1.2 Utilize the MITRE ATT&CK Framework to Model Threat Actor Behaviors CCFH Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A detection engineering team is reviewing a threat actor's TTPs and wants to create a detection that covers multiple techniques with a single rule. The actor uses scheduled tasks for persistence and also uses scheduled tasks to execute malicious code. Which ATT&CK technique should the team focus on to create a single detection?

   • AT1562 Impair Defenses
   • BT1059 Command and Scripting Interpreter
   • CT1053 Scheduled Task
   • DT1543 Create or Modify System Process
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is reviewing an alert where an attacker used a USB drive to deliver malware to a workstation. The analyst needs to document this in ATT&CK. Which technique and tactic should be recorded?

   • AT1053 Scheduled Task, Persistence
   • BT1091 Replication Through Removable Media, Lateral Movement
   • CT1566 Phishing, Initial Access
   • DT1200 Hardware Additions, Initial Access
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team is analyzing a mobile malware sample that abuses accessibility services to steal credentials from banking apps. The team needs to map this behavior to the appropriate ATT&CK matrix. Which matrix and tactic should they use?

   • AMobile matrix, Collection
   • BEnterprise matrix, Credential Access
   • CICS matrix, Collection
   • DMobile matrix, Credential Access
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During a threat hunt, an analyst finds that an attacker created a new local user account and added it to the local administrators group. The analyst needs to map this to ATT&CK. Which tactic and technique pair is correct?

   • ADefense Evasion, T1562 Impair Defenses
   • BPrivilege Escalation, T1078 Valid Accounts
   • CDiscovery, T1087 Account Discovery
   • DPersistence, T1136 Create Account
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is investigating a suspected intrusion into an industrial control system (ICS) environment. The analyst observes that an attacker modified ladder logic on a programmable logic controller (PLC) to cause a physical process to operate unsafely. The analyst needs to document this behavior using the MITRE ATT&CK framework. Which matrix and tactic should the analyst reference?

   • AICS matrix, Impair Process Control tactic
   • BEnterprise matrix, Collection tactic
   • CEnterprise matrix, Impact tactic
   • DMobile matrix, Impact tactic
   Reveal Solution Discussion Select an answer first