A security team is performing incident response and wants to understand the full scope of an intrusion. Which concept describes the systematic process of using known compromised systems to identify additional compromised infrastructure?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because indicator pivoting uses artifacts from confirmed compromises (hashes, IPs, domains, registry keys, filenames) to search for the same indicators on other systems, revealing the full scope of the intrusion. A is wrong because threat modeling is a proactive design activity to identify potential threats before an incident.
Full explanation below image
Full Explanation
B is correct because indicator pivoting uses artifacts from confirmed compromises (hashes, IPs, domains, registry keys, filenames) to search for the same indicators on other systems, revealing the full scope of the intrusion. A is wrong because threat modeling is a proactive design activity to identify potential threats before an incident. C is wrong because vulnerability chaining is an offensive technique where multiple lower-severity vulnerabilities are combined for greater impact. D is wrong because adversary emulation is a red team technique that simulates specific threat actors, not an IR scoping method.