Question

Refer to the exhibit. What distinguishes the procedures used by each APT group?

Accepted Answer

D. The first APT group used the Plink utility to create an SSH tunnel, and the second group executed the sc utility via PowerShell to enumerate active services on the domain controller.

Answer

The first APT group used the Plink utility for the inter-beacon communication over the HTTPS, and the second group executed the sc utility to create multistage C2 channels.

Answer

The first APT group executed the Plink utility for the signed binary proxy execution, and the second group used the sc utility to exfiltrate data over alternative protocols.

Answer

The first APT group executed the sc utility via PowerShell to enumerate active services on the domain controller, and the second group used the Plink utility to create an SSH tunnel.