In an advanced persistent threat scenario, an adversary follows a detailed set of procedures in the cyber kill chain. During one such instance, the adversary has successfully gained access to a corporate network and now attempts to obfuscate malicious traffic within legitimate network traffic. Which of the following actions would most likely be part of the adversary's current procedures?

Question

Accepted Answer

B. Initiating DNS tunneling to communicate with the command-and-control server. DNS tunneling is a technique where malicious actors encode data from their command-and-control (C2) servers into DNS queries and responses, effectively creating a covert channel. Because DNS traffic is common and typically allowed through firewalls, this method highly obfuscates malicious communications, making them appear as legitimate DNS requests and responses within normal network traffic.

Answer

A. Employing data staging techniques to collect and aggregate sensitive data. Employing data staging techniques is related to preparing data for exfiltration or further processing, not primarily for obfuscating command-and-control communication within legitimate traffic.

Answer

C. Establishing a command-and-control server to communicate with compromised systems. Establishing a command-and-control server describes the setup of the infrastructure for communication, not the specific method used to obfuscate the communication traffic itself.

Answer

D. Conducting internal reconnaissance using PowerShell scripts. Conducting internal reconnaissance using PowerShell scripts is an activity focused on discovery within the network, not the primary method for obfuscating C2 traffic within legitimate network flows.

In an advanced persistent threat scenario, an adversary follows a detailed set of procedures in the cyber kill chain. During one such instance, the adversary has successfully gained access to a corpor

Question

Options

How the community answered

Why each option

Topics

Community Discussion