300-215 Question 162
Select 3During a forensic analysis, you are reviewing threat intelligence data related to a recent malware attack. The artifacts include indicators such as domain names, IP addresses, and file hashes tied to the campaign. You also observe techniques such as lateral movement and privilege escalation. Using Cisco SecureX Threat Response, how would you determine the most likely threat actor profile responsible for the attack?
- A
Correlate the observed indicators with known threat actor campaigns in threat intelligence feeds.
- B
Analyze the behavioral patterns and tactics used in the attack and match them to MITRE ATT&CK matrices for known threat actors.
- C
Focus solely on the domain names and check for overlaps with previously blocked domains in your network.
- D
Review historical events in Cisco Secure Endpoint to identify if the same artifacts were used in past incidents.
- E
Use Cisco Umbrella to trace the geolocation of the IP addresses and determine if they match the threat actor's known region of operation.
Show answer and explanation
Correct answers: A, B, E
Explanation
To effectively evaluate artifacts and determine a threat actor profile, a multi-faceted approach is required. Correlating indicators with known campaigns, analyzing tactics and techniques via MITRE ATT&CK, and leveraging geolocation analysis are key steps in profiling. Each of these methods provides essential information to attribute the attack to a specific group or actor. Solely focusing on one type of artifact or historical data without additional context will likely not provide a complete or accurate profile.
- A. Correct.
Correlating indicators with known threat actor campaigns in threat intelligence feeds provides direct evidence of potential attribution, as these feeds often link artifacts to specific actors or groups.
- B. Correct.
Matching behavioral patterns and tactics to MITRE ATT&CK matrices is a proven method to identify threat actor profiles, as these matrices categorize techniques commonly associated with specific actors.
- C. Incorrect.
Focusing solely on domain names without considering other artifacts or context is insufficient for determining a threat actor profile, as domain names alone do not provide enough attribution information.
- D. Incorrect.
While reviewing historical events in Cisco Secure Endpoint can provide context and verify artifact reuse, it does not directly help identify the specific threat actor's profile without other corroborating evidence.
- E. Correct.
Using Cisco Umbrella to trace the geolocation of IP addresses can help determine the region of operation, which is often a key factor in profiling threat actors who operate in specific geographical areas.