39 questions · Adversarial Tactics · All types, answers revealed
Which tactic is associated with 'T1537 Transfer Data to Cloud Account'?
Transferring data to a cloud account is a classic exfiltration step.
Why this answer
This is a form of Exfiltration.
What is the primary goal of the 'Command and Control' (C2) tactic?
C2 provides the means to control the system remotely.
Why this answer
C2 is about maintaining a communication channel between the compromised host and the attacker's infrastructure.
You suspect an adversary is performing 'T1005 Data from Local System'. Which of these actions is relevant?
Finding and collecting sensitive documents on the local disk is the technique.
Why this answer
Data from Local System involves searching for and copying files from a user's machine.
You are assessing an attacker's use of 'T1203 Exploitation for Client Execution'. What does this imply?
Exploiting software vulnerabilities is the core of this technique.
Why this answer
This technique involves exploiting a client-side application (like a browser or PDF reader) to execute code.
Which TWO of the following are examples of 'Discovery' techniques?
Identifying users is a discovery activity.
Why this answer
Enumerating network shares and identifying current user context are discovery actions.
You are investigating a breach where the attacker used 'T1555 Credentials from Password Stores'. Where would they look?
Browsers store saved passwords in these local files.
Why this answer
Password stores include browser data, local vaults, and credential managers.
You are implementing threat hunting for 'T1562 Impair Defenses'. Which activity are you searching for?
These are direct techniques to weaken defenses.
Why this answer
Impair Defenses involves disabling security software, such as antivirus or EDR agents, to remain undetected.
Which TWO of the following are considered 'Defense Evasion' techniques?
Masking files hides them from security tools.
Why this answer
Clearing logs and masquerading as a legitimate process are used to avoid detection.
You are reviewing a Purple Team exercise involving 'T1003 OS Credential Dumping'. What is the most reliable way to detect credential dumping via LSASS process access?
Dumping tools typically request a process handle with specific access masks.
Why this answer
LSASS.exe is the process that handles local security; monitoring it for non-system process access is a high-fidelity detection method.
You see a process performing DNS queries for unusually long subdomains. Which tactic is the adversary likely exercising?
This is a form of C2 communication.
Why this answer
DNS tunneling is a technique used to bypass network firewalls and communicate with C2 servers, falling under Command and Control.
Which technique is most effective for an adversary to perform 'T1078 Valid Accounts'?
Legitimate credentials obtained via phishing allow access as a valid user.
Why this answer
Adversaries often use stolen credentials or social engineering to obtain legitimate user credentials to access systems as authorized users.
While analyzing an EDR alert, you observe a process modifying 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. What is the primary adversary objective at this stage?
Registry modifications for startup ensure the malware survives a reboot.
Why this answer
Modifying registry run keys is a standard technique to ensure a program executes automatically upon system startup, which defines Persistence.
What is the purpose of 'T1027 Obfuscated Files or Information'?
Hiding the true intent or code structure helps bypass static signatures.
Why this answer
Obfuscation is used to hide code or scripts from static analysis and security tools, aiding Defense Evasion.
Which TWO of the following are considered 'Credential Access' techniques?
Brute force seeks to gain credentials.
Why this answer
Brute forcing passwords and dumping memory (LSASS) are standard credential access methods.
Which of these is a typical 'Lateral Movement' technique?
RDP is a primary tool for moving between systems in a network.
Why this answer
Remote Desktop Protocol (RDP) is a standard tool used by adversaries to move laterally between machines.
In the context of the MITRE ATT&CK framework, what distinguishes 'T1059 Command and Scripting Interpreter' from 'T1204 User Execution'?
T1059 is about the interpreter, T1204 requires user interaction to launch.
Why this answer
T1059 focuses on the interpretation of code (PowerShell, Bash), while T1204 focuses on the user-driven triggering of the malicious file.
Which THREE of the following are common 'Impact' techniques?
A form of impact.
Why this answer
Data destruction, ransomware encryption, and service disruption are all forms of impact.
An adversary uses 'vssadmin.exe delete shadows /all /quiet' during an attack. Which tactic is this technique categorized under?
This action destroys data, fulfilling the goal of service disruption.
Why this answer
Deleting shadow copies is a specific technique used to hinder forensic analysis and recovery, categorized under Impact.
What is the primary function of a 'C2 Beacon'?
Checking for instructions is the definition of a beacon.
Why this answer
Beacons are small packets sent periodically from the infected host to the attacker's server to check for instructions.
Which TWO of the following behaviors are typical of 'Lateral Movement'?
SMB is a primary protocol for lateral movement.
Why this answer
Remote services like RDP and SMB/Admin shares are primary mechanisms for moving laterally.
You are configuring Microsoft Defender for Endpoint. Which feature is most effective against 'T1566 Phishing'?
These block the delivery of phishing emails before they reach the user.
Why this answer
Defender for Office 365 / MDE integration provides specialized filtering for malicious attachments and URLs linked to phishing.
You are auditing an environment for 'T1083 File and Directory Discovery'. Which log source provides the most visibility into this activity?
Event ID 11 tracks FileCreate events, often associated with enumeration.
Why this answer
File and Directory Discovery often involves listing files, which generates audit events when monitoring directory access via Sysmon Event ID 11 or Windows Security logs.
You are configuring a YARA rule for CrowdStrike Falcon to detect Cobalt Strike Beacon traffic. Which specific technique should you look for in the process memory that indicates process hollowing?
Writing to the memory space of a suspended process is required for hollowing.
Why this answer
Process hollowing involves creating a legitimate process in a suspended state and replacing its memory with malicious code, a hallmark of execution techniques.
You are reviewing logs in Splunk and identify a suspicious process spawning 'cmd.exe' from 'wsmprovhost.exe'. Which MITRE ATT&CK tactic does this behavior most directly align with?
Using WinRM/PowerShell Remoting to execute commands is a primary technique for Lateral Movement.
Why this answer
The spawning of a command shell from a remote management process is a classic indicator of Lateral Movement using remote execution.
Which THREE of the following are 'Command and Control' techniques?
A common C2 channel.
Why this answer
Web service protocols, non-standard port traffic, and standard application layer protocols are all C2 channels.
An adversary is using a living-off-the-land (LotL) binary to execute commands. Why is this preferred over a custom malware?
Using system tools helps blend in with administrative behavior.
Why this answer
LotL binaries are legitimate system tools, making them harder to flag as malicious by signature-based defenses.
What is the primary difference between a Red Team and a Blue Team in a security simulation?
This describes the core function of adversarial simulation.
Why this answer
The Red Team performs the offensive actions to emulate threats, while the Blue Team defends and monitors.
Which THREE of the following are considered 'Collection' techniques?
A collection technique.
Why this answer
Screen capture, audio capture, and file collection are all ways to steal data.
During a simulation, you notice a process spawning child processes from 'wmic.exe'. What is this technique often used for?
WMIC allows the execution of commands on local or remote systems.
Why this answer
WMIC is often used for remote execution and discovery in Windows environments.
Which of the following is considered an 'Execution' tactic in the MITRE ATT&CK framework?
PowerShell is a primary tool for command execution.
Why this answer
Execution involves running malicious code on a system.
Which action constitutes 'Discovery' as defined by the MITRE ATT&CK framework?
Commands to identify user context or network shares are Discovery.
Why this answer
Discovery involves gathering information about the system and network to plan subsequent steps.
Which TWO of the following are examples of 'Initial Access' tactics?
A primary initial access vector.
Why this answer
Phishing and exploiting public-facing applications are two common ways to gain the first foothold in an environment.
An attacker uses 'T1133 External Remote Services' to gain access. What does this involve?
This is the classic technique for T1133.
Why this answer
T1133 involves exploiting VPNs, Citrix, or other external-facing access points to enter a network.
Which of these is a 'Defense Evasion' technique?
Making malware look like a standard Windows process evades observation.
Why this answer
Using masquerading (renaming files to look like system files) is a common way to hide malicious processes.
Which THREE of the following are considered 'Execution' techniques?
Triggering by a user is an execution method.
Why this answer
Command scripting, binary execution, and scheduled task execution are all ways to start code.
Which THREE of the following are 'Privilege Escalation' techniques?
The core technique.
Why this answer
Exploiting system software, abusing user accounts, and using local security exploits are common escalation vectors.
Which THREE of the following are common 'Exfiltration' techniques?
A common exfiltration technique.
Why this answer
Using cloud storage, scheduled transfers, and network protocols are common ways to move data out.
Which TWO of the following are examples of 'Persistence' tactics?
A common persistence technique.
Why this answer
Creating scheduled tasks and adding items to the Startup folder are standard ways to ensure malware survives reboot.
You detect an adversary attempting to clear Windows Event Logs using 'wevtutil cl'. This falls under which tactic?
Removing logs is a classic technique to hide tracks.
Why this answer
Clearing logs is an explicit attempt to remove traces of activity to evade detection.
Ready to test yourself?
Try a timed practice session using only Adversarial Tactics questions.