312-39V2: Certified SOC Analyst v2

Question

As a SOC L1 analyst, you learn that a critical infrastructure provider in your organization was attacked: threat actors infiltrated its network and exfiltrated sensitive system blueprints. Before their presence was detected, however, they ran a series of commands that altered system logs, wiped forensic artifacts, and changed timestamps to resemble normal activity. The adversary also ensured that no unusual login events were recorded by manipulating security monitoring tools. Which APT lifecycle phase does this represent?

Explanation

Cleanup is the APT lifecycle phase in which adversaries conceal their presence and impede investigation by removing or modifying evidence. Clearing or altering logs, deleting forensic artifacts, manipulating timestamps, and suppressing suspicious login records are forms of indicator removal and timestomping used to hide malicious activity.

Learn more

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ31

Community Discussion