Question 321 · 607 in bank
A security analyst attempts to start a company's database server. When the server starts, the analyst receives an error message indicating the database server did not pass authentication. After reviewing and testing the system, the analyst receives confirmation that the server has been compromised and that attackers have redirected all outgoing database traffic to a server under their control. Which of the following MITRE ATT&CK techniques did the attacker most likely use to redirect database traffic?
Show answer
Answer: C
Explanation
The correct answer is: C. Valid accounts Explanation: The MITRE ATT&CK technique "Valid accounts" refers to the use of legitimate credentials (whether obtained through phishing, brute force, or other means) to gain unauthorized access to systems and services. In this case, the attacker likely leveraged valid credentials to compromise the database server and redirect outgoing traffic to a server they control. This technique involves using accounts that are already authorized to bypass security mechanisms and perform malicious actions without raising alarms.
Source: Adapted from community discussion — jbmac