Threats & Attack Techniques
MITRE ATT&CK thinking, common attacker behaviors, and detection ideas.
Showing 10 of 10
TA-01
What is the MITRE ATT&CK framework?
▾
TA-01
What is the MITRE ATT&CK framework?
Answer: A knowledge base of adversary tactics and techniques that helps map behaviors to detections, hunting, and response.
Tip: Mention use: “I map alerts to ATT&CK to understand the kill chain stage.”
TA-02
What is credential dumping and why is it dangerous?
▾
TA-02
What is credential dumping and why is it dangerous?
Answer: Extracting credentials from memory or stores (e.g., LSASS) to enable lateral movement and privilege escalation.
Tip: Signals: suspicious access to LSASS, use of known tools, abnormal authentication patterns.
TA-03
What is privilege escalation?
▾
TA-03
What is privilege escalation?
Answer: Gaining higher permissions than intended (user → admin/root). It can be done via exploits, misconfigurations, or credential abuse.
Tip: Mention both: local and domain escalation paths.
TA-04
What is C2 (command and control)?
▾
TA-04
What is C2 (command and control)?
Answer: Infrastructure attackers use to send commands and receive data from compromised systems.
Tip: SOC angle: beaconing patterns, rare domains, unusual ports, periodic callbacks.
TA-05
Explain “living off the land” (LOLBins).
▾
TA-05
Explain “living off the land” (LOLBins).
Answer: Using legitimate built-in tools (PowerShell, WMI, rundll32) to avoid detection and blend in with normal admin activity.
Tip: Focus on context: suspicious command lines, unusual parents, odd execution times.
TA-06
How does data exfiltration commonly happen?
▾
TA-06
How does data exfiltration commonly happen?
Answer: Via cloud storage, HTTPS uploads, DNS tunneling, email, or staging and compressing then sending out.
Tip: Indicators: abnormal upload volume, rare destinations, new tools (rclone), unusual archives.
TA-07
What is lateral movement and give an example technique.
▾
TA-07
What is lateral movement and give an example technique.
Answer: Moving across hosts. Examples: remote services (SMB/WinRM), pass-the-hash, RDP, PsExec.
Tip: Mention detective signals: new remote service creation, admin shares, authentication bursts.
TA-08
What are common persistence techniques on Windows?
▾
TA-08
What are common persistence techniques on Windows?
Answer: Scheduled tasks, services, startup folder, Run keys, WMI event subscriptions, DLL hijacking.
Tip: In an interview, naming 3–5 with confidence is plenty.
TA-09
What is a supply chain attack?
▾
TA-09
What is a supply chain attack?
Answer: Compromising software/hardware providers or dependencies so victims get infected through trusted updates or libraries.
Tip: Detection relies on integrity checks, SBOM awareness, and anomaly monitoring.
TA-10
Why do attackers use encryption and obfuscation?
▾
TA-10
Why do attackers use encryption and obfuscation?
Answer: To hide payloads, evade signatures, and make analysis harder (packed binaries, encrypted strings, TLS traffic).
Tip: SOC response: lean on behavior + metadata + endpoint telemetry.