MITRE ATT&CK Technique for Redirecting Database Traffic

SY0-701 By islever Editorial Last updated

Given a scenario, analyze indicators of malicious activity.

Short answer

B Process injection is the listed MITRE ATT&CK technique most likely used to alter the compromised database server’s outbound behavior and redirect database traffic to the attacker-controlled server.

Question

A security analyst attempts to start a company's database server. When the server starts, the analyst receives an error message indicating the database server did not pass authentication. After reviewing and testing the system, the analyst receives confirmation that the server has been compromised and that attackers have redirected all outgoing database traffic to a server under their control. Which of the following MITRE ATT&CK techniques did the attacker most likely use to redirect database traffic?
  1. Browser extension
  2. Process injection Correct Answer
  3. Valid accounts
  4. Escape to host

Key Takeaways

The exam tests whether you separate initial access from the traffic-redirection mechanism; Valid Accounts may explain entry, but Process Injection best matches manipulation of the database process.

This SY0-701 question asks which MITRE ATT&CK technique best explains outbound database traffic redirection after a compromised server fails authentication. The answer is Process Injection (B), because it can alter the running database process's network behavior.

Common mistake: The plausible wrong choice is C, Valid Accounts, because the authentication error invites a credential explanation. Valid Accounts can explain how attackers got in, but it does not by itself redirect a running server's outgoing database connections.

Expert Analysis

The decisive qualifier is the redirection, not the login. The question says the analyst sees an authentication failure and later confirms compromise, but the actual ask is which MITRE ATT&CK technique was most likely used "to redirect database traffic." That wording eliminates any technique that only explains initial access or persistence. The authentication error is context; the redirection of all outbound database traffic is the observed effect the correct technique must explain.

Valid Accounts explains entry, not redirection. Option C, Valid Accounts (T1078), is the most tempting distractor because it fits the authentication symptom. A learner could argue that stolen credentials let the attacker reconfigure the server or its connection strings, and some comments do make that case. But credentials alone do not redirect a running process's outbound connections. Valid Accounts may be part of the intrusion chain, yet it is not the technique that directly accounts for the traffic being sent to an attacker-controlled server.

The other options are out of scope. Option A, Browser Extension (T1176), targets browser data and persistence; it has no meaningful role in a database server's outbound traffic. Option D, Escape to Host (T1611), requires a containerized workload and describes breaking out to the host; the scenario never mentions containers or host-level breakout.

Process Injection is the best fit among the choices. Option B, Process Injection (T1055), is the only listed technique that can alter a running database process's behavior, such as hooking or patching its network calls so its outbound sessions go to the attacker's server. That directly matches the observed redirection. It may not be the only possible ATT&CK label for traffic manipulation, but it is clearly the most likely of the four. Therefore, the correct answer is B.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When an ATT&CK question describes an effect such as redirection, isolate the verb: the question asks how the traffic was redirected, not how access was first obtained. Use that to discard Valid Accounts and other access-stage techniques unless the option directly changes the target process or network path. If two choices could belong to the same intrusion, pick the one tied to the observed effect—here, Process Injection for the database process's altered outbound behavior.

Frequently Asked Questions

Why is Valid Accounts wrong when the database server failed authentication?

Valid Accounts explains attackers using legitimate credentials to access systems, which could be part of the intrusion. The question asks what redirected the database traffic; credentials alone do not alter a running process's outbound connections, while Process Injection can.

Can Process Injection really redirect database traffic?

Process Injection (T1055) lets adversaries inject code into a legitimate process, which can hook or patch that process's network calls. That makes it the best fit among the four options for outbound database traffic being sent to an attacker-controlled server.

More SY0-701 FAQ →

Discussion 25 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 25

  1. jbmac 👍 9 Answered C
    The correct answer is: C. Valid accounts Explanation: The MITRE ATT&CK technique "Valid accounts" refers to the use of legitimate credentials (whether obtained through phishing, brute force, or other means) to gain unauthorized access to systems and services. In this case, the attacker likely leveraged valid credentials to compromise the database server and redirect outgoing traffic to a server they control. This technique involves using accounts that are already authorized to bypass security mechanisms and perform malicious actions without raising alarms.
  2. jacobtriestech 👍 6 Answered D
    Escape to host is a technique where an attacker gains unauthorized access to a system and then pivots to other systems within the network. In this case, the attacker gained access to the database server and then redirected its traffic to a controlled server. This indicates a successful escape to host.
  3. Eracle 👍 6
    It's wrong, valid accounts is in mitre ATT&CK!
  4. Hyper01 👍 5 Answered B
    Correct answer: B. Process injection Why: Redirecting a running database server’s outgoing connections to an attacker-controlled host most likely involves modifying the database process’s behavior (for example, hooking or patching its network calls or connection strings). That fits process injection (MITRE ATT&CK T1055) — an attacker injects code into the database process so it performs network actions of the attacker’s choosing. The other options don’t match the described technique: A (Browser extension): irrelevant to a DB server. C (Valid accounts): would let attackers authenticate, but wouldn’t by itself reroute traffic. D (Escape to host): describes breaking out of a container/VM to the host, not redirecting connections.
  5. laternak26 👍 5 Answered B
    Process injection is a technique where an attacker injects malicious code into a legitimate process to evade detection or alter the behavior of that process. In this case, the attackers could have injected code into a legitimate database process to redirect the database traffic. NOT C. Valid accounts because it is not even MITRE Technique. D. Espace to host means escaping from VM to Host not redirecting network traffic.
Show 20 more comments
  1. ProudFather 👍 5 Answered D
    An escape to host attack allows an attacker to break out of a sandboxed environment, such as a virtual machine or container, and gain access to the underlying host system. In this case, the attacker likely exploited a vulnerability in the database server's software or configuration to escape its security constraints and redirect network traffic.
  2. cda26aa 👍 4
    The MITRE ATT&CK technique most likely used by the attacker to redirect database traffic is B. Process injection. Here's why: Process injection involves injecting malicious code into a legitimate process, allowing the attacker to manipulate the process and redirect traffic without being detected by the operating system2. This technique can be used to intercept and redirect database traffic to a server under the attacker's control. Other options like browser extension, valid accounts, and escape to host are less likely to be directly involved in redirecting database traffic in this scenario.
  3. prabh1251 👍 4 Answered B
    Process injection is a technique where an attacker inserts malicious code into a legitimate process, which allows them to: ✅ Gain higher privileges. ✅ Manipulate the process’s behavior. ✅ Redirect traffic or steal data without detection. In this case: The attacker likely injected code into the database server process. This allowed them to redirect database traffic to a malicious server.
  4. VincentvdS 👍 4 Answered B
    Nice.. ChatGPT says B, CoPilot says C, Community says D.. Its nice if you add the answer of chatgpt in Copilot.. lol..
  5. 9ce65e3 👍 3 Answered B
    Analysis: Redirecting all outgoing database traffic to an attacker-controlled server requires manipulating the server’s behavior at a low level, such as altering network configurations, routing tables, or database processes. Process injection (B) is the most likely MITRE ATT&CK technique, as it allows attackers to inject code into a database process to redirect traffic (e.g., by modifying network calls or DNS resolution). Valid accounts (C) could enable initial access but doesn’t explain traffic redirection. Browser extension (A) is unrelated, and escape to host (D) is contextually inapplicable. The failure to pass authentication suggests tampering with the server’s integrity, further supporting process-level compromise. Final Answer: B. Process injection
  6. 9149f41 👍 3 Answered B
    Valid Accounts explains how the attacker gained access to the server. Process Injection explains how the attacker redirected traffic after gaining access. Both techniques are part of the attack chain, but Process Injection is the most relevant to the traffic redirection described in the scenario. Without Process Injection (or a similar technique), the attacker could not have redirected the traffic, even with valid credentials.
  7. 93bdd7c 👍 2 Answered C
    The attacker most likely used the Valid Accounts technique to redirect database traffic. This technique involves an attacker obtaining and using legitimate credentials to bypass authentication and gain access to systems, servers, or services. In this scenario, the error message suggests authentication failure, implying that attackers used valid credentials to reconfigure the server or its network settings, and then set up traffic redirection to exfiltrate data or reroute traffic to a malicious server under their control. Another possible technique that could have been used is Process Injection, which involves injecting malicious code into legitimate processes. This technique can be used to intercept and redirect database traffic to a server under the attacker’s control. However, based on the information provided, Valid Accounts is the most likely technique used by the attacker.
  8. Empath 👍 2 Answered B
    MITRE ATT&CK Options A. Browser extension Persistence technique, focused on stealing data from web browsers. Not related to redirecting database traffic. ❌ B. Process injection Attacker injects malicious code into a legitimate process to evade detection or run under trusted context. This could allow manipulation of how traffic is handled (e.g., tampering with database processes). ✅ (plausible) C. Valid accounts Attacker uses legitimate credentials for access. Explains compromise, but not traffic redirection. ❌ D. Escape to host Refers to breaking out of a virtual machine/container into the host OS. Not described in the scenario. ❌ Most Likely Answer: The attacker redirected database traffic by injecting malicious code into a running process (e.g., the DB service or networking process). This matches MITRE ATT&CK: Process Injection.
  9. srtysrhtyjumnuyedt 👍 2 Answered D
    D is correct. According to the MITRE ATT&CK framework: "Escape to Host Adversaries may break out of a container to gain access to the underlying host. This can allow an adversary access to other containerized resources from the host level or to the host itself. In principle, containerized resources should provide a clear separation of application functionality and be isolated from the host environment. [...] Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, accessing other containers running on the host, or setting up a command and control channel on the host."
  10. prabh1251 👍 2 Answered C
    Process Injection is a technique where attackers inject malicious code into legitimate processes, enabling them to intercept or redirect network traffic., what is Escape to Host? Escape to Host is a MITRE ATT&CK technique where: ✔️ An attacker breaks out of a sandboxed or virtualized environment (like a container or VM). ✔️ The goal is to gain control of the host machine — not just redirect traffic or compromise a service.
  11. b82faaf 👍 2 Answered C
    Valid accounts is a MITRE ATT&CK technique used in this case.
  12. BigCGeekn 👍 1 Answered C
    Why Valid Accounts? • Authentication Failure: The database server failing to start or throwing an authentication error points to a misconfigured, changed, or unauthorized credential state (such as modified root/administrator passwords or connection strings). • System Reconfiguration: Attackers leverage Valid Accounts to log into systems legitimately, alter network routing or database configuration files, and redirect traffic to an external command-and-control or collection server without needing to exploit a live software vulnerability.
  13. pindinga1 👍 1 Answered C
    The correct answer is C. Valid accounts. Valid accounts is a technique in the MITRE ATT&CK framework where attackers use stolen or compromised legitimate credentials to gain access to a system. In this case, the attackers likely used valid accounts to redirect outgoing database traffic to a server under their control, as they would have had the necessary privileges to modify the database configurations or intercept traffic without triggering alarms.
  14. dron_nuahs 👍 1 Answered D
    This type of attack is consistent with the Escape to hosttechnique in the MITRE ATT&CK framework, which involves attackers exploiting vulnerabilities or misconfigurations to escape from a compromised environment (e.g., a container or virtual machine) and gain control over the host system. Once they have control, they can manipulate network traffic, redirect data, or perform other malicious activities.
  15. lukascorpwork 👍 1 Answered D
    D. "Escape to host" is a privilege escalation or container breakout technique where an attacker, after compromising a virtualized or containerized system, gains control over the host machine. This would allow them to modify network settings, reroute traffic, and take control over database connections—exactly what happened in this case.
  16. itsgonnabemay 👍 1 Answered D
    "Valid Accounts" refers to an adversary leveraging legitimate credentials, while "Escape to Host" (or container escape) involves an adversary moving from a container to the host machine to gain broader access
  17. TIS2478 👍 1 Answered C
    Escape to host means you take first the control of a container before take the control of the host. Here the case is a database running on a server, not a container
  18. JoeRealCool 👍 1 Answered C
    It's valid accounts. The attacker used a valid account and changed the password, thus leading to the error message during authentication.
  19. b7e8d4f 👍 1 Answered D
    D. Escape the host is the correct answer
  20. 1chung 👍 1 Answered C
    I go with C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide