Techniques used by threat actors can be identified by analyzing:

Question

Options

• AThe color scheme of the phishing email
• BThe encryption algorithm of ransomware
• CThe sequence of commands executed after initial compromise
• DThe geographical location of the attacker

• A
  6% (3)
• B
  2% (1)
• C
  89% (47)
• D
  4% (2)

Explanation

Analyzing the sequence of commands executed after initial compromise reveals threat actor techniques because post-exploitation behavior - running reconnaissance commands, lateral movement tools, privilege escalation utilities, or data exfiltration scripts - directly maps to known attacker TTPs (Tactics, Techniques, and Procedures) documented in frameworks like MITRE ATT&CK. This command sequence is what forensic analysts and EDR tools capture to attribute and categorize an attack.

Why the distractors are wrong:

• A (color scheme): Aesthetics may help identify a specific phishing campaign, but they don't reveal operational techniques - they're presentation choices, not methodology.
• B (encryption algorithm): The ransomware's encryption algorithm identifies what tool was used, not the broader sequence of techniques the attacker employed to deploy it (credential theft, lateral movement, etc.).
• D (geographical location): Attribution by location is notoriously unreliable due to VPNs and proxies, and location tells you who (loosely), not how - it reveals nothing about technique.

Memory tip: Think "commands = conduct" - the commands an attacker runs after getting in are their behavioral fingerprint, which is exactly what technique-focused frameworks like ATT&CK catalog.

No community discussion yet for this question.