TryHackMe - Actions on Objectives (Exfiltration) (Cyber Kill Chain) | SOC Analyst 1


After going through six phases of the attack, "Megatron" can finally achieve his goals, which means taking action on the original objectives. With hands-on keyboard access, the attacker can achieve the following: 

  • Collect the credentials from users.
  • Perform privilege escalation (gaining elevated access like domain administrator access from a workstation by exploiting the misconfiguration).
  • Internal reconnaissance (for example, an attacker gets to interact with internal software to find its vulnerabilities).
  • Lateral movement through the company's environment.
  • Collect and exfiltrate sensitive data.
  • Deleting the backups and shadow copies. Shadow Copy is a Microsoft technology that can create backup copies, snapshots of computer files, or volumes. 
  • Overwrite or corrupt data.
Answer the question below
Can you provide a technology included in Microsoft Windows that can create backup copies or snapshots of files or volumes on the computer, even when they are in use? Shadow Copy

Comments