What aspect of a threat intelligence report is critical in drawing conclusions about threat actor tactics?

Question

Options

• AThe geographic location of the attacker
• BThe industry targeted by the attacker
• CThe specific vulnerabilities exploited
• DThe malware delivery method

• A
  4% (1)
• B
  8% (2)
• C
  75% (18)
• D
  13% (3)

Explanation

Specific vulnerabilities exploited (C) are the most critical element for drawing conclusions about threat actor tactics, because the choice of vulnerability reveals how an attacker operates - their technical capability, preferred attack vectors, and methodology. This directly maps to the "Techniques" layer of frameworks like MITRE ATT&CK, giving analysts actionable intelligence about the actor's tradecraft.

Why the distractors fall short:

• A (Geographic location): Tells you where an actor may be based, but attribution doesn't explain tactics - a Russian actor and a Chinese actor may use identical techniques.
• B (Industry targeted): Reveals who the actor pursues (their objective or motivation), not how they attack.
• D (Malware delivery method): This is a component of tactics, but it's one narrow step (initial access). The specific vulnerabilities exploited span the full attack lifecycle and are more revealing of overall methodology.

Memory tip: Think of it this way - CVEs are the actor's fingerprints on the lock they picked. The lock's location (geo), the building type (industry), and the getaway car (delivery method) tell you context, but the actual lock-picking technique tells you how they work.

No community discussion yet for this question.