macOS

MITRE ATT&CK SOC Analyst Quiz

Section 3: macOS (Questions 41-60)

Analyze real-world macOS attack scenarios using ESF logs, LaunchAgent plists, TCC database entries, and endpoint telemetry. Map each attack to the MITRE ATT&CK framework.

How to Answer Each Question

For each scenario, you'll answer 5 components:

  1. Attacker Objective — What is the attacker trying to achieve?
  2. MITRE ATT&CK Tactic — Which tactic does this map to?
  3. Technique / Sub-technique — Which technique applies? (Includes the ID)
  4. Key Evidence — What specific evidence supports your mapping?
  5. Next Likely Step — What will the attacker do next?

Scoring

ComponentPoints
Attacker Objective1 point
Correct Tactic2 points
Correct Technique + ID3 points
Evidence Analysis2 points
Next Likely Step2 points

Maximum: 200 points (10 per question x 20 questions)