During triage you review an EDR alert on a finance workstation: 'rundll32.exe loaded a signed but unusual DLL from C:\Users\Public, then spawned a connection to a known content delivery domain'. Your team maps every observation to MITRE ATT&CK. Which mapping BEST fits the rundll32 behaviour observed here?
- AInitial Access via T1566 Phishing, because the workstation belongs to a finance user who is a common phishing target
- BExfiltration via T1041 Exfiltration Over C2 Channel, because a network connection to an external domain was observed
- CDefense Evasion via T1218 System Binary Proxy Execution, because a trusted signed Windows binary is being abused to run the payload Correct
- DPersistence via T1547 Boot or Logon Autostart Execution, because the DLL was loaded from a public writable folder
Why A is wrong: Tempting because finance users are phished often, but the evidence shows post-execution binary abuse, not a delivery vector, so mapping to phishing invents a tactic the artefact does not establish.
Why B is wrong: Tempting because an outbound connection is present, but a single connection to a CDN domain is not evidence that data left the host, so keying exfiltration overreads the artefact.
Why C is correct: Correct: rundll32 is a legitimate signed system binary abused to proxy execution of an attacker DLL, which is exactly the living-off-the-land pattern ATT&CK catalogues under T1218.
Why D is wrong: Tempting because a writable path suggests staging, but nothing shows a run key, service, or startup entry, so persistence is a technique the evidence does not support.