructure they use. Placing the C2 IP here is tempting because the server belongs to and is controlled by the adversary, but the Diamond Model assigns IP addresses, domains and servers to the Infrastructure vertex.

Victim

Why it fails: The Victim vertex describes the target organisation, asset or person affected by the intrusion, not attacker-controlled infrastructure. Assigning the C2 IP here is tempting because the victim's hosts connect outbound to that server, but the Diamond Model records the compromised target itself, leaving the IP to Infrastructure.

Scan for known malware signatures

Why it fails: Signature scanning matches known malicious code, but living-off-the-land activity uses native, unmodified operating system utilities that carry no malicious signature. Signature scanning is tempting because it is fast and effective against documented malware families, and would be correct if the adversary deployed custom or known implants rather than existing system tools.

Update firewall rules for all known ports

Why it fails: Firewall port rules filter network traffic by port and protocol; living-off-the-land techniques execute locally through legitimate binaries and typically reuse already-permitted channels. Port rule updates are tempting because they harden network exposure, and would be correct if the threat relied on unusual listening ports or unauthorised outbound services.

Focus on file hash blacklisting

Why it fails: Living-off-the-land intrusions abuse signed, legitimate system binaries, so file hashes match benign tooling and generate no useful detection. Hash blacklisting is tempting because it reliably catches known malware samples, and would be correct against commodity threats using unmodified, previously catalogued binaries rather than an adaptive APT.

Lateral Movement

Why it fails: Process Hollowing injects code into a suspended legitimate process to evade defences, supporting the Defense Evasion tactic, not Lateral Movement. Lateral Movement covers techniques such as remote service exploitation or pass-the-hash; Process Hollowing is tempting because hollowed processes can later be used to move, but the technique itself evades detection.

Credential Access

Why it fails: Process hollowing injects code into a suspended legitimate process to evade defences, not to harvest credentials; credential access covers dumping LSASS memory or keylogging. It is tempting because hollowed processes can host credential stealers, and it would be correct when the observed behaviour is extracting secrets from memory or authentication stores.

Persistence

Why it fails: Process hollowing provides stealthy execution within an existing process, but it does not survive reboots; persistence requires registry Run keys, scheduled tasks or services. It is tempting because masquerading as a legitimate process looks durable, and it would be correct when the technique re-establishes access after restart or logoff.

T1071

Why it fails: T1071 covers application layer protocol use for command and control, such as HTTP or DNS, not local share enumeration. It tempts because both involve network traffic, but 'net view' queries Windows network resources, mapping to T1135 Network Share Discovery.

T1059

Why it fails: T1059 covers Command and Scripting Interpreter execution, not discovery activity. It is tempting because 'net view' runs through a command interpreter, but the behaviour is network share and system enumeration, which maps to T1018 Remote System Discovery or T1135 Network Share Discovery.

T1027

Why it fails: T1027 is obfuscation of files or information to hinder analysis, not host enumeration. It tempts because reconnaissance can involve encoded output, but 'net view' runs plainly to list shares, mapping to T1135 Network Share Discovery.

Discovery

Why it fails: Discovery covers adversary reconnaissance of systems and networks, such as account or share enumeration, not payload execution. It is tempting because PowerShell can gather host information, but this behaviour is running a Base64-encoded downloader, which maps to Execution, not Discovery.

Persistence

Why it fails: PowerShell execution maps to the Execution tactic, not Persistence, which covers maintaining foothold via mechanisms such as registry Run keys or scheduled tasks. Persistence is tempting because encoded PowerShell often appears in later-stage malware, but the behaviour described is the initial execution itself.

Command and Control

Why it fails: Command and Control covers an adversary communicating with compromised systems, typically after a payload is already running. It is tempting because the script downloads a secondary payload, but the tactic here is the act of executing PowerShell itself, which maps to Execution rather than the later C2 channel.

DNS sinkholing

Why it fails: DNS sinkholing blocks resolution of known command-and-control domains, which disrupts the Command and Control phase after installation. It would be correct for severing beaconing, but it does not detect or remove the installed implant itself, which requires endpoint detection and response.

Email gateway filtering

Why it fails: Email gateway filtering blocks malicious attachments and links during Delivery, so it cannot act once Installation has completed and the implant resides on the host. It is tempting because it is a genuine kill-chain control, but its correct position is earlier, at Delivery or Exploitation, not after code execution on the endpoint.

Social engineering training

Why it fails: Social engineering training counters the Delivery and Exploitation phases by stopping users opening malicious content. Once Installation has occurred, malware is already resident, so training cannot detect or remove it; the appropriate control is endpoint detection and response or antivirus quarantine.

Weaponization

Why it fails: Weaponization occurs on the attacker's infrastructure, pairing exploits with payloads before delivery; employees have no visibility or control there, so training cannot mitigate it. Awareness training targets Delivery, teaching users to recognise phishing lures and malicious attachments. Weaponization would be the right focus for threat-intelligence or vulnerability-management controls instead.

Installation

Why it fails: Installation establishes persistence on the host through malware, scheduled tasks or registry changes, which is a technical control matter, not user judgement. It tempts because training can reduce the initial execution that precedes installation, and would be correct if the question asked which phase training indirectly hinders by preventing malicious downloads.

Actions on Objectives

Why it fails: Actions on Objectives covers the attacker's final goals — exfiltration, encryption, lateral movement — executed through tooling and privileges that awareness training cannot revoke. It tempts because trained staff may notice unusual activity late, and would be correct if the question concerned detection and response controls rather than human behaviour.

T1204: User Execution

Why it fails: This relates to user-driven malicious actions.

T1133: External Remote Services

Why it fails: This relates to abusing remote access services like VPNs.

T1053: Scheduled Task

Why it fails: This relates to persistence via scheduling.

Automated script kiddies

Why it fails: Script kiddies run existing tools opportunistically without the funding, patience or tailored objectives of an APT, so they cannot sustain covert access over months. The lure is that both involve intrusion tooling; automated scripts would be the right answer if the question asked about low-skill, indiscriminate attacks.

Uncoordinated network scanning

Why it fails: Uncoordinated scanning is random, noisy and short-lived, lacking the sustained human direction, custom tooling and long-term persistence that define an APT. It is tempting because scanning is a genuine reconnaissance technique, and it would fit a question asking about opportunistic probing rather than a state-sponsored intrusion campaign.

Short-term ransomware campaigns

Why it fails: Short-term ransomware campaigns are opportunistic and typically conclude within days, whereas an APT sustains covert access over months or years pursuing strategic objectives. It tempts because ransomware can be deployed by APT groups, but duration and persistence, not payload type, define an APT.

Exfiltration

Why it fails: Exfiltration requires actual data transfer out of the network, whereas heartbeat pings are small, regular check-ins maintaining a command-and-control channel. Exfiltration is tempting because both involve outbound traffic to unknown external domains, but pings carry no stolen data, indicating Command and Control rather than Exfiltration.

Privilege Escalation

Why it fails: Heartbeat pings are command-and-control beaconing, not privilege escalation, which requires exploiting vulnerabilities or misconfigurations to gain higher permissions. Privilege escalation is tempting because beaconing malware often escalates privileges after establishing a foothold, but the periodic outbound pings themselves demonstrate C2, not elevation.

Collection

Why it fails: Collection covers gathering data before exfiltration, such as keylogging or screen capture; periodic heartbeat pings only signal an active C2 channel. Collection is tempting because beaconing often precedes data gathering, but the pings themselves transmit no collected data, so they indicate Command and Control instead.

A known malicious file hash

Why it fails: A file hash is a static artefact left behind after an attack, matching known-bad signatures — the definition of an indicator of compromise. Indicators of attack describe live behavioural sequences such as process injection or credential dumping. Hashes suit retrospective scanning and threat-intelligence matching, not real-time behavioural detection.

A specific registry key for malware persistence

Why it fails: A registry key used for persistence is a static host artefact recorded after compromise, so it is an indicator of compromise. Indicators of attack capture intent and behaviour during an intrusion, such as lateral movement or privilege escalation. Registry keys are correct for forensic hunting and signature-based endpoint detection.

A blacklisted IP address

Why it fails: A blacklisted IP address is a static reputation artefact, so it is an indicator of compromise, not of attack. Indicators of attack describe behavioural patterns occurring while an adversary operates, such as beaconing or exploitation attempts. Blacklists suit perimeter blocking and retrospective log correlation rather than behavioural detection.

Update the firewall blacklist only

Why it fails: Blacklisting one IP addresses a single indicator without pivoting to identify the adversary, capability or victim linked to that infrastructure. Firewall blocking suits immediate containment of known malicious traffic, yet threat hunting requires expanding the Diamond Model to reveal further related infrastructure and activity.

Change all user passwords

Why it fails: This is a remediation step, not a threat hunting process.

Close the incident ticket

Why it fails: Closing the ticket halts analysis before the newly found infrastructure is pivoted into adversary, capability and victim vertices, discarding intelligence value. Ticket closure fits confirmed containment and remediation, whereas a fresh Diamond Model node demands expansion of the model to uncover related activity.

Server rack temperature

Why it fails: Server rack temperature is environmental telemetry, not an observable artefact of malicious activity, so it cannot indicate compromise. It is tempting because thermal anomalies can accompany cryptomining or failing hardware, and data-centre monitoring legitimately tracks it, but that is facilities management rather than IOC collection.

Employee behavior patterns

Why it fails: IOCs are technical, machine-observable artefacts; behaviour patterns are human and contextual, forming the separate discipline of user behaviour analytics. It is tempting because insider threat and anomaly detection genuinely use behaviour, but that is a detection methodology, not an indicator type recorded as an IOC.

Project management timeline

Why it fails: IOCs are forensic artefacts observable in hosts or network traffic, such as hashes, IP addresses, domains and registry keys. A project timeline is administrative scheduling data with no bearing on compromise. It is tempting because timelines do feature in investigations, but as case-management context, not as an indicator type.