1- Reconnaissance

Question 1

1- Reconnaissance

10 techniques

Answer 1

1- Active Scanning
2- Gather Victim Host Information
3- Gather Victim Identity Information
4- Gather Victim Network Information
5- Gather Victim Org Information
6- Phishing for Information
7- Search Closed Sources
8- Search Open Technical Databases
9- Search Open Websites/Domains
10- Search Victim-Owned Websites

Question 2

1.1- Active Scanning

T1595

Answer 2

1- Scanning IP blocks
2- Vulnerability scanning

M1056 - Pre-compromise
Platforms: PRE
Data Sources:
(1) Network Traffic: Network Traffic Flow
(2) Network Traffic: Network Traffic Content

Question 3

1.2- Gather Victim Host Information

T1592

Answer 3

1- Hardware
2- Software
3- Firmware
4- Client Configurations

M1056 - Pre-compromise
Platforms: PRE

Question 4

1.3 - Gather Victim Identity Information

Answer 4

1- Credentials
2- Email Addresses
3- Employee Names

G0050 - APT32
M1056 - Pre-compromise
Platforms: PRE

Question 5

1.4 - Gather Victim Network Information

Answer 5

1- Domain Properties
2- DNS
3- Network Trust Dependencies
4- Network Topology
5- IP Addresses
6- Network Security Appliances

G0125 - HAFNIUM
M1056 - Pre-compromise
Platforms: PRE

Question 6

1.5 - Gather Victim Org Information

Answer 6

1- Determine Physical Locations
2- Business Relationships
3- Identify Business Tempo
4- Identify Roles

M1056 - Pre-compromise
Platforms: PRE

Question 7

1.6 - Phishing for Information

Answer 7

1- Spearphishing Service
2- Spearphishing Attachment
3- Spearphishing Link

G0007 - APT28
G0128 - ZIRCONIUM
M1054 - Software Configuration (DMARC)
M1017 - User Training
Platforms: PRE

Data Sources:

(1) Application Log: Application Log Content
(2) Network Traffic: Network Traffic Content
(3) Network Traffic: Network Traffic Flow

Question 8

1.7 - Search Closed Sources

Answer 8

1- Threat Intel Vendors
2- Purchase Technical Data

M1056 - Pre-compromise
Platforms: PRE

Question 9

1.8 - Search Open Technical Databases

Answer 9

1- DNS/Passive DNS
2- WHOIS
3- Digital Certificates
4- CDNs
5- Scan Databases

M1056 - Pre-compromise
Platforms: PRE

Question 10

1.9 - Search Open Websites/Domains

Answer 10

1- Social Media
2- Search Engines

G0034 - Sandworm Team
M1056 - Pre-compromise
Platforms: PRE

Question 11

1.10 - Search Victim-Owned Websites

Answer 11

G0034 - Sandworm Team
G0122 - Silent Librarian
M1056 - Pre-compromise
Platforms: PRE

Data Sources:
(1) Application Log: Application Log Content