Surveillance & Intelligence Gathering Flashcards

What is the key difference between an Indicator of Compromise (IOC) and an Indicator of Attack (IOA)?

Answer: IOCs identify artifacts of past compromises while IOAs identify attacker behaviors in progress

IOCs (file hashes, IPs, domains) indicate a compromise has already occurred, whereas IOAs focus on real-time behaviors and TTPs that indicate an attack is actively underway.

Which surveillance concept describes the practice of correlating data from multiple independent sources to increase confidence in an intelligence assessment?

Answer: All-source fusion

All-source fusion combines intelligence from HUMINT, SIGINT, OSINT, and technical feeds to produce higher-confidence assessments than any single source could provide.

An attacker enumerates subdomains of a target by brute-forcing common names against the DNS server. Which tool is specifically designed for this purpose?

Answer: Amass

Amass is an open-source attack surface mapping tool that performs subdomain enumeration through DNS brute force, scraping, and certificate transparency log analysis.

In the Diamond Model of Intrusion Analysis, which four core features are connected to represent a single intrusion event?

Answer: Adversary, capability, infrastructure, victim

The Diamond Model places adversary, capability, infrastructure, and victim at the four vertices of a diamond to represent the fundamental relationships in any intrusion event.

Which technique allows an attacker to passively monitor Wi-Fi traffic on a network they are not associated with by placing a wireless adapter in monitor mode?

Answer: Packet capture via promiscuous mode on wireless

Placing a wireless adapter in monitor mode allows it to capture all 802.11 frames within radio range regardless of the destination MAC address, enabling passive surveillance of unencrypted Wi-Fi traffic.

What is the purpose of 'pivoting' in the context of internal network reconnaissance after initial compromise?

Answer: Using a compromised host as a relay to reach and scan otherwise inaccessible network segments

Pivoting leverages a foothold host as a proxy or tunnel to route attacker traffic into network segments that are not directly reachable from the internet.

Which legal authority in the United States governs the collection of foreign intelligence through electronic surveillance conducted inside the country?

Answer: Foreign Intelligence Surveillance Act (FISA)

FISA establishes the legal framework and oversight procedures for electronic surveillance conducted within the US for foreign intelligence purposes, including the FISA Court approval process.