CySA+ 2B: Attack Frameworks and IoC Management

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to Lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What is one of the primary actions an attacker can perform during the actions on objectives phase?

  • Restore system functionality post-attack
  • Collect information and execute data exfiltration (correct)
  • Enhance perimeter security measures
  • Establish initial access to the target system

What does the MITRE ATT&CK framework specifically categorize?

  • Individual users and their credentials
  • Policies for incident response
  • Techniques used in cyber attacks (correct)
  • Physical security vulnerabilities

Which of the following is NOT one of the core features in the Diamond Model of Intrusion Analysis?

  • Adversary
  • Infrastructure
  • Victim
  • Attacker motivation (correct)

Why do some organizations view the Kill Chain model as too simplistic?

<p>It focuses too broadly on perimeter security. (B)</p> Signup and view all the answers

Which aspect does the Diamond Model of Intrusion Analysis help to analyze?

<p>The relationships between various entities in an intrusion event (A)</p> Signup and view all the answers

What does the term Indicator of Compromise (IoC) primarily refer to?

<p>A clear indication that a network has been attacked (C)</p> Signup and view all the answers

Why is correlating multiple IoCs essential in threat analysis?

<p>It provides a clearer picture of events (D)</p> Signup and view all the answers

What type of detection may struggle against advanced adversary tactics?

<p>Signature-based detection (B)</p> Signup and view all the answers

Which of the following is NOT identified as an indicator of compromise?

<p>Monthly software updates (D)</p> Signup and view all the answers

What do TTPs in behavioral threat research stand for?

<p>Tactics, Techniques, and Procedures (D)</p> Signup and view all the answers

How might a Security Operations Center (SOC) analyst identify a threat?

<p>By noticing unusual downloading activity (C)</p> Signup and view all the answers

Which of the following is a characteristic of behavioral threat research?

<p>It links multiple IoCs to identify patterns (A)</p> Signup and view all the answers

Which of the following indicators could suggest a DDoS attack?

<p>A sudden spike in network traffic (A)</p> Signup and view all the answers

What phase of the Kill Chain involves data exfiltration and network monitoring?

<p>Command and Control (B)</p> Signup and view all the answers

Which method is NOT used for delivering the weaponized code to the target?

<p>Physical theft (D)</p> Signup and view all the answers

In the Kill Chain, which step directly follows the Weaponization phase?

<p>Delivery (A)</p> Signup and view all the answers

What is the main goal of the Reconnaissance phase in the Kill Chain?

<p>To gather information about the target's security (C)</p> Signup and view all the answers

What role does the Command and Control (C2) server play in the Kill Chain?

<p>It facilitates remote control of infected systems (A)</p> Signup and view all the answers

During which phase of the Kill Chain is the payload code created?

<p>Weaponization (C)</p> Signup and view all the answers

Which of the following could indicate the presence of malware on a device?

<p>Increased memory usage (D)</p> Signup and view all the answers

What tactic might an attacker use during the Reconnaissance phase to avoid detection?

<p>Utilizing a botnet or zombie hosts (D)</p> Signup and view all the answers

Flashcards

Data exfiltration

The attacker steals data from the target system and sends it to a remote location

MITRE ATT&CK

A framework that categorizes cyberattack techniques by tactics and unique IDs.

Kill Chain

A model of cyberattacks, focused on perimeter security.

Diamond Model

A model that analyzes intrusion events by looking at attacker, capabilities, infrastructure and victim.

Signup and view all the flashcards

CIA Triad

Important security goal.

Signup and view all the flashcards

Malware Indicators

Unusual CPU or memory usage leading to system slowdowns.

Signup and view all the flashcards

Network Reconnaissance

Attackers scanning ports and IP addresses to find weaknesses.

Signup and view all the flashcards

Reconnaissance (Kill Chain)

Attacker's initial step to explore target systems and vulnerabilities.

Signup and view all the flashcards

Weaponization (Kill Chain)

Crafting malware code to exploit vulnerabilities.

Signup and view all the flashcards

Delivery (Kill Chain)

Delivering the malware to the target system.

Signup and view all the flashcards

Exploitation (Kill Chain)

Using malware code to take advantage of an identified vulnerability.

Signup and view all the flashcards

Command and Control (C2)

Attacker's remote control center for malware.

Signup and view all the flashcards

Indicator of Compromise (IoC)

A sign or event indicating a successful attack on a system or network.

Signup and view all the flashcards

Examples of IoCs

Unauthorized files, suspicious emails, unusual registry changes, unusual port usage, or excessive bandwidth use.

Signup and view all the flashcards

Correlating IoCs

Combining multiple IoCs to get a more complete picture of an attack.

Signup and view all the flashcards

Threat Research

Analyzing attacker tactics (how they work), techniques (what tools they use), and procedures (steps they follow).

Signup and view all the flashcards

Behavioral Threat Research

Linking IoCs to create attack patterns.

Signup and view all the flashcards

TTPs

Tactics, Techniques, and Procedures used by Attackers.

Signup and view all the flashcards

DDoS attack

A sudden flood of network traffic intending to overwhelm a system or service.

Signup and view all the flashcards

Static Malware Signature

A method to detect malware based solely on known patterns within a database.

Signup and view all the flashcards

Study Notes

CySA+ 2B: Attack Frameworks and Indicator Management

  • Classifying threat actors: Understanding adversary motivations and capabilities is crucial. Sophisticated tools are needed due to the diverse nature of threat actors. Attack frameworks can help categorize and analyze indicators of compromise (IoCs).
  • Indicators of Compromise (IoC): IoCs are residual signs that an asset or network has been successfully attacked. They can be specific (e.g., malware signatures) or require analyst interpretation (e.g., unusual data downloads). Analysts must judge, but correlating multiple IoCs improves accuracy.
  • Types of IoCs: IoCs include unauthorized software, suspicious files/emails, suspicious registry changes, unknown ports/protocols, unusual bandwidth usage, rogue hardware, and service disruptions.
  • Threat Research: Signature-based detection may not identify sophisticated adversary tactics. Threat research has evolved beyond static signatures to understand patterns in adversary behavior. This behavioral analysis helps identify tactics, techniques, and procedures (TTPs).
  • Behavioral TTPs: Some TTPs to look for include DDoS attacks (increased network traffic), viruses/worms (higher CPU/memory use), network reconnaissance (port scans), and data exfiltration (spikes in data transfer).

Kill Chain

  • Kill Chain Overview: A framework outlining the steps attackers usually take to achieve their objectives (e.g., Lockheed Martin Kill Chain). Seven steps are included: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives.
  • Reconnaissance: Attackers stealthily assess target systems and vulnerabilities.
  • Weaponization: Attackers create the tools/code tailored to exploit vulnerabilities.
  • Delivery: Attackers deliver the malware to the target. Common methods include email attachments, USB drives, and other means of transferring the weaponized code.
  • Exploitation: The delivered malware is executed on the target system.
  • Installation: The malicious code establishes persistence on the target system.
  • Command and Control (C2): The attacker establishes communication to control the compromised system; a C2 server is used as the control point for various malware.
  • Actions on Objectives: Attackers use access to collect and exfiltrate data or other malicious actions.

MITRE ATT&CK Framework

  • Alternative to Kill Chain for More Modern Attacks: Some organizations find the Kill Chain too basic for modern threats.
  • MITRE ATT&CK Framework: A more nuanced framework that tags specific adversary tactics, techniques, and procedures (TTPs). Includes categories like target selection, initial access, persistence, lateral movement, and command and control.
  • Importance of the Framework: The framework helps identify and categorize specific actions that attackers might take for more efficient threat response.

Diamond Model of Intrusion Analysis

  • Analysis of Intrusion Events: This model helps analyze intrusion events focusing on adversary, capability, infrastructure, and victim.
  • Graph Representation: The model uses a diamond shape to visualize the four core aspects of an intrusion event.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Quiz Team

Related Documents

CySA+ Lesson 2B: Attack Frameworks & Indicators

More Like This

Use Quizgecko on...
Browser
Open
Browser
Browser