Cyber Threats And Attack Frameworks

Which of the following is considered an 'Indicator of Attack' (IOA) rather than an IOC?

Which TWO of the following actions are considered 'Defense Evasion' techniques?

An adversary uses a custom script to modify 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. Which MITRE ATT&CK technique is this?

Which TWO items are part of the 'Adversary' vertex in the Diamond Model?

Which THREE phases of the Cyber Kill Chain focus on the attacker's activities before reaching the target environment?

You are analyzing an APT threat group that consistently uses 'living-off-the-land' techniques. How should you approach identifying their presence using the MITRE ATT&CK framework?

You are assessing a company's incident response capability against the Cyber Kill Chain. If an attacker has successfully completed the 'Installation' phase, which defensive control should you have triggered?

You are mapping an adversary behavior to the MITRE ATT&CK framework. The attacker uses PowerShell to execute a Base64 encoded payload that downloads a secondary script. Under which Tactic should this specific execution behavior be primarily classified?

Which TWO of the following are considered 'Indicator of Compromise' (IOC) types?

When evaluating an adversary's TTPs, you notice they use 'Process Hollowing'. Which ATT&CK Tactic does this technique primarily support?

A security analyst is using the Diamond Model to document an incident. The analyst notes that the adversary used a specific Command and Control (C2) server IP address. In the context of the Diamond Model, where does this IP address belong?

You are performing threat hunting based on the Diamond Model. You identified a new Infrastructure node (IP). What is the logical next step in the Diamond Model analysis?

Which THREE of the following are primary components (vertices) of the Diamond Model of Intrusion Analysis?

During an investigation, you observe an attacker utilizing a custom-compiled Trojan that bypasses EDR detection. According to the Cyber Kill Chain, at which phase is this specific action of developing the custom tool occurring?

Which THREE MITRE ATT&CK tactics are commonly involved in an adversary's effort to maintain a presence on a compromised system?

An adversary is performing internal reconnaissance using 'net view' commands. In the MITRE ATT&CK framework, which technique ID maps to this behavior?

You are identifying Indicators of Compromise (IOCs) for an ongoing APT campaign. Which of the following is considered a Host-based IOC?

Which of the following best describes an Advanced Persistent Threat (APT)?

When applying the Cyber Kill Chain to an organization, which THREE phases are most effectively defended by network-level security controls?

Which phase of the Cyber Kill Chain is primarily mitigated by effective security awareness training for employees?

You observe an adversary using a legitimate VPN tunnel to communicate with their C2 server. Under the MITRE ATT&CK framework, which technique is this?

What is the primary purpose of the 'Actions on Objectives' phase in the Cyber Kill Chain?

An analyst is examining logs and finds a pattern of periodic heartbeat pings to an unknown external domain. Which MITRE ATT&CK tactic does this activity suggest?

Which THREE criteria are essential when evaluating the quality of an IOC for threat intelligence sharing?