Práctica CompTIA CySA+

A threat intelligence analyst at an MSP is documenting an intrusion with the Diamond Model. The team knows the malware family (a modified Cobalt Strike beacon) and the victim (a regional accounting client). They have not identified who is behind it or where the command servers are. Which Diamond Model vertices remain to be filled in, and which pivot is available first?

• AAdversary and Infrastructure are unfilled; pivot from the Capability vertex (the beacon configuration) to discover Infrastructure such as the C2 domains and IPs
• BCapability and Victim are unfilled; pivot from the Adversary vertex to identify the malware
• COnly Adversary is unfilled, because the Diamond Model treats infrastructure as part of Capability
• DInfrastructure and Victim are unfilled; pivot from the Adversary vertex using the malware's compile timestamp

Atajos de teclado: Desactivados