312-39 · Question #20
As a SOC Administrator at a mid-sized financial institution, you noticed intermittent network slowdowns and unexplained high memory usage across multiple critical systems. Your initial analysis…
The correct answer is D. Persistence. This scenario best aligns with Persistence because the attacker established mechanisms to maintain access over time after the initial compromise. The defining evidence is “unauthorized scheduled tasks executed during off-peak hours” running obfuscated scripts and connecting to…
Question
As a SOC Administrator at a mid-sized financial institution, you noticed intermittent network slowdowns and unexplained high memory usage across multiple critical systems. Your initial analysis found no traces of malware, but a forensic investigation revealed unauthorized scheduled tasks that executed during off-peak hours. These tasks ran obfuscated scripts that connected to an external command-and-control (C2) server. Further investigations showed that the adversary had gained access months ago through a compromised VPN account, leveraging stolen credentials from a phishing campaign. Which phase of the Advanced Persistent Threat (APT) lifecycle does this scenario align with?
Options
- ACleanup
- BInitial Intrusion
- CSearch and Exfiltration
- DPersistence
How the community answered
(31 responses)- A10% (3)
- B6% (2)
- C3% (1)
- D81% (25)
Explanation
This scenario best aligns with Persistence because the attacker established mechanisms to maintain access over time after the initial compromise. The defining evidence is “unauthorized scheduled tasks executed during off-peak hours” running obfuscated scripts and connecting to a C2 server. Scheduled tasks and startup mechanisms are classic persistence techniques that allow an adversary to survive reboots, re-establish footholds, and perform recurring actions (beaconing, payload retrieval, credential harvesting) without continuous interactive access. The scenario explicitly states the adversary gained access months ago via compromised VPN credentials (initial intrusion), but what you are observing now is the long-lived foothold and automated re-entry capability. Cleanup would involve covering tracks and removing evidence; while obfuscation and potential log manipulation can be related, the core described behavior is recurring execution and ongoing C2 communication. Search and exfiltration would focus on data discovery and transfer; while network slowdowns could be related to exfiltration, the most direct indicators here are persistence mechanisms enabling continued control. For SOC response, this phase emphasizes removing persistence artifacts, rotating credentials, and validating no alternate footholds remain.
Topics
Community Discussion
No community discussion yet for this question.