CompTIA · CySA+ CS0-004
Attack methodology frameworks
CySA+ CS0-004 · Lesson 17 of 22 · 2:29:49
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the CySA+ CS0-004 exam (CompTIA Cybersecurity Analyst (CySA+)). In this lesson: the Cyber Kill Chain and its seven steps, the Diamond Model of Intrusion Analysis and pivoting, MITRE ATT&CK version 20 and its fifteen tactics, including stealth and defense impairment, and ATT&CK Navigator layers for detection coverage. Includes three original practice questions.
Preview the topics
- An analyst finds that the command server’s domain was also used against two other credit unions last month, and uses it to find a second malware sample. Which framework describes this pivoting between features?
- The EDR stopped the loader right after it was installed, before it could open any channel to the attacker. At which kill chain step was the attack broken?
- A detection engineer wants to know which techniques of a ransomware group the SOC can detect, and to show the gaps to management in one colored view. What should the engineer use?