312-39V2: Certified SOC Analyst v2

Question

As a SOC Administrator at a mid-sized financial institution, you observed intermittent network slowdowns and unexplained high memory usage across multiple critical systems. Your initial analysis found no evidence of malware, but a forensic investigation uncovered unauthorized scheduled tasks that ran during off-peak hours. These tasks executed obfuscated scripts that connected to an external C2 server. Further investigation showed that the adversary had obtained access months earlier through a compromised VPN account, using credentials stolen in a phishing campaign. Which phase of the Advanced Persistent Threat (APT) lifecycle does this scenario correspond to?

Explanation

Persistence is the phase in which an adversary establishes a mechanism to retain and repeatedly regain execution or access after the initial compromise. Unauthorized scheduled tasks that execute obfuscated scripts during off-peak hours provide that recurring foothold; the VPN compromise and stolen phishing credentials describe the earlier intrusion vector.

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ45

Community Discussion