Campaigns and Attribution GCTI Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization has experienced three separate security incidents over the past six months. In each incident, the attackers used a different malware family and a different initial access vector (one via phishing, one via exploitation of a public-facing application, and one via credential stuffing). However, in all three incidents, the attackers used the same custom post-exploitation toolkit and exfiltrated data to the same external IP address. How should the organization's threat intelligence team characterize these incidents?

   • AAs a single intrusion that has recurred multiple times
   • BAs three unrelated attacks because the malware and initial access vectors are different
   • CAs a single campaign because the incidents share common post-exploitation tools and exfiltration infrastructure
   • DAs a false flag operation because the attackers used different malware families
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security operations center has observed multiple alerts over the past month: a phishing email with a specific subject line, a malware hash, and a command-and-control domain. The analyst wants to determine if these alerts are part of the same campaign. Which action would most effectively support that determination?

   • AReport the alerts to law enforcement without further analysis.
   • BBlock the indicators and close the alerts as false positives.
   • CCorrelate the alerts using the shared indicators and check for additional commonalities in TTPs.
   • DIsolate each alert and investigate them independently to avoid bias.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An analyst at a manufacturing firm notices that a single phishing email led to a credential compromise, followed by a separate ransomware deployment three weeks later. The analyst wants to determine whether these two events should be treated as one campaign or two unrelated incidents. Which combination of evidence would most strongly support treating them as a single campaign?

   • AThe phishing email and the ransomware note both demanded payment in Bitcoin, but the wallet addresses were different.
   • BBoth events used the same command-and-control domain and the ransomware binary was signed with a certificate previously used by the same actor.
   • CThe phishing email was sent from a domain that was registered one day before the attack, while the ransomware used a different domain registered a week later.
   • DThe ransomware encrypted files with an extension not seen before, and the phishing email used a lure about a new HR policy.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An incident response team discovers that a ransomware campaign uses a wiper disguised as ransomware and that the decryption key is absent. The malware contains strings in Russian, and the C2 infrastructure is hosted in a country that is a known adversary of Russia. The team is considering attribution. What is the most important consideration before concluding the actor is Russian?

   • AThe absence of a decryption key suggests the ransomware is a false flag designed to mislead attribution.
   • BThe C2 infrastructure location is the most reliable indicator of attribution.
   • CThe Russian language strings are definitive proof of Russian origin.
   • DThe use of a wiper instead of ransomware indicates a hacktivist group, not a state actor.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An intelligence team has attributed a campaign to a specific threat actor based on a single piece of malware that shares a rare code signature with a known sample. The team is preparing a report for executives. How should the team communicate the confidence level of this attribution?

   • ANo confidence, because technical indicators are never reliable for attribution.
   • BLow confidence, because the evidence is based on a single technical indicator without corroboration.
   • CModerate confidence, because the malware is technically sophisticated.
   • DHigh confidence, because the code signature is rare and unique to the actor.
   Reveal Solution Discussion Select an answer first