Palo Alto Networks Certified Network Security Administrator (PCNSA)Cybersecurity FundamentalsMedium
A security analyst is investigating a series of unauthorized access attempts originating from a compromised internal workstation. The attacker appears to be attempting to move laterally within the network to gain access to a critical database server. Which stage of the Cyber Attack Kill Chain does this activity most closely represent?
- AAction on Objectives
- BWeaponization
- CInternal Reconnaissance
- DDelivery
Show answer & explanationAnswer & explanation
Correct answer: C. Internal Reconnaissance
Internal Reconnaissance involves an attacker, after gaining initial access, mapping out the internal network to identify valuable targets and vulnerabilities for lateral movement. The scenario describes an attacker attempting to move laterally to a critical database server, which aligns with this stage.
Why the other options are wrong
- A. Action on Objectives is the final stage where the attacker achieves their ultimate goals, such as data exfiltration or system destruction.
- B. Weaponization is the stage where the attacker combines an exploit with a backdoor into a deliverable payload.
- D. Delivery is the stage where the attacker transmits the weaponized payload to the target.
Internal Reconnaissance
The phase in a cyberattack where an attacker, having gained initial access to a network, actively explores the internal environment to identify valuable assets, vulnerabilities, and pathways for lateral movement.
- Occurs after initial compromise.
- Aims to map the internal network.
- Precedes lateral movement and action on objectives.
Memory trick: Remember the 'Kill Chain' as a step-by-step detective story.