3 Attacks and Adversary Techniques Free Online FlashCards

What is a threat actor?

A person or group capable of causing harm. Threat actors include cybercriminals, nation-state groups, hacktivists, insiders, and opportunistic attackers.

In MITRE ATT&CK, how do tactics differ from techniques?

A tactic is the goal of an action; a technique is how an actor pursues that goal.

What may signal a credential attack?

Unusual sign-ins, repeated failed logins, unexpected MFA prompts, or logins from unfamiliar locations can be warning signs.

What can ransomware do besides encrypt data?

Ransomware encrypts data for extortion; incidents may also involve stealing data.

How does a denial-of-service attack disrupt a service?

They overwhelm a service with large volumes of traffic or requests, reducing its availability.

How do a vulnerability and an exploit differ?

A vulnerability is a weakness; an exploit is a method or code that takes advantage of that weakness.

How can CISA’s KEV Catalog help defenders?

It identifies vulnerabilities known to have been exploited and can help organizations prioritize remediation.

What is an indicator of compromise (IoC)?

A technical artifact or observable that suggests an attack may be underway or may already have occurred.

How does network segmentation limit an attack?

It restricts unnecessary connections, making it less likely that a compromise will spread to other systems.

How should organizations protect ransomware backups?

Keep backups offline and encrypted, and test restoration regularly. Accessible backups may also be targeted by ransomware.

Does every intrusion follow the same fixed sequence?

No. Real attacks may skip, repeat, or reorder stages.

How can a supply-chain compromise reach an organization?

It abuses a supplier, software update, or trusted service to reach downstream organizations.