Câu 15: CCFR-201: CrowdStrike Certified Falcon Responder

Within the MITRE-Based Falcon Detections Framework, what is the correct way to interpret Keep Access > Persistence > Create Account?

1. A. An adversary is trying to keep access through persistence by creating an account — đáp án hiện tại
2. B. An adversary is trying to keep access through persistence using browser extensions
3. C. An adversary is trying to keep access through persistence using external remote services
4. D. An adversary is trying to keep access through persistence using application skimming