Adversarial Tactics

Which tactic is associated with 'T1537 Transfer Data to Cloud Account'?

What is the primary goal of the 'Command and Control' (C2) tactic?

You suspect an adversary is performing 'T1005 Data from Local System'. Which of these actions is relevant?

You are assessing an attacker's use of 'T1203 Exploitation for Client Execution'. What does this imply?

Which TWO of the following are examples of 'Discovery' techniques?

You are investigating a breach where the attacker used 'T1555 Credentials from Password Stores'. Where would they look?

You are implementing threat hunting for 'T1562 Impair Defenses'. Which activity are you searching for?

Which TWO of the following are considered 'Defense Evasion' techniques?

You are reviewing a Purple Team exercise involving 'T1003 OS Credential Dumping'. What is the most reliable way to detect credential dumping via LSASS process access?

You see a process performing DNS queries for unusually long subdomains. Which tactic is the adversary likely exercising?

Which technique is most effective for an adversary to perform 'T1078 Valid Accounts'?

While analyzing an EDR alert, you observe a process modifying 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. What is the primary adversary objective at this stage?

What is the purpose of 'T1027 Obfuscated Files or Information'?

Which TWO of the following are considered 'Credential Access' techniques?

Which of these is a typical 'Lateral Movement' technique?

In the context of the MITRE ATT&CK framework, what distinguishes 'T1059 Command and Scripting Interpreter' from 'T1204 User Execution'?

Which THREE of the following are common 'Impact' techniques?

An adversary uses 'vssadmin.exe delete shadows /all /quiet' during an attack. Which tactic is this technique categorized under?

What is the primary function of a 'C2 Beacon'?

Which TWO of the following behaviors are typical of 'Lateral Movement'?

You are configuring Microsoft Defender for Endpoint. Which feature is most effective against 'T1566 Phishing'?

You are auditing an environment for 'T1083 File and Directory Discovery'. Which log source provides the most visibility into this activity?

You are configuring a YARA rule for CrowdStrike Falcon to detect Cobalt Strike Beacon traffic. Which specific technique should you look for in the process memory that indicates process hollowing?

You are reviewing logs in Splunk and identify a suspicious process spawning 'cmd.exe' from 'wsmprovhost.exe'. Which MITRE ATT&CK tactic does this behavior most directly align with?

Which THREE of the following are 'Command and Control' techniques?

An adversary is using a living-off-the-land (LotL) binary to execute commands. Why is this preferred over a custom malware?

What is the primary difference between a Red Team and a Blue Team in a security simulation?

Which THREE of the following are considered 'Collection' techniques?

During a simulation, you notice a process spawning child processes from 'wmic.exe'. What is this technique often used for?

Which of the following is considered an 'Execution' tactic in the MITRE ATT&CK framework?

Which action constitutes 'Discovery' as defined by the MITRE ATT&CK framework?

Which TWO of the following are examples of 'Initial Access' tactics?

An attacker uses 'T1133 External Remote Services' to gain access. What does this involve?

Which of these is a 'Defense Evasion' technique?

Which THREE of the following are considered 'Execution' techniques?

Which THREE of the following are 'Privilege Escalation' techniques?

Which THREE of the following are common 'Exfiltration' techniques?

Which TWO of the following are examples of 'Persistence' tactics?

You detect an adversary attempting to clear Windows Event Logs using 'wevtutil cl'. This falls under which tactic?