[Handling and Responding to Malware Incidents] An attacker traced out and found the kind of websites a target company/individual is frequently…

The scenario describes a classic watering hole attack. This is a targeted attack strategy where an adversary profiles a specific group or individual to discover websites they frequently visit. The attacker then compromises one of these legitimate sites, injecting malicious code. The adversary waits for the target to visit the trusted, but now compromised, "watering hole," which then infects the target's system with malware. The described steps—profiling the target, compromising a frequented website, and waiting for the victim to access it—are the defining characteristics of this attack type.

B. Obfuscation application: Obfuscation is a technique used to make malicious code unreadable to evade detection, not the name of the attack methodology itself.
C. Directory traversal: This is a specific web server vulnerability that allows an attacker to access restricted directories. It could be the method used to compromise the site, but it is not the overall attack strategy.
D. Cookie/Session poisoning: This attack involves manipulating session data (like cookies) to impersonate a user or escalate privileges, which is different from the malware delivery method described.

1. MITRE ATT&CK® Framework. (2023). Drive-by Compromise, Technique T1189. MITRE. Retrieved from https://attack.mitre.org/techniques/T1189/. The framework states, "A drive-by compromise is when a user is infected with malware by visiting a website... A watering hole is a type of drive-by compromise, where the adversary targets a specific group of users by compromising a website they are known to visit."

2. National Institute of Standards and Technology (NIST). (n.d.). Glossary: Watering Hole Attack. Computer Security Resource Center. Retrieved from https://csrc.nist.gov/glossary/term/wateringholeattack. NIST defines a watering hole attack as "A targeted attack strategy in which an attacker guesses or observes which websites an organization often uses and infects one or more of them with malware."

3. Lee, R. M., & Assante, M. J. (2015). The Industrial Control System Cyber Kill Chain. SANS Institute. In the Reconnaissance phase description (page 6), the paper mentions attackers identifying "watering holes—websites that their targets frequent" as a key step in preparing for targeted attacks.