A security analyst is attempting to utilize the following threat intelligence for developing detection capabilities: APT X's approach to a target would be sending a phishing email to the target after conducting active and passive reconnaissance. Upon successful compromise, APT X conducts internal reconnaissance and attempts to move laterally by utilizing existing resources. When APT X finds data that aligns to its objectives, it stages and then exfiltrates data sets in sizes that can range from 1GB to 5GB. APT X also establishes several backdoors to maintain a C2 presence in the environment. In which of the following phases in this APT MOST likely to leave discoverable artifacts?
A) Data collection/exfiltration
B) Defensive evasion
C) Lateral movement
D) Reconnaissance

Question

Quizplus · Accepted Answer

APT X is most likely to leave discoverable artifacts during the data collection/exfiltration phase, as this involves staging and transferring data, which can be detected through network monitoring and data loss prevention tools.

A Security Analyst Is Attempting to Utilize the Following Threat