Question

A security analyst reviewing NetFlow data notices that an internal file server (10.10.5.12) is transferring large volumes of data to a single internal workstation (10.10.5.88) over SMB during off-hours. The workstation normally generates minimal traffic. No data has yet left the network perimeter, but the workstation's outbound connections to the internet remain flat. Based on the MITRE ATT&CK framework, which activity is MOST likely occurring?

Accepted Answer

Data staging in preparation for later exfiltration

Answer

Command and control beaconing to an external server

Answer

Active data exfiltration over an encrypted channel

Answer

Initial access via a phishing payload delivery