An organization experienced a security breach that allowed an attacker to send fraudulent wire transfers from a hardened PC exclusively to the attacker's bank through remote connections. A security analyst is creating a timeline of events and has found a different PC on the network containing malware. Upon reviewing the command history, the analyst finds the following: PS>.\mimikatz.exe "sekurlsa::pth /user:localadmin /domain:corp-domain.com /ntlm:B4B9B02E1F29A3CF193EAB28C8D617D3F327 Which of the following best describes how the attacker gained access to the hardened PC?

The command sekurlsa::pth /user:localadmin /domain:corp-domain.com /ntlm:B4B9B02E1F29A3CF193EAB28C8D617D3F327 is a classic example of a pass-the-hash (PtH) attack using Mimikatz. This command allows an attacker to authenticate to a service or system using the NTLM hash of a user's password, rather than the plaintext password itself. The presence of localadmin suggests a shared support account, which is often targeted in such attacks due to its widespread privileges. The attacker likely compromised a less secure machine, extracted the NTLM hash for the localadmin account, and then used this hash to authenticate to the "hardened PC" without needing the actual password. Incorrect options: Fileless malware hosted by the banking platform is not indicated by the Mimikatz command. Living-off-the-land binaries (LOLBins) are legitimate system tools used maliciously, but Mimikatz is a dedicated credential-dumping tool, not typically classified as a LOLBin. Social engineering is a possibility for initial access, but the command specifically details a technical post-exploitation technique, not the social engineering itself.