Adversarial Tactics practice questions

There is no distinction

Why it fails: They are distinct tactics/techniques.

T1059 is for Windows, T1204 is for Linux

Why it fails: Both cover cross-platform environments.

T1059 is the technique, T1204 is the outcome

Why it fails: Both are standalone techniques.

CreateServiceW

Why it fails: This is related to service creation and persistence.

GetSystemTime

Why it fails: This is a benign API call often used for environment keying.

RegCreateKeyEx

Why it fails: This relates to registry persistence.

Initial Access

Why it fails: This usually occurs after Initial Access.

Exfiltration

Why it fails: It does not involve moving data out.

Persistence

Why it fails: It is an active movement technique, not a long-term maintenance technique.

Exfiltration

Why it fails: WMI child-process spawning typically reflects execution or lateral movement, such as remote process creation via Win32_Process; exfiltration moves data outward over channels like HTTP or DNS. Exfiltration is tempting because WMI can script file transfers, but the parent-child pattern itself indicates command execution, not data egress.

Collection

Why it fails: WMI child-process creation demonstrates execution or lateral movement, not Collection, which gathers data such as files or clipboard contents from a target. Collection is tempting because WMI can enumerate and copy data, but the spawning behaviour itself evidences command execution rather than staged data gathering.

Impact

Why it fails: Not an impact tool.

Account manipulation

Why it fails: Account manipulation belongs to Persistence, Impact and Privilege Escalation, covering changes to permissions or credentials for continued access. It is tempting because tampering with accounts can also weaken logging or defences, yet the technique's defining purpose is maintaining or elevating access, not evading detection.

Data staging

Why it fails: Data staging groups collected files before exfiltration, which maps to the Collection and Exfiltration tactics, not Defense Evasion. It is tempting because staging often accompanies anti-forensic cleanup, but the technique itself prepares data for removal rather than impairing defences, hiding artefacts or evading detection.

Remote service creation

Why it fails: Remote service creation maps to Persistence and Execution, installing services on remote systems for continued or lateral access. It is tempting because service creation can disable security tooling, but the technique's core objective is establishing remote access, not the obfuscation, disabling or deception that defines Defense Evasion.

Enumerating local administrators using net localgroup

Why it fails: Enumerating local administrators with net localgroup is a Discovery technique (T1069.001), not Defense Evasion. It gathers information about privileged accounts but does not attempt to hide activity or bypass security controls. Discovery is about understanding the environment, whereas Defense Evasion focuses on avoiding detection.

Scheduling a task to run a malicious script at logon

Why it fails: Scheduling a task for persistence is a Persistence technique (T1053.005), not Defense Evasion. While it may help avoid detection by blending in, the primary goal is maintaining access. Defense Evasion would involve obfuscating the task or disabling security tools, not the scheduling itself.

Injecting code into a remote process using CreateRemoteThread

Why it fails: Injecting code via CreateRemoteThread is Process Injection (T1055), which is under Defense Evasion and Privilege Escalation. However, the question asks for Defense Evasion specifically, and while injection does evade defenses by hiding in legitimate processes, it is more precisely a sub-technique of Defense Evasion. But among the options, A and B are unambiguously Defense Evasion. D is also Defense Evasion, but the question requires choosing two, and A and B are the most direct examples. This option is plausible but not the best answer because it is a technique that can also be used for other purposes, and the question likely expects the two clearest Defense Evasion activities.

Defense Evasion

Why it fails: Defense Evasion is about avoiding detection. While scheduling a job might blend in, the core purpose is to maintain access, not to evade defenses. The 'at' command itself is not an evasion technique; it is a legitimate scheduling utility. The tactic is Persistence because the goal is recurring access.

Privilege Escalation

Why it fails: Privilege Escalation involves gaining higher-level permissions. Scheduling a job with 'at' does not inherently elevate privileges; it depends on the context in which the job runs. The scenario does not indicate the attacker gained new rights, only that they set up recurring execution. Thus, it is not primarily Privilege Escalation.

Execution

Why it fails: Execution is about running malicious code, but the scheduling itself is not the execution; it's the mechanism to ensure recurring execution. The reverse shell running is execution, but the tactic described is maintaining that execution over time. The question asks about the scheduling action, which is persistence.

T1059 Command and Scripting Interpreter

Why it fails: Command and Scripting Interpreter involves the use of command-line interfaces, PowerShell, or other scripting interpreters to execute commands. While the child process might be a script interpreter, the initial vector is the exploitation of the client application (Word). The scenario does not specify that the child process is a scripting interpreter; it could be any executable.

T1204 User Execution

Why it fails: User Execution involves the adversary relying on a user to execute malicious code, such as opening a malicious file. However, the scenario describes a child process spawned by WINWORD.EXE, indicating exploitation or malicious macro execution, not merely the user's action of opening the document. T1204 is a broader technique that encompasses the user's action, but the specific behavior of spawning a child process is more indicative of T1203.

T1566 Phishing

Why it fails: Phishing is a technique for initial access, where the adversary sends a malicious email to trick the user. In this scenario, the user received a document, but the focus is on the execution method after the document is opened. The child process and network connection indicate post-execution behavior, not the initial phishing delivery.

T1204.002 User Execution: Malicious File

Why it fails: User execution via a malicious file requires a user to open or run a file, such as a document or installer. The DNS log pattern alone does not indicate any file execution event; it only shows network queries. While a malicious file could have initiated the C2, the observed behavior is network-based command and control, not the execution technique itself.

T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Why it fails: Exfiltration over an unencrypted non-C2 protocol would involve sending data out through a separate channel not used for command and control, such as FTP or HTTP to a different endpoint. The DNS queries here are to a single domain and occur at regular intervals, which indicates an active C2 channel rather than bulk data exfiltration. No large data transfer is evident.

T1568.002 Dynamic Resolution: Domain Generation Algorithms

Why it fails: DGAs generate large numbers of pseudo-random domain names, often across many different registered domains, to evade blocklists. Here the workstation queries subdomains under one consistent parent domain, evilcorp.com, which is characteristic of DNS tunneling or beaconing rather than DGA. The regular interval and fixed parent domain further rule out DGA behavior.

Capturing network traffic to extract cleartext credentials

Why it fails: Enumerating domain accounts using net user is a Discovery technique (T1087 Account Discovery). It is used to gather information about accounts, not to obtain credentials. This activity does not involve accessing credential material, so it is not Credential Access.

Using WMI to query installed antivirus products

Why it fails: Using WMI to query installed antivirus products is a Discovery technique (T1047 Windows Management Instrumentation and T1518.001 Security Software Discovery). It is used to gather information about the environment, not to obtain credentials. This activity does not align with Credential Access.

Creating a scheduled task to run a script at system startup

Why it fails: Creating a scheduled task is a Persistence technique (T1053.005 Scheduled Task/Job), not Credential Access. While it can be used to maintain access, it does not directly involve obtaining credentials. The scenario is about credential dumping, so this activity is unrelated to Credential Access.

Defense Evasion

Why it fails: Defense evasion includes actions that undermine security controls. While the script attempts to disable Defender, that is the payload's effect, not the tactic of creating the scheduled task. The question asks about the creation of the scheduled task, which is a means to execute code. The defense evasion tactic would apply to the disabling of real-time protection, not the task creation itself.

Privilege Escalation

Why it fails: Privilege escalation aims to gain higher-level permissions. The scenario does not state that the script requires or obtains elevated privileges; it simply runs from a temporary directory. Disabling Defender could be done with existing user privileges if the user has administrative rights, but the primary tactic of creating a scheduled task to run a script is execution, not privilege escalation.

Persistence

Why it fails: Persistence involves maintaining access across restarts or credential changes. While scheduled tasks are often used for persistence, the scenario emphasizes the immediate execution of a script that disables defenses. The task creation itself is a mechanism for execution, not necessarily persistence, because there is no indication that the task is designed to survive reboots or that the attacker intends to maintain long-term access through it.

T1027 Obfuscated Files or Information

Why it fails: Obfuscated Files or Information involves adversaries hiding artifacts to evade detection. While the PowerShell command might be obfuscated, the line shown is not obfuscated; it is a clear download and execute command. The technique does not directly apply to this specific line, which is about execution via PowerShell.

T1105 Ingress Tool Transfer

Why it fails: Ingress Tool Transfer involves transferring tools or files from an external system into the victim network. While this line does download a file, the primary action is executing the downloaded script using PowerShell. Ingress Tool Transfer is more about the transfer itself, but here the execution is the key behavior. The technique is better classified as PowerShell execution.

T1204.002 User Execution: Malicious File

Why it fails: User Execution: Malicious File involves a user executing a malicious file, such as an attachment. In this scenario, the PowerShell script is executed, but there is no indication that a user manually executed a file. The script could be executed by another process or scheduled task. The technique is specifically about user action, which is not the focus here.

T1055 Process Injection

Why it fails: Process injection involves injecting code into a legitimate process to hide malicious activity. While the unusual parent-child relationship could indicate injection, the scenario describes a process named svchost.exe spawned by powershell.exe. This is more indicative of process masquerading, where the attacker names a malicious executable svchost.exe to blend in, rather than injecting into the real svchost.exe, which would have services.exe as parent.

T1071.001 Application Layer Protocol: Web Protocols

Why it fails: Web protocols are commonly used for command and control, and the HTTPS connection could be part of that. However, the question asks for the technique most likely being used by the attacker in creating the process. The use of HTTPS is a C2 channel, but the primary evasion technique here is the masquerading of the process name. The unusual parent-child relationship points to masquerading rather than the protocol itself.

T1053.005 Scheduled Task/Job: Scheduled Task

Why it fails: Scheduled tasks are used to execute programs at specific times or intervals. While the 30-second interval could suggest a scheduled task, the scenario does not mention task creation. The beaconing is more likely a built-in feature of the malware. The key anomaly is the process name and parent, not a scheduled task. Therefore, this technique is not the best fit.

NetFlow

Why it fails: NetFlow is for network traffic patterns.

DHCP logs

Why it fails: DHCP logs track IP assignments.

Firewall logs

Why it fails: Firewall logs track network traffic, not local file listing.

Discovery

Why it fails: Writing to the Run key establishes persistence, not reconnaissance. Discovery involves enumerating users, systems or permissions to map the environment. Discovery would be the objective when an attacker runs commands such as net user or whoami to gather host and account details.

Execution

Why it fails: The Run key write itself does not launch code; it registers a program to run later. Execution covers the actual process invocation, such as a scheduled task or user logon triggering the payload. Persistence is the objective at the modification stage.

Privilege Escalation

Why it fails: Modifying HKLM\...\Run requires existing administrative rights; it does not elevate the attacker. Privilege Escalation covers gaining higher permissions, such as token impersonation or exploiting an unpatched service. The Run key write instead secures persistence across reboots.

Credential Access

Why it fails: Credential Access covers dumping credentials, such as LSASS memory or SAM hashes; wsmprovhost.exe spawning cmd.exe shows a remote PowerShell session running commands, not credential theft. Credential Access is tempting because remote execution is often followed by credential dumping, but the spawning event alone does not demonstrate it.

Exfiltration

Why it fails: Exfiltration covers data theft and transfer out of the environment; wsmprovhost.exe spawning cmd.exe indicates remote PowerShell execution, which maps to Execution. Exfiltration is tempting because attacker command shells often precede staging and outbound transfer, but no data movement is evidenced here.

Persistence

Why it fails: Persistence covers mechanisms that survive restarts, such as scheduled tasks or services; a remote PowerShell host spawning cmd.exe shows execution of commands, not establishment of lasting access. Persistence is tempting because remote shells are frequently used to install backdoors, but the observed event itself is not that installation.

Credential Access

Why it fails: Credential Access covers techniques such as dumping LSASS or SAM to obtain credentials; vssadmin shadow deletion targets backup copies, not credential stores. It is tempting because shadow copies can contain credential material, but the technique's purpose is destroying recovery data, which maps to Impact.

Defense Evasion

Why it fails: Deleting shadow copies via vssadmin is categorised under Impact, since it destroys recovery data and inhibits backup restoration, not Defense Evasion. It is tempting because the quiet flag and use of a signed Windows binary suggest hiding activity, which would fit Defense Evasion if the goal were concealing artefacts rather than destroying them.

Initial Access

Why it fails: Initial Access covers techniques gaining an initial foothold, such as phishing or exploiting a public-facing service; vssadmin shadow deletion occurs after compromise and destroys recovery data. It is tempting because the command appears early in ransomware playbooks, but it would be correct only if the technique itself established the attacker's entry.

Network Isolation

Why it fails: Network Isolation quarantines a device by cutting its network connections, which contains an already-compromised endpoint rather than stopping a phishing message from being delivered or clicked. It is genuinely used during incident response to prevent lateral movement and command-and-control traffic.

Attack Surface Reduction (ASR) rules

Why it fails: ASR rules block specific behaviours such as Office child processes or executable content, but they do not inspect or detonate inbound email, so a malicious link or attachment still reaches the mailbox. ASR is genuinely used to harden endpoints against exploitation and script-based attacks after delivery.

Device Control

Why it fails: Device Control governs which USB and removable-media devices may connect and what data they may transfer, addressing exfiltration and infected media rather than email-borne phishing. It is genuinely used to block unauthorised peripherals and enforce removable-storage policy on managed endpoints.

Installing a backdoor

Why it fails: Installing a backdoor is Persistence, establishing continued access after compromise, not Discovery. Discovery covers techniques such as account, network and file enumeration that map the victim environment. It would be the correct classification when an adversary runs commands to identify systems, users or shares before lateral movement.

Deleting logs to hide traces

Why it fails: Deleting logs to hide traces is Indicator Removal, part of Defence Evasion, not Discovery. Discovery concerns gathering information about the victim environment, such as account, network or system enumeration. Log deletion would be correctly classified when the question asks how adversaries conceal their activity from defenders.

Encrypting files for ransom

Why it fails: Encrypting files for ransom is Impact, specifically Data Encrypted for Impact, not Discovery. Discovery covers enumeration of accounts, systems, networks and files to inform later actions. Encryption would be the correct classification when the question concerns adversaries destroying or denying access to data.

To escalate privileges

Why it fails: Obfuscation does not grant higher rights.

To increase execution speed

Why it fails: T1027 disguises code or data to frustrate analysis and evade defences; it does not optimise performance. Obfuscation typically adds processing overhead rather than reducing it. The technique is tempting because packed or encoded payloads can appear streamlined, yet its purpose is concealment from defenders, not faster execution.

To facilitate lateral movement

Why it fails: T1027 hides files or information to impede detection and analysis, not to move between systems. Lateral movement relies on techniques such as remote service exploitation or credential use. Obfuscation may accompany an intrusion, but its documented objective is defence evasion, not traversing a network.