46. A threat intelligence analyst is updating a document according to the MITRE ATT&CK framework. The analyst detects the following behavior from a malicious actor: 'The malicious actor will attempt to achieve unauthorized access to the vulnerable system.' In which of the following phases should the analyst include the detection?
Answer: C
The detection should be included in the Tactics phase.
The detection of unauthorized access attempts by a malicious actor falls under the Tactics phase of the MITRE ATT&CK framework. This phase encompasses the overarching goals and objectives of the adversary, which includes gaining unauthorized access to systems.
A) Procedures
Procedures refer to the specific methods or steps taken by adversaries to execute their techniques. While procedures are important for understanding how threats are carried out, they do not encompass the broader strategic objectives of the malicious actor, making this option incorrect.
B) Techniques
Techniques describe the various ways adversaries achieve their tactics. Although unauthorized access is a technique that may be employed, the question specifically asks about the phase to include the detection, which is broader than just the techniques themselves; thus, this option is not the correct answer.
C) Tactics
Tactics represent the high-level goals of the adversary, such as gaining unauthorized access to a system. Since the analyst detected behavior indicative of an attempt to achieve this goal, it is appropriate to include the detection in the Tactics phase, confirming this as the correct choice.
D) Subtechniques
Subtechniques provide more granular details about how a specific technique is executed. While they offer valuable insight into specific methods used by adversaries, the detection of unauthorized access attempts aligns more closely with the overall tactical objective rather than the finer details of execution, making this option incorrect.
Conclusion
Including the detection of unauthorized access in the Tactics phase is essential as it aligns with the overarching goals of malicious actors, emphasizing their intent to breach systems. The other options focus on execution methods or detailed steps that do not capture the strategic nature of the detected behavior, thereby failing to address the core concept of tactical objectives within the MITRE ATT&CK framework.