312-50 Question 162
Select 2▪ APT ConceptsA financial services company discovers that an engineer's workstation has been making low-volume encrypted outbound connections to a cloud-hosted VPS every night for the past 6 weeks. Endpoint telemetry shows a signed but unusual DLL loaded into a legitimate process, and the attacker appears to have used stolen domain credentials to access a file server containing merger documents. The SOC lead suspects an advanced persistent threat (APT) rather than opportunistic malware. Which TWO indicators in this scenario most strongly support that assessment?
- A
The activity shows long-term, covert persistence with stealthy command-and-control traffic and targeted access to sensitive business data
- B
The attacker used a cloud-hosted VPS for outbound communications, which by itself proves nation-state attribution
- C
The intrusion involved credential theft and likely lateral movement to reach a specific internal file server
- D
The malware used a signed DLL, which means the software is trusted and therefore not part of an APT
- E
The outbound traffic occurred at night, which indicates the event is most likely a scheduled backup job rather than malicious activity
Show answer and explanation
Correct answers: A, C
Explanation
The best answers are 1 and 3 because they reflect core APT concepts: persistence, stealth, targeted objectives, credential theft, and lateral movement. APTs are generally distinguished less by a single malware family or infrastructure choice and more by sustained campaigns using multiple tactics, techniques, and procedures (TTPs) to gain and maintain access to high-value systems. In real-world investigations, analysts should correlate endpoint evidence, authentication logs, network beaconing patterns, privilege escalation, and access to sensitive repositories. Guidance from frameworks such as MITRE ATT&CK is especially relevant here: valid accounts, command and control over encrypted channels, DLL side-loading or proxy execution, and lateral movement are all common post-compromise behaviors. NIST incident handling guidance also emphasizes using multiple indicators and contextual analysis rather than relying on one artifact such as a signed file or cloud IP address for classification or attribution.
- A. Correct.
Correct. APT activity is commonly characterized by stealth, persistence over an extended period, and focused targeting of high-value assets or information. In this scenario, the 6-week duration, low-volume encrypted beaconing, and access to merger documents all align with the behavior of a threat actor attempting to remain undetected while pursuing a specific objective.
- B. Incorrect.
Incorrect. Attackers frequently use cloud infrastructure, VPS hosts, and compromised third-party services for command-and-control because they blend in with normal traffic and are easy to provision. However, use of a cloud-hosted VPS does not by itself establish nation-state attribution or prove an APT. Attribution requires broader intelligence, including infrastructure overlap, tooling, TTP correlation, and other context.
- C. Correct.
Correct. Credential theft and lateral movement are common tactics used by APT groups after initial compromise to expand access and reach strategic targets. The use of stolen domain credentials to access a specific file server containing sensitive merger documents strongly suggests a targeted post-compromise objective rather than random or purely financially motivated commodity malware behavior.
- D. Incorrect.
Incorrect. A signed DLL is not automatically trustworthy in an incident context. Attackers may abuse legitimately signed binaries, steal code-signing certificates, or use DLL side-loading to make malicious activity appear benign. The presence of a signed DLL loaded into a legitimate process can actually support the idea of stealth and defense evasion, both of which are consistent with APT tradecraft.
- E. Incorrect.
Incorrect. Nighttime traffic can be suspicious or benign depending on the environment. While backups and maintenance windows often occur after hours, the key issue here is the repeated low-volume encrypted communication over weeks combined with suspicious process loading and unauthorized access to sensitive data. Time of day alone is not sufficient to dismiss malicious activity.