A technique often used by advanced persistent threat actors that can be identified through log analysis is:

The correct answer is A. Spear-phishing for initial access. Spear-phishing is the correct answer because APT actors frequently use highly targeted phishing emails to gain initial access, and these attempts leave distinct traces in email gateway logs, DNS query logs, and endpoint telemetry - making them detectable through log analysis…

Threat Hunting Techniques

Question

Options

ASpear-phishing for initial access
BUsing common software for tasks
CRegularly patching vulnerabilities
DEncrypting all data stored on servers

How the community answered

(31 responses)

A
74% (23)
B
3% (1)
C
10% (3)
D
13% (4)

Explanation

Spear-phishing is the correct answer because APT actors frequently use highly targeted phishing emails to gain initial access, and these attempts leave distinct traces in email gateway logs, DNS query logs, and endpoint telemetry - making them detectable through log analysis. Option B is wrong because using common ("living off the land") software actually helps attackers evade detection, not be identified by it. Option C is wrong because patching vulnerabilities is a defensive practice performed by defenders, not a technique used by threat actors. Option D is wrong because encrypting stored data is standard security hygiene and is not an APT tactic that log analysis would surface as suspicious behavior.

Memory tip: Think "APT = Access via Phishing, Traced in logs" - spear-phishing is how APTs get in, and logs are how defenders find out.

Topics

#APT techniques#Spear-phishing#Log analysis#Initial access

Community Discussion

No community discussion yet for this question.

Full 300-220 Practice