Which term describes the adversary collecting as much data as possible, including sensitive employee and customer data, business tactics, and financial information, for exfiltration or destruction?

Which term describes the adversary collecting as much data as possible, including sensitive employee and customer data, business tactics, and financial information, for exfiltration or destruction?

• A. Data Staging
• B. IoCs
• C. Use of Web Shell
• D. Use of Web Shell Detection

Answer: (A)

Data staging is the phase where an attacker gathers data from across the network and brings it to a central location in preparation for exfiltration or destruction. The goal is to consolidate as much sensitive information as possible—employee and customer data, financial records, internal tactics, and other valuable data—in a single spot so it can be easily copied out or wiped. This preparatory step makes the exfiltration process more efficient and increases the potential impact of the attack, since the attacker has a ready cache of target data. Indicators of Compromise (IoCs) are signs that malicious activity has occurred or is occurring; they’re measurements or artifacts like unusual IPs, file hashes, or domain names used by attackers. A web shell is a backdoor the attacker uploads to a web server to maintain access, not specifically about collecting data. Detecting a web shell is about finding that backdoor, not about the attacker’s data collection behavior.

Data staging is the phase where an attacker gathers data from across the network and brings it to a central location in preparation for exfiltration or destruction. The goal is to consolidate as much sensitive information as possible—employee and customer data, financial records, internal tactics, and other valuable data—in a single spot so it can be easily copied out or wiped. This preparatory step makes the exfiltration process more efficient and increases the potential impact of the attack, since the attacker has a ready cache of target data.

Indicators of Compromise (IoCs) are signs that malicious activity has occurred or is occurring; they’re measurements or artifacts like unusual IPs, file hashes, or domain names used by attackers. A web shell is a backdoor the attacker uploads to a web server to maintain access, not specifically about collecting data. Detecting a web shell is about finding that backdoor, not about the attacker’s data collection behavior.