350-201 Question 163
Select 3A cybersecurity analyst is investigating an attack where the adversary bypassed endpoint defenses, escalated privileges, and exfiltrated sensitive data. The analyst wants to determine the Tactics, Techniques, and Procedures (TTPs) used in this attack. Which of the following actions should the analyst take to effectively identify the TTPs?
- A
Analyze the attacker's actions against the MITRE ATT&CK framework
- B
Review system logs and correlate them with known attack patterns
- C
Focus solely on identifying the malware's hash value for signature-based detection
- D
Inspect network traffic for indicators of data exfiltration
- E
Ignore lateral movement and concentrate only on the initial compromise
Show answer and explanation
Correct answers: A, B, D
Explanation
To effectively identify Tactics, Techniques, and Procedures (TTPs), it is important to use comprehensive approaches such as leveraging the MITRE ATT&CK framework, analyzing system logs for attack patterns, and inspecting network traffic for signs of malicious activity. These methods provide a detailed understanding of the adversary's behavior. Narrowing the focus to a single indicator, such as malware hash, or ignoring key phases like lateral movement, will result in an incomplete analysis of the TTPs.
- A. Correct.
The MITRE ATT&CK framework is specifically designed to help identify TTPs by mapping attacker behaviors to known tactics and techniques. This is a crucial step in understanding the methods used.
- B. Correct.
System logs provide valuable insights into the actions taken by the attacker and can help correlate patterns with known techniques, aiding in determining the TTPs.
- C. Incorrect.
Focusing only on the malware's hash value is insufficient for identifying TTPs as it provides limited information and does not reveal the broader context of the attack.
- D. Correct.
Inspecting network traffic can help identify unusual activity like data exfiltration, which is a key technique often associated with specific TTPs.
- E. Incorrect.
Ignoring lateral movement would overlook critical tactics and techniques used by attackers to expand their access within the network. This would hinder the identification of TTPs.