Question
A malicious actor has gained access to an internal network by means of social engineering. The actor does not want to lose access in order to continue the attack. Which of the following best describes the current stage of the Cyber Kill Chain that the threat actor is currently operating in?
- A. Weaponization
- B. Reconnaissance
- C. Delivery
- D. Exploitation Correct
Explanation
In the Cyber Kill Chain, reconnaissance, weaponization and delivery all happen before the attacker gets in; once the social engineering lure has worked and the actor has gained access to the network, the attack has reached exploitation. Of the options given, exploitation is the only stage that matches an actor who already has a foothold and is working to keep it. Reconnaissance is information gathering, weaponization is building the payload, and delivery is sending it to the target, all of which are already complete here.
