CCNA Adversarial Tactics Questions

Using WMI to create a process on a remote host with compromised credentials is a classic Lateral Movement technique (T1047). It allows the adversary to move from one system to another and execute code remotely. The use of valid domain credentials and remote process creation directly aligns with the goal of expanding access within the network.

T1537 describes adversaries copying data from a victim environment into adversary-controlled cloud storage, so it maps to the Exfiltration tactic. The cloud account is merely the destination, not a separate technique, making exfiltration the correct categorisation.

Command and Control establishes an ongoing channel between the compromised host and attacker infrastructure, letting the adversary issue instructions and receive output. This sustained management distinguishes C2 from initial exploitation or lateral movement, satisfying the tactic's goal of remote direction of the victim.

Adversaries performing T1005 search local directories for document extensions such as .docx or .xlsx to locate and stage valuable data before exfiltration. This action directly matches the technique's focus on collecting files from the compromised host's local file system.

The 'reg save' commands are used to extract the SAM and SYSTEM registry hives, which contain password hashes. This is a classic Credential Access technique (T1003 OS Credential Dumping). By saving these hives, the attacker can later extract credentials offline, gaining access to accounts. The subsequent exfiltration of these files further confirms the intent to steal credentials.

T1203 describes adversaries exploiting vulnerabilities in client applications, such as browsers, office suites or document readers, to execute code on a victim's system. The technique's defining axis is abuse of a software flaw rather than user action, so it implies the attacker targeted an application vulnerability.

Stopping the Windows Defender service disables a key security control and is categorized under Defense Evasion as Impair Defenses. By turning off antivirus protection, the adversary prevents the tool from detecting or blocking subsequent malicious activity. This directly weakens the host's defenses, fitting the tactic precisely.

Creating a new Windows service to run a malicious executable at startup is a classic Persistence technique. T1543.003 specifically covers the creation or modification of Windows services. The service ensures the malicious code runs automatically, maintaining access. This directly matches the scenario.

System owner/user discovery counts as a Discovery technique because it identifies who owns or uses an asset, satisfying the inventory-building constraint before assessment begins. Discovery establishes what exists and who is responsible for it, distinct from later phases such as vulnerability scanning or configuration hardening.

T1555 targets credentials stored in password managers and applications. Chromium-based browsers persist saved usernames and passwords in a SQLite 'Login Data' database, encrypted with the local profile key, making that file the primary artefact attackers harvest under this technique.

Remote access software covers the use of legitimate remote monitoring and management tools to maintain access. Because the RMM tool is signed and already present for administrative purposes, the attacker can blend in with normal IT activity. This technique specifically addresses adversaries leveraging these tools for command and control and persistence, which matches the scenario exactly.

Disabling Windows Defender or altering firewall rules directly implements T1562 Impair Defenses, which covers adversary actions that weaken or disable security controls to evade detection. This satisfies the scenario's requirement to hunt for defence-impairment activity, since both actions remove protective telemetry and filtering rather than merely executing or persisting.

Dumping credentials from memory, such as using Mimikatz to extract plaintext passwords or hashes from LSASS, is a classic Credential Access technique (T1003 OS Credential Dumping). The goal is to obtain credentials for lateral movement or privilege escalation. This directly aligns with the Credential Access tactic.

LSASS credential dumping requires a process to open a handle to lsass.exe with read access. Monitoring handle-access events, such as Sysmon Event ID 10, detects this behaviour regardless of the dumping tool, unlike signature-based or file-creation detection.

Long, high-entropy subdomains encode data in DNS queries, a hallmark of DNS tunnelling used to smuggle commands and exfiltrated data past perimeter controls. This covert channel provides the command-and-control channel an adversary needs to direct compromised hosts.

Lateral Movement consists of techniques used to enter and control remote systems on a network. Mapping an administrative share on a remote server with credentials for a service account, then scheduling a task on that remote host, is a textbook lateral movement sequence. The 'net use' establishes the authenticated remote connection that enables subsequent remote execution.

Stolen credentials from phishing directly satisfy T1078's requirement for legitimate, valid account access, bypassing exploitation and malware entirely. Because the account already exists and is authorised, the adversary authenticates normally against Microsoft Entra ID, evading perimeter defences and blending with genuine user activity.

The Run key under HKLM\Software\Microsoft\Windows\CurrentVersion\Run causes a program to execute automatically at user logon, establishing persistence so the adversary survives reboots. Modification of this key is a classic autostart technique, not credential access, exfiltration or lateral movement.

T1027 covers techniques such as packing, encoding and encryption that alter files or information so their true content is hidden. This defeats signature-based detection, because antivirus and similar tools match known byte patterns that obfuscation changes, allowing the adversary to evade identification.

Brute force systematically guesses credentials to gain account access, mapping to MITRE ATT&CK Credential Access (T1110). It directly targets authentication secrets, satisfying the stem's requirement for a technique whose objective is obtaining credentials rather than execution or persistence.

Lateral movement involves pivoting from a compromised host to other systems. Remote Desktop Protocol lets an attacker authenticate to additional machines using harvested credentials, making RDP a common technique for moving deeper into a network.

Encrypting data for impact satisfies the availability constraint by rendering files unusable without the decryption key, rather than exposing them. Unlike exfiltration or ransomware encryption for extortion, this technique destroys access outright, aligning with the Impact tactic's objective of disrupting business operations.

Deleting volume shadow copies destroys the victim's ability to recover encrypted or damaged data, which is the destructive outcome Impact tactics aim to achieve. Ransomware operators run vssadmin this way to prevent restoration, so the technique sits under Impact rather than Defence Evasion or Execution.

A C2 beacon periodically contacts its command-and-control server to request instructions, allowing the implant to receive new tasks without maintaining a constant connection. This polling mechanism satisfies the question's focus on the beacon's primary function within attacker infrastructure.

Lateral movement commonly abuses SMB and administrative shares to reach remote hosts using harvested credentials, moving within the environment rather than breaching the perimeter. This satisfies the stem's request for a typical lateral movement behaviour.

Creating a scheduled task that runs at startup is a direct persistence mechanism because it ensures the adversary's code executes automatically after reboots or logons. Scheduled tasks are a recognized autostart location, so this behavior aligns with the Persistence tactic rather than one-time execution or defense evasion alone.

Email filtering policies inspect inbound messages and attachments, blocking or quarantining malicious senders, links and payloads before delivery. This directly counters T1566 Phishing, which relies on email as the initial access vector, satisfying the requirement to prevent phishing reaching users.

Event ID 11 tracks FileCreate events, often associated with enumeration.

Rundll32 loading a DLL from a user-writable path such as the Public folder is the hallmark of signed binary proxy execution, where a trusted Microsoft binary is abused to run attacker code and evade application whitelisting and process-based detections. The unusual file extension and non-system directory reinforce that this is masquerading as legitimate execution rather than a benign DLL load.

Credential Access consists of techniques for stealing credentials such as account names and passwords. The SAM hive contains local account password hashes, and the SYSTEM hive holds the boot key needed to decrypt them. Saving these hives for offline extraction is a direct credential theft technique, making Credential Access the correct tactic.

Using the 'at' command to schedule a recurring job is a Persistence technique (T1053.002 At). It ensures the reverse shell runs regularly, maintaining the attacker's access even if the initial foothold is lost. This is a direct attempt to establish persistence on the Linux host, allowing the attacker to survive reboots and maintain long-term access.

Creating a scheduled task configured to run with highest privileges is a Privilege Escalation technique (T1053.005 Scheduled Task/Job: Scheduled Task). Adversaries can use this to execute code as SYSTEM or an administrator, thereby escalating privileges. This is distinct from persistence, as the immediate goal is to gain higher privileges, though it can also serve as persistence.

Spawning PowerShell from Outlook is a classic example of the Execution tactic, specifically T1204 User Execution or T1059 Command and Scripting Interpreter. The adversary leverages a trusted application to run malicious code, achieving code execution on the host. This aligns with the scenario where the initial execution vector is the user opening the attachment, leading to PowerShell execution.

Lateral Movement fits because wsmprovhost.exe hosts PowerShell remoting sessions, and spawning cmd.exe from it indicates an attacker executing commands on a remote host via WinRM. This satisfies the stem's constraint: the parent process evidences remote execution rather than local privilege escalation or persistence.

Compressing files and uploading them to an external address during off-hours is data theft leaving the environment. Exfiltration covers techniques that transfer data out of the victim network, and the repeated archive uploads to an external IP match that objective, making this the most direct tactic represented by the observed activity.

Persistence consists of techniques an adversary uses to keep access across restarts, credential changes, or other interruptions. Creating a scheduled task that mimics a legitimate updater and runs a payload every 15 minutes is a classic persistence mechanism, ensuring the callback survives reboots and user logoffs without requiring re-exploitation.

PsExec operates by copying a binary to the remote host and registering a temporary Windows service that runs it with SYSTEM privileges. That service-based execution is exactly what the System Services: Service Execution sub-technique describes. The remote service creation, execution, and subsequent deletion are the signature behaviours, distinguishing this technique from simple file transfer over admin shares or scheduled task abuse.

Using a legitimate RMM tool that is already trusted, deleting its logs, and renaming the executable to masquerade as a system process are actions designed to avoid detection. These behaviors obscure the adversary's activity and blend with normal operations, which is the core objective of the Defense Evasion tactic.

The relayed NTLM authentication to multiple servers, using a machine account to gain access on other hosts, indicates the adversary is moving from one system to another. NTLM relay is commonly used for lateral movement because it leverages captured authentication to reach additional targets, so Lateral Movement is the tactic directly supported by this evidence.

Attackers blend C2 traffic into standard application layer protocols such as HTTP, HTTPS or DNS, so it appears as legitimate web traffic. This satisfies the Command and Control criterion by evading network detection that trusts common protocols.

LotL binaries are signed, trusted system tools already present on the host, so their execution blends into legitimate administrative activity. This satisfies the stem's constraint of avoiding custom malware, which would introduce new files, hashes and behaviours that endpoint detection readily flags.

The use of DNS queries with long, hexadecimal subdomains is a hallmark of DNS tunneling for command and control. Adversaries encode commands and responses in DNS queries and responses to communicate with compromised hosts, often bypassing network restrictions. This falls under the Command and Control tactic, specifically T1071.004 Application Layer Protocol: DNS. The frequent, varying queries indicate an active C2 channel.

Red teams emulate attacker tactics, techniques and procedures to expose weaknesses, while blue teams defend, detect and respond to those simulated intrusions. This adversarial-versus-defensive split is the defining axis separating the two roles in a security simulation.

Screen capture grabs an image of the current desktop or application window, gathering information for later exfiltration. It satisfies the Collection tactic because the adversary is amassing data prior to staging and removal from the environment.

Timestomping modifies file metadata so that a malicious file appears consistent with legitimate files, which is a Defense Evasion technique. Analysts relying on creation time to spot recently dropped binaries can be misled. The technique targets the file system's timestamp attributes, and it is often combined with placing the file in a system directory to further blend in with expected content.

Modifying a service's ImagePath to point to a malicious executable and setting it to auto-start is a classic persistence technique. It ensures the malicious code runs on system boot, maintaining access. This falls under the Persistence tactic, specifically T1543.003 Create or Modify System Process: Windows Service. The adversary leverages the existing service infrastructure to survive reboots.

High-volume DNS queries with encoded subdomains and frequent NXDOMAIN responses are characteristic of DNS tunnelling or DNS beaconing used for command and control. The adversary encodes data or instructions in the query name to exfiltrate or receive tasking through a channel that often bypasses egress filtering. The signed Office add-in acting as the querying process is consistent with a compromised trusted application being used to reach the C2 infrastructure.

PowerShell scripts fall under Execution because they run adversary-controlled code on a target system, one of the techniques mapped to that tactic. Execution covers the actual running of malicious code, distinct from Initial Access or Persistence techniques.

Modifying the Run key is a classic Persistence technique (T1547.001 Registry Run Keys / Startup Folder). It ensures the malicious executable runs automatically when the user logs in, maintaining access across reboots. This is a direct attempt to establish persistence on the host, allowing the attacker to survive system restarts and maintain a foothold.

Discovery covers techniques that enumerate systems, accounts, shares and network resources to build situational awareness. Running whoami identifies the current user context, while net view lists reachable hosts and shares, both mapping directly to ATT&CK's Discovery tactic.

Execution encompasses techniques that result in adversary-controlled code running on a system. Invoking rundll32.exe to call an exported function from a malicious DLL is a direct method of running that code. The tactic describes the act of getting the payload to run, which is exactly what the observed command accomplishes.

Phishing qualifies as an Initial Access tactic because it gains an attacker their first foothold in a target environment, typically by harvesting credentials or delivering malware. It satisfies the scenario's requirement by directly enabling entry, unlike later-stage tactics such as persistence or privilege escalation, which presuppose existing access.

Exploiting an exposed VPN gateway directly matches T1133, which covers adversary use of external-facing remote services such as VPNs, RDP and Citrix to gain initial access. The exposed gateway satisfies the technique's requirement for a publicly reachable service, letting the attacker authenticate or exploit it rather than relying on user execution.

'net user /domain' enumerates domain user accounts, which is a Discovery technique (T1087 Account Discovery). It helps the adversary understand the user landscape for targeting. This is a classic example of Discovery because it gathers information about accounts and permissions within the domain, aiding in further attacks.

Using net.exe and nltest.exe to enumerate domain groups and trusts is internal reconnaissance to understand the environment. This aligns with TA0007 Discovery, which includes techniques like Domain Trust Discovery (T1482) and Permission Groups Discovery (T1069). The goal is gathering information to plan further actions, not directly executing payloads or moving laterally.

Masquerading as a system process names a legitimate-looking executable, such as svchost.exe, so defenders and users overlook malicious activity. It is catalogued under Defense Evasion because it conceals the adversary's true identity rather than exploiting a vulnerability.

The outbound SMB connections from a non-standard process like rundll32.exe loading a DLL from a user-writable location strongly indicate the adversary is moving laterally across the network. SMB is a common protocol for lateral movement via administrative shares or remote service execution. The tactic of Lateral Movement encompasses techniques that adversaries use to enter and control remote systems.

Modifying an existing scheduled task to execute a malicious script ensures the adversary's code runs automatically on a recurring basis, even after reboots or credential changes. This is a classic persistence mechanism because it maintains foothold without requiring ongoing interactive access. The use of a legitimate task name and SYSTEM privileges further hides the activity, aligning with TA0003 Persistence.

User Execution occurs when a victim runs a malicious file or link, causing adversary code to execute on the host. This satisfies the Execution tactic, which covers techniques that result in running attacker-controlled code on a target system.

The core technique.

Exfiltration over alternative protocol transfers stolen data through a channel other than the command-and-control path, such as DNS, FTP, or ICMP, evading controls that monitor the primary channel. It satisfies the stem by being a recognised MITRE ATT&CK exfiltration technique.

Scheduled tasks let an adversary register malicious code to run automatically at defined times or triggers, surviving reboots and logoff. This satisfies the stem's definition of Persistence, since the mechanism re-establishes execution without further attacker interaction, maintaining foothold on the compromised host.

Process Injection (T1055) involves injecting code into another process to evade detection and potentially elevate privileges. The use of CreateRemoteThread to execute code in a remote process is a classic example of process injection. This technique allows the adversary to run code under the context of a legitimate process, making it harder to detect.

Accessing NTDS.dit is a direct attempt to extract credential material, including password hashes for domain accounts, which is the defining goal of the Credential Access tactic. The subsequent NTLM authentications to member servers are consistent with the adversary using harvested credentials or hashes to move laterally, but the initial activity that enables that movement is the credential theft itself. The tactic mapping therefore centres on Credential Access.

Clearing Windows Event Logs destroys evidence of prior activity, so the adversary gains nothing tactically except avoiding detection. That places wevtutil cl under Defense Evasion, which covers indicator removal on host, rather than Execution, Persistence or Impact.

The regsvr32.exe invocation with /s /u /i:URL scrobj.dll is a classic signed-binary proxy execution technique, often called Squiblydoo, used to bypass application control and execute a remote scriptlet without writing to disk. Its primary purpose is to evade defenses, not to achieve persistence or credential access, so Defense Evasion is the most direct tactic.

The execution of a malicious macro that runs PowerShell to download and run a payload is a clear example of the Execution tactic. Execution encompasses techniques that result in adversary-controlled code running on a local or remote system. Here, the macro is the execution method, specifically T1204.002 User Execution: Malicious File. The adversary uses the user's action of enabling macros to execute code.