MITRE ATT&CK: answer key
Every question with its answer and the reasoning. Work the drill first, or the key only tells you what, not how.
-
Which MITRE ATT&CK technique ID does this real procedure example describe? "DarkGate will retrieved encrypted commands from its command and control server for follow-on actions such as cryptocurrency mining." (Answer with the technique ID, e.g. "T1059" or "T1059.001".)
Answer: T1001
Data Obfuscation (T1001): Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Read more: View T1001 on the ATT&CK map
-
Masquerading (T1036) maps to which MITRE ATT&CK tactic? (type the tactic name, e.g. "Credential Access")
Answer: Stealth
Masquerading (T1036) maps to the Stealth tactic in the Enterprise matrix.
Read more: View T1036 on the ATT&CK map
-
Which MITRE ATT&CK technique ID does this real procedure example describe? "Clambling has the ability to use Telnet for communication." (Answer with the technique ID, e.g. "T1059" or "T1059.001".)
Answer: T1071
Application Layer Protocol (T1071): Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing.
Read more: View T1071 on the ATT&CK map
-
Modify Registry (T1112) maps to which MITRE ATT&CK tactic? (type the tactic name, e.g. "Credential Access")
Answer: Defense Impairment
Modify Registry (T1112) maps to Defense Impairment, Persistence in the Enterprise matrix. Defense Impairment is the one this question checked.
Read more: View T1112 on the ATT&CK map
-
Which MITRE ATT&CK technique ID does this real procedure example describe? "APT28 has used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144, to gain execution on vulnerable Microsoft Exchange; they have also conducted SQL injection attacks against external websites." (Answer with the technique ID, e.g. "T1059" or "T1059.001".)
Answer: T1190
Exploit Public-Facing Application (T1190): Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets.
Read more: View T1190 on the ATT&CK map
-
File and Directory Permissions Modification (T1222) maps to which MITRE ATT&CK tactic? (type the tactic name, e.g. "Credential Access")
Answer: Defense Impairment
File and Directory Permissions Modification (T1222) maps to the Defense Impairment tactic in the Enterprise matrix.
Read more: View T1222 on the ATT&CK map
-
Which MITRE ATT&CK technique ID does this real procedure example describe? "APT42 has used custom malware to steal login and cookie data from common browsers." (Answer with the technique ID, e.g. "T1059" or "T1059.001".)
Answer: T1539
Steal Web Session Cookie (T1539): An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used.
Read more: View T1539 on the ATT&CK map
-
Phishing (T1566) maps to which MITRE ATT&CK tactic? (type the tactic name, e.g. "Credential Access")
Answer: Initial Access
Phishing (T1566) maps to the Initial Access tactic in the Enterprise matrix.
Read more: View T1566 on the ATT&CK map
-
Which MITRE ATT&CK technique ID does this real procedure example describe? "In the Triton Safety Instrumented System Attack, TEMP.Veles engaged in network reconnaissance against targets of interest." (Answer with the technique ID, e.g. "T1059" or "T1059.001".)
Answer: T1595
Active Scanning (T1595): Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction. Adversaries may perform different forms of active scanning depending on what information they seek to gather.
Read more: View T1595 on the ATT&CK map
-
Acquire Access (T1650) maps to which MITRE ATT&CK tactic? (type the tactic name, e.g. "Credential Access")
Answer: Resource Development
Acquire Access (T1650) maps to the Resource Development tactic in the Enterprise matrix.
Read more: View T1650 on the ATT&CK map
-
These five real MITRE ATT&CK techniques all show up in one intrusion. Click them into the order their tactics actually occur in the Enterprise kill chain (earliest first).
Answer: T1566: Phishing T1059: Command and Scripting Interpreter T1003: OS Credential Dumping T1082: System Information Discovery T1041: Exfiltration Over C2 Channel
Real MITRE ATT&CK kill-chain order: T1566 Phishing (Initial Access) → T1059 Command and Scripting Interpreter (Execution) → T1003 OS Credential Dumping (Credential Access) → T1082 System Information Discovery (Discovery) → T1041 Exfiltration Over C2 Channel (Exfiltration).
Read more: Explore the ATT&CK map
-
Order these four real MITRE ATT&CK techniques, from pre-attack recon through an established C2 channel, by where their tactics fall in the Enterprise kill chain (earliest first).
Answer: T1595: Active Scanning T1583: Acquire Infrastructure T1136: Create Account T1105: Ingress Tool Transfer
Real MITRE ATT&CK kill-chain order: T1595 Active Scanning (Reconnaissance) → T1583 Acquire Infrastructure (Resource Development) → T1136 Create Account (Persistence) → T1105 Ingress Tool Transfer (Command and Control).
Read more: Explore the ATT&CK map
-
Order these five real MITRE ATT&CK techniques, from privilege escalation through to a ransomware-style impact, by where their tactics fall in the Enterprise kill chain (earliest first).
Answer: T1548: Abuse Elevation Control Mechanism T1021: Remote Services T1114: Email Collection T1071: Application Layer Protocol T1486: Data Encrypted for Impact
Real MITRE ATT&CK kill-chain order: T1548 Abuse Elevation Control Mechanism (Privilege Escalation) → T1021 Remote Services (Lateral Movement) → T1114 Email Collection (Collection) → T1071 Application Layer Protocol (Command and Control) → T1486 Data Encrypted for Impact (Impact).
Read more: Explore the ATT&CK map
-
Order these four real MITRE ATT&CK techniques, spanning stealth through exfiltration, by where their tactics fall in the Enterprise kill chain (earliest first).
Answer: T1027: Obfuscated Files or Information T1553: Subvert Trust Controls T1083: File and Directory Discovery T1567: Exfiltration Over Web Service
Real MITRE ATT&CK kill-chain order: T1027 Obfuscated Files or Information (Stealth) → T1553 Subvert Trust Controls (Defense Impairment) → T1083 File and Directory Discovery (Discovery) → T1567 Exfiltration Over Web Service (Exfiltration).
Read more: Explore the ATT&CK map