Cisco CyberOps Associate (CBROPS) 200-201Security MonitoringHard
A security analyst discovers several new, unauthorized user accounts with administrative privileges created on a critical database server. Audit logs show these accounts were created shortly after a successful 'SQL query containing xp_cmdshell' from an external IP address. What phase of the cyber kill chain does the creation of these new accounts represent?
- AInstallation
- BActions on Objectives
- CWeaponization
- DReconnaissance
Show answer & explanationAnswer & explanation
Correct answer: B. Actions on Objectives
The creation of new administrative accounts after gaining access (via 'xp_cmdshell') directly facilitates an attacker's goals within the compromised system, such as ensuring persistence or further data manipulation. This falls under 'Actions on Objectives' in the Cyber Kill Chain, where the attacker achieves their actual goals.
Why the other options are wrong
- A. Installation focuses on establishing persistent access mechanisms (e.g., backdoors), but creating new admin accounts is more directly working towards the attacker's ultimate goal.
- C. Weaponization is combining an exploit with a backdoor into a deliverable payload, not account creation.
- D. Reconnaissance is about gathering information before an attack, not creating accounts post-exploitation.
Cyber Kill Chain - Actions on Objectives
The 'Actions on Objectives' phase of the Cyber Kill Chain encompasses the steps an attacker takes to achieve their ultimate goals after gaining access to a target system, such as data exfiltration, destruction, or gaining further control.
- Occurs after successful exploitation and installation.
- Involves activities like data theft, privilege escalation, lateral movement, or system sabotage.
- Directly aligns with the attacker's original intent.
- Detection focuses on monitoring for unusual data access, command execution, or configuration changes.
Memory trick: The Kill Chain is like a step-by-step guide for an attacker's journey.