An attacker creates a scheduled task on a compromised server that automatically reopens a backdoor connection every time the system restarts, ensuring access even after reboots.
Which phase of a cyber attack does this represent?
Before launching an attack, the adversary scans the organization’s public-facing website, social media accounts, and employee LinkedIn profiles to identify staff names, technologies used, and possible login portals.
Which phase of a cyber attack does this represent?
After breaching a user account, the attacker uses that access to move into the company’s internal network and accesses other servers with more valuable data.
Which phase of a cyber attack does this represent?
The attacker gains entry into a system by tricking an employee into clicking a malicious link in a phishing email, which downloads malware.
Which phase of a cyber attack does this represent?
To prevent being noticed, the attacker disguises malicious traffic as normal user behavior and deletes system logs that would reveal their activities.
Which phase of a cyber attack does this represent?
After moving through the network, the attacker exfiltrates a large set of customer data and uploads it to an external server under their control.
Which phase of a cyber attack does this represent?