Using open-source intelligence gathered from technical forums, a threat actor compiles and tests a malicious downloader to ensure it will not be detected by the victim organization's endpoint…

Question

Options

• ADelivery
• BReconnaissance
• CExploitation
• DWeaponization

• A
  4% (1)
• B
  17% (4)
• C
  4% (1)
• D
  74% (17)

Explanation

Cyber Kill Chain: Weaponization

Weaponization is correct because this stage involves the threat actor building or preparing the malicious payload - in this case, compiling a downloader and testing it against security tools to ensure it evades detection. The actor is essentially crafting their weapon before deploying it, which is the defining characteristic of this phase.

Why the distractors are wrong:

• Reconnaissance (B) involves gathering information about the target (scanning, OSINT about the organization) - not creating malware. While OSINT is mentioned, it's being used to inform the build process, not as the primary action.
• Delivery (A) is the stage where the weapon is sent to the victim (e.g., via phishing email or malicious link) - the threat actor hasn't deployed anything yet.
• Exploitation (C) occurs after delivery, when the malicious code actually executes and takes advantage of a vulnerability on the target system.

Memory Tip: Think of Weaponization as the "workshop" phase - the attacker is in their garage building and testing the weapon before taking it outside. If the attacker is still at their own workbench (not yet interacting with the victim), it's Weaponization.

No community discussion yet for this question.