Understanding Cyber Threats, IoCs, and Attack Methodology
Understanding Cyber Threats, IoCs, and Attack Methodology
This domain tests whether you can reason about who attacks, how they progress, and what evidence they leave. Know the threat actor taxonomy: nation-state/APT (patient, well-resourced, espionage), organized crime (financially motivated, ransomware), hacktivist (ideological, defacement/DDoS), insider (authorized access, hardest to detect), and script kiddie (commodity tooling).
Map activity to the Cyber Kill Chain (recon → weaponization → delivery → exploitation → installation → C2 → actions on objective) and to MITRE ATT&CK tactics/techniques. The Kill Chain is linear and defensive-friendly; ATT&CK is behavior-based and better for detection mapping. Questions often ask which stage a given event belongs to.
Indicators of Compromise (IoCs) are artifacts suggesting intrusion: hashes, malicious domains/IPs, registry keys, unusual parent-child process relationships, beaconing traffic. Distinguish IoCs from Indicators of Attack (IoA), which describe behavior/intent (e.g., credential dumping) and are more durable than atomic IoCs. Remember the pyramid of pain: hash < IP < domain < network artifact < tool < TTP - higher levels hurt adversaries more.
Traps: calling phishing the "exploitation" stage (it is usually delivery); treating an IP blocklist as durable defense (attackers rotate infrastructure); assuming IoCs equal compromise (they are leads requiring validation); and confusing vulnerability with exploit with payload.
Rule of thumb: If the artifact changes every campaign, it is a low-value IoC. If it describes how the adversary operates, it is a TTP and worth detecting.
Worked example: A user opens a malicious attachment that runs a macro and beacons to a rare domain. Delivery = email attachment; exploitation = macro execution; installation/C2 = beaconing. The beacon domain is an IoC; the macro-execution pattern is a TTP.