Linux

MITRE ATT&CK SOC Analyst Quiz

Section 2: Linux (Questions 21-40)

Analyze real-world Linux attack scenarios using auditd logs, crontabs, systemd services, kernel modules, and network captures. Map each attack to the MITRE ATT&CK framework.

How to Answer Each Question

For each scenario, you'll answer 5 components:

  1. Attacker Objective — What is the attacker trying to achieve?
  2. MITRE ATT&CK Tactic — Which tactic does this map to?
  3. Technique / Sub-technique — Which technique applies? (Includes the ID)
  4. Key Evidence — What specific evidence supports your mapping?
  5. Next Likely Step — What will the attacker do next?

Scoring

ComponentPoints
Attacker Objective1 point
Correct Tactic2 points
Correct Technique + ID3 points
Evidence Analysis2 points
Next Likely Step2 points

Maximum: 200 points (10 per question x 20 questions)