SY0-701 Question 490
Single answerExecutionA security analyst is reviewing alerts from an endpoint detection and response (EDR) platform after a user opened a malicious email attachment. The attachment launched a script interpreter and began running additional commands directly in memory without writing a traditional executable to disk. The analyst needs to identify the attack phase being observed so the team can tune detections for this behavior. Which phase of the cyber kill chain is the attacker primarily performing?
- A
Reconnaissance
- B
Weaponization
- C
Execution
- D
Exfiltration
Show answer and explanation
Correct answer: C
Explanation
The best answer is Execution. In practical incident response, analysts often map observed behavior to an attack framework or kill chain stage to improve detections and response playbooks. Here, the key indicators are that the user opened a malicious attachment and a script interpreter began running commands in memory. That is a strong indicator of malicious code execution on the endpoint. This aligns with common guidance from ATT&CK-style detection practices, where interpreters such as PowerShell, cmd, WMI, JavaScript, or macros are frequently used to execute payloads, including fileless malware. Defenders commonly tune controls such as EDR behavioral detections, application control, PowerShell logging, AMSI inspection, and script-block logging to detect this phase. Although the precise naming can differ across frameworks, Security+ commonly expects candidates to recognize execution as the stage where attacker-controlled code actually runs on the compromised host.
- A. Incorrect.
Reconnaissance is incorrect because this phase occurs before delivery and involves gathering information about the target, such as users, systems, email formats, or exposed services. In this scenario, the attacker has already delivered the attachment and code is actively running on the endpoint.
- B. Incorrect.
Weaponization is incorrect because weaponization is the phase where the attacker prepares a malicious payload or couples an exploit with a backdoor before sending it to the victim. The scenario describes the payload already being triggered on the victim system, not being built or staged by the attacker.
- C. Correct.
Execution is correct because the malicious attachment has caused code to run on the victim endpoint through a script interpreter, and the commands are being executed in memory. In Security+ attack frameworks, execution refers to the stage where malicious code runs on a target system after delivery and exploitation. Fileless techniques that use PowerShell, WMI, or other interpreters are classic examples of execution activity defenders monitor.
- D. Incorrect.
Exfiltration is incorrect because exfiltration involves moving stolen data out of the environment to an attacker-controlled destination. The scenario does not mention data theft or outbound transfer; it focuses on malicious code starting to run after the attachment was opened.