Cyber Kill Chain
The moment after an unwary user clicks a link and executes the malware
Installation
The threat actor who initiated the attack
Adversary
The step that includes disabling ports and quarantining systems
Containment
FIM
File Integrity Monitoring
Which of the following are threats discovered in live environments that have no current fix or patch?
Zero day
The point that a threat actor decides on the tool to exploit the chosen vulnerability
Weaponization
An attacker first compromises a device, then an account, then another account, then a server followed by the target server. How many analyses are needed?
5 (Five)
The step where you perform OSINT research and Vulnerability Assessments
Preparation
EDR
Endpoint Detection & Response
Knowledge of threat actor tactics & techniques relies on Timeliness, Relevance, and _____________
Accuracy
Harvesting information concerning the target
Reconnaissance
The target of the attack by the threat actor
Victim
An IDS, Firewall, Proxy Server, End User, or Log Audit would be found involved in which step?
Detection
SWG
Secure Web Gateway
Linux command used to interact with a web server via the CLI.
Wget or cURL
What happens after the payload (malware) is triggered upon an action by the careless end-user
Installation
The source-to-destination path used to accomplish the exploit
Infrastructure
The step that includes changing passwords, performing updates, and reinstate data
Recovery
RCE
Remote Command Execution
Linux command used to extract human-readable text from a binary or data file
Hint: NOT grep
Strings
The effort by a threat actor after they have gained access to a device or network
Action on Objectives
When a threat actor uses their knowledge, research, and tools to exploit a vulnerability
Capability
The NIST Standard that outlines Incident Handling and Response
800-61
OSSTMM
Open Source Security Testing Methodology Manual
Protocol provides sender and domain authentication, receipt verification, and destination feedback for email traffic
DMARC (Domain-based Message Authentication, Reporting, and Conformance)