CySA+ Study Notes 18

Question 1

code that can be used in general situations that is packaged for general sale usually on the dark web; ex : RATs for example.

Answer 1

Commodity Malware

Question 2

a threat research that source identifies IP address ranges and DNS domains that are linked with malicious activity, like sending spam or DDoS attacks.

Answer 2

Reputational Data

Question 3

attacker determines which methods to complete phases of attack, use stealth to accomplish this, attacker discovers about target how organized and what security systems it has in place. May use passive / active scanning and if successful will be 1 or more potential exploits. Attacker needs to est. resources to launch attack, to evade detection will use botnet for DDoS attacks and exploits and then mask their origin.

Answer 3

Kill Chain : Reconnaissance (Stage 1)

Question 4

attacker couples payload code that will enable access w/exploit code that will use a vuln. to execute on target system.

Answer 4

Kill Chain : Weaponization (Stage 2)

Question 5

attacker identifies vector by which to transmit the weaponized code to target environ, like by email attachment or on USB drive.

Answer 5

Kill Chain : Delivery (Stage 3)

Question 6

weaponized code is executed on target system, ex : phishing email may trick user into running the code while drive by download would execute on a vulnerable system w/o user intervention.

Answer 6

Kill Chain : Exploitation (Stage 4)

Question 7

mechanism enables weaponized code to run on remote access tool and achieve persistence on target system.

Answer 7

Kill Chain : Installation (Stage 5)

Question 8

weaponized code est.’s an outbound channel to remote server that can be used to control remote access tool and possibly download extra tools to progress the attack.

Answer 8

Kill Chain : C2 or C&C (Stage 6)

Question 9

attacker usually uses access he has achieved to covertly collect info from target systems and transfer to remote system (data exfiltration).

Answer 9

Kill Chain : Action on Objectives (Stage 7)

Question 10

is built with SDO -> Observed Data : include IP address, change in exe file or sign., HTTP request or firewall blocking a connection attempt. Observables generated by logging/monitoring system. (2) Indicator : software would automate discovery of correlations between observables based on knowledge of past incidents and TTPs. (3) Attack Pattern : known adversary behaviors. (4) Campaign and Threat Actors : those launching the attacks. (5) CoA : mitigating actions or use of security controls to reduce risk from attacks or to resolve an incident.

Answer 10

STIX (is XML-based)