Classify Identity and Cloud Intrusion Patterns

Q1. Which pattern is best described as vishing, spearphishing, or impersonation aimed at help desk staff to reset passwords or transfer MFA tokens?
- Help desk social engineering
- Cloud valid account access
- Session token abuse
- Cloud infrastructure discovery
Answer: Help desk social engineering[[cite:1]]
Q2. Which pattern is most directly mapped to MITRE ATT&CK T1021.007 Remote Services: Cloud Services?
- Help desk social engineering
- Cloud valid account access
- Public-facing exploitation
- Cloud infrastructure discovery
Answer: Cloud valid account access[[cite:2]]
Q3. Which indicator most strongly suggests session-token abuse rather than password-based login?
- A successful sign-in that may have used browser cookies in a pass-the-cookie attack
- A help desk call asking for an MFA reset
- An AWS DescribeInstances request
- A terminal server with port 80 open
Answer: A successful sign-in that may have used browser cookies in a pass-the-cookie attack[[cite:3]]
Q4. What is the best analyst classification for an exposed terminal server or missing VPN requirement, when no exploit telemetry confirms compromise?
- Public-facing exploitation
- Cloud valid account access
- Cloud infrastructure discovery
- Help desk social engineering
Answer: Public-facing exploitation, but only as exposure evidence unless exploit telemetry confirms exploitation[[cite:4]][[cite:5]]
Q5. Which activity best fits cloud infrastructure discovery?
- Searching for VMware vCenter, backups, VPN instructions, repositories, certificates, source code, or AWS Systems Manager Inventory
- Resetting a password after a help desk call
- Logging in with a synchronized SSO account
- Using a browser cookie to reuse an authenticated session
Answer: Searching for VMware vCenter, backups, VPN instructions, repositories, certificates, source code, or AWS Systems Manager Inventory[[cite:6]]

to phish other accounts within the organization

Use Alternate Authentication Material: Web Session Cookie [T1550.004]

validate, test, and exercise their security controls

Classify Identity and Cloud Intrusion Patterns

Explore related topics