At what stage of the cyber kill chain theory model does data exfiltration occur?
A . Actions on objectives
B . Weaponization
C . installation
D . Command and control
Answer: D
Explanation:
cyber kill chain in this the command and control stage is the defender’s “last best chance” to block the operation: by blocking the Command and Control channel. If adversaries can’t issue commands, defenders can prevent impact. Typically, compromised hosts must beacon outbound to an Internet controller server to establish a Command & Control (aka C2) channel. APT malware especially requires manual interaction rather than conduct activity automatically. Once the C2 channel establishes, intruders effectively have “hands on the keyboard” access inside the target environment. Let’s remember that seldom is Malware automated, normally this command channel is manual. The general practice of intruders is:
Email C in, Web = Out. The trick for them is to have established the control over many work stations in an effort to “exfiltrate” data without setting off any anomalies or other monitoring applications based upon content, quantity, frequency, etc. Hence, the reason it is essential to have the proper tools in place that can identify, track, observe, stop and destroy these campaigns within your arsenal of capabilities.