問題文
An analyst is asked to describe an intrusion using MITRE ATT&CK. The report needs to state both the attacker's objective at each step and the specific method used to reach it. How should the analyst apply the two levels that ATT&CK provides?
選択肢
- Tactics express the affected platform, and techniques express the detection rule that matched, so the pair records which sensor produced the alert.
- Tactics express the tools that the attacker ran, and techniques express the vulnerabilities that those tools exploited, so the pair identifies which patch would have stopped the step.
- Tactics express the objective of a step, such as gaining an initial foothold and techniques express the specific method used to reach that objective, such as abusing a remote service.
- Tactics express the severity of a step, such as how much damage it caused and techniques express the order in which the steps occurred, so the two together give a ranked timeline of the intrusion.