350-201 Question 161
Select 3A financial institution experienced a data breach where attackers used phishing emails to harvest employee credentials. Subsequently, the attackers accessed the internal network, escalated privileges, and exfiltrated sensitive customer data using a remote server. As a cybersecurity analyst, which TTPs are most relevant to this incident?
- A
Credential harvesting via phishing
- B
Privilege escalation to gain administrative access
- C
Exploitation of a zero-day vulnerability in endpoint software
- D
Data exfiltration to an external remote server
- E
Distributed Denial of Service (DDoS) attack to disrupt services
Show answer and explanation
Correct answers: A, B, D
Explanation
The scenario describes a multi-step attack where attackers used phishing to harvest credentials (initial access tactic), escalated privileges to gain administrative access (privilege escalation technique), and finally exfiltrated sensitive data to a remote server (data exfiltration procedure). Identifying these TTPs is crucial for understanding and mitigating such attacks.
- A. Correct.
Credential harvesting via phishing is a key tactic employed by attackers in this scenario to gain initial access to the network.
- B. Correct.
Privilege escalation is a technique used by attackers to expand their access within the internal network, which is a clear step in this attack.
- C. Incorrect.
Exploitation of a zero-day vulnerability is not mentioned in the scenario, making it irrelevant to this specific incident.
- D. Correct.
Data exfiltration to a remote server is a crucial procedure performed by the attackers to steal sensitive customer data.
- E. Incorrect.
A Distributed Denial of Service (DDoS) attack is not part of the described scenario, as the incident focuses on credential theft, privilege escalation, and data exfiltration.