All language subtitles for 1. Mitre Attack Interview Questions

So most times it happens in an interview.

That interview always asks the question related to Mr. Tech or maybe the cyber question so they can

be ask you the difference between the mightier attack and cyber chain, because, you know.

Well, we'll talk about it, right?

We'll talk about the difference in the upcoming videos.

So another issue.

So let me start with the what is exactly the media tech.

So if you search on Google, you will get it the this attack, right?

So actually, this is not an attack.

It's a double D and it means adversarial tactics, techniques and common knowledge.

Right.

So this is what attack?

And it is one of the framework which is a curated knowledge base and model for cyber adversary behavior,

reflecting the various phases of an adversary's attack lifecycle and the platform they are known to

target.

Now, what is to be in that if you already have our tactics, techniques and the procedures?

Right.

So these tips are nothing but the tactics, techniques and procedures.

And these are the behaviors, methods or patterns of activity used by threat actor or group of threat

actor.

So now our next question we have.

Can you explain tactics and technique?

So now what is tactics?

So tactics are movement with difficulty, statism, cunning action to achieve something right in a in

a short form or in simple language.

If I try to explain this tactics is is actually your goal, let's say initial access, right?

So getting some access, is this your goal?

Right, for what you are actually everything is doing.

Now, what is technique?

A technique is a way to find your goal, right?

To find your tactics.

So let's say a spear phishing.

Spear phishing through a spear phishing.

You are you are trying to.

Data.

Initial access in the organization.

So this is what tactics and techniques is difference actually.

So technique is a skill and knowledge of a given art or occupation.

Correct.

Now, next question we have which one you will prefer more TTP or IOC than Y?

Obviously, we we can see our tips are behavioral, right.

Whatever the bad actors are against the right actor is going to launch the attack tips depends directly

on those things that how actually on which phase what is actually happening right and IOC is nothing

but you can collect the indicators whatever the compromises is going to happen through that network,

through that at sorry, through that attack.

So if I talk about database behavior, right, behavioral based and IOC aesthetic ways.

So definitely if both are preferable, but more preferable is to be.

Have you remember our tactics in mightier attack?

So, yes, 14 there are 14 tactics and you can check all those 14 tactics on Google and you can learn

all those things that are actually working.

Right.

So they can ask you, so now what is defense evasion?

So defense evasion is one of the adversary which is trying to avoid being detected.

And for that, they use different different of techniques, let's say uninstalling disabling security

software, encrypting data and scripts.

So different, different there is different, different things you can actually go then on that attack

website.

Now what is position in miter and can you name some path where it maintains their foothold?

So mainly the path is merely on start of folders, maybe on the registries.

In the registries there will be a there we may be.

Definitely in the startup folders, maybe on the different, different phases.

And now what is the position actually?

So everybody is trying to maintain their foothold.

Right.

So once you gain all the privileges escalation.

So you have to maintain your access.

So for that, we use persistence.

And there are some techniques like boot or log on auto start execution.

There is also more you can you can directly.

I'm saying from the last one that you can actually go on that miter attack.

Go.

Our website.

What is lateral movement?

The adversary is trying to move through your environment.

Now here is the actual difference.

We'll talk about this difference because for that, we need a cyber kill chain.

We need to understand then only we can get to know all this difference.

So we'll talk about this in the next video.