Q: 7
Using open-source intelligence gathered from technical forums, a threat actor compiles and tests a
malicious downloader to ensure it will not be detected by the victim organization's endpoint security
protections. Which of the following stages of the Cyber Kill Chain best aligns with the threat actor's
actions?
Options
Discussion
Option D, It's Weaponization, not B-compiling and testing the payload is past recon stage. Trap here is thinking OSINT always means B.
C/D? Pretty sure D is correct, compiling and testing points to Weaponization, but OSINT mention could trip people up into picking B.
B tbh, saw a similar question in a practice set once and picked Reconnaissance because of the OSINT mention.
D , official guide and some practice tests cover these kill chain phases well.
Nah, I think B here. OSINT gathering feels like the trap choice in this scenario.
D
D . The compiling and testing part puts it squarely in Weaponization, since they're creating the malware with evasion in mind. B is tempting because of the OSINT from forums, but that's just prep data, not the main action. Saw a similar question on a practice set. Anyone disagree?
D or B depending on how you read it. The compiling and testing part is clearly Weaponization (D), but if the focus was just on gathering info using OSINT, then it'd fall under Reconnaissance (B). Here though, since they're building malware based on what they learned, I think D makes more sense. But it's one of those edge Kill Chain cases where wording really matters. Anyone see it different?
C. not D
C , since they're testing the downloader, feels like they're checking if it can exploit something. I know weaponization is close here but exploitation also covers where malware tries to beat defenses. Not totally sure though.
Be respectful. No spam.
