Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET)Security OperationsHard
A SOC analyst is performing threat hunting and discovers a suspicious PowerShell command executed on multiple endpoints. The command uses obfuscated techniques and attempts to establish an outbound connection to an unknown IP address on an unusual port. The analyst suspects this is part of a sophisticated, targeted attack. To understand the full scope and intent of the adversary, which threat intelligence framework would be most beneficial for structuring the investigation and categorizing the observed behaviors?
- AOpenIOC
- BSTIX/TAXII
- CMITRE ATT&CK
- DCVSS
Show answer & explanationAnswer & explanation
Correct answer: C. MITRE ATT&CK
MITRE ATT&CK is a knowledge base of adversary tactics and techniques based on real-world observations. It's highly beneficial for threat hunting and understanding adversary behavior, as it helps categorize observed actions (like obfuscated PowerShell, outbound connections) within a broader context of an attack chain, allowing analysts to understand the adversary's intent and identify other potential related activities.
Why the other options are wrong
- A. OpenIOC is a framework for defining and sharing Indicators of Compromise (IOCs), not for structuring adversary TTPs.
- B. STIX/TAXII are standards for sharing threat intelligence, not a framework for categorizing adversary behaviors.
- D. CVSS (Common Vulnerability Scoring System) is for rating vulnerability severity, not for describing adversary actions or TTPs.
MITRE ATT&CK Framework
A globally accessible knowledge base of adversary tactics and techniques based on real-world observations, used as a foundation for developing specific threat models and methodologies.
- Organizes adversary behaviors into tactics (goals) and techniques (how they achieve them).
- Aids in threat hunting, incident response, and security control mapping.
- Provides common language for describing adversary actions.
Memory trick: STIX share, OpenIOC identifies, ATT&CK maps, CVSS scores.