Considering the following example, what MITRE ATT&CK tactic would you use to complete the workflow?

The provided Falcon Fusion SOAR workflow example shows a trigger based on anIdentity Detection, followed by conditions and actions that search for recently logged-in users and related entities across endpoints. According to the CCIS curriculum, this type of workflow aligns with theLateral Movementtactic in the MITRE ATT&CK framework.

Lateral Movement involves an attacker moving from one system or account to another after initial access has been achieved. The workflow’s logic—correlating identity detections with additional users and endpoints—supports identifying and responding to movement across the environment using compromised or abused credentials.

The other tactics do not best fit this scenario:

Initial Access occurs earlier in the attack chain.

Credential Access focuses on obtaining credentials.

Privilege Escalation centers on increasing access rights.

Because the workflow is designed to detect and respond tomovement between systems and identities,Option C (Lateral Movement)is the correct and verified answer.