312-39 Cyber Threats Iocs And Attack Methodology — 10 Questions

Question 1

During an investigation of an APT, you observe a process executing from C:\Users\Public\ and reaching out to a suspicious domain. Which TTP from the MITRE ATT&CK framework is primarily being demonstrated?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

T1547: Boot or Logon Autostart Execution. Running binaries from non-standard user-writable directories is a common technique for persistence or execution within a compromised environment.

Answer

T1059: Command and Scripting Interpreter

Answer

T1105: Ingress Tool Transfer

Answer

T1204: User Execution

Question 2

You are analyzing a packet capture (PCAP) and find a beaconing pattern with a consistent 30-second interval and jitter of 5%. Which detection strategy is most effective for this IoC?

Accepted Answer

Frequency analysis on connection flow metadata. Beaconing with jitter is a hallmark of C2 communication designed to evade simple threshold-based detection.

Answer

Port-based blocking

Answer

Signature-based IDS alert

Answer

Static IP blocklisting

Question 3

In a Windows environment, which artifact would provide the best evidence of 'Lateral Movement' using Pass-the-Hash?

Accepted Answer

Security Event ID 4624 (Logon Type 9). Pass-the-Hash relies on NTLM authentication, making Security Event ID 4624 (type 9) the most reliable indicator.

Answer

Registry key creation in RunOnce

Answer

Prefetch file modification

Answer

DNS query logs

Question 4

An analyst notices a spike in outbound traffic to a known sinkhole IP address. What does this indicate?

Accepted Answer

A compromised host attempting to reach a C2. Sinkholes are used by security researchers to intercept traffic from infected hosts that are trying to contact a C2 domain.

Answer

An attempted DDoS attack

Answer

A network misconfiguration

Answer

A successful data exfiltration

Question 5

A SOC analyst is reviewing logs in a SIEM and notices multiple failed login attempts followed by a successful one from an unknown IP. Which specific IoC category does this activity represent?

Accepted Answer

Unauthorized access attempt. This behavior is a classic indicator of a brute-force attack or credential stuffing attempt.

Answer

Data exfiltration indicator

Answer

Network anomaly signature

Answer

System resource exhaustion

Question 6

You are tracking a threat actor who uses 'Living off the Land' (LotL) techniques. Which of the following commands is a classic indicator of this methodology?

Accepted Answer

powershell.exe -enc JABz.... LotL techniques use built-in system tools like PowerShell or WMI to execute malicious actions, avoiding the need for custom malware.

Answer

malware.exe

Answer

mimikatz.exe

Answer

netcat.exe

Question 7

A system administrator reports high CPU usage on a server. Upon checking task manager, you find 'svchost.exe' running from a temp folder. What is the most immediate action?

Accepted Answer

Isolate the host from the network. Identifying a process running from a suspicious location like Temp is a high-confidence IoC for malware.

Answer

Delete the file

Answer

Update antivirus signatures

Answer

Restart the server

Question 8

Which of the following describes the 'Reconnaissance' phase in the Cyber Kill Chain?

Accepted Answer

Scanning for open ports and services. Reconnaissance involves gathering information to identify vulnerabilities before launching an attack.

Answer

Deploying a remote access trojan

Answer

Exploiting a software vulnerability

Answer

Encrypting data for ransom

Question 9

Which of the following is considered a 'Network-based' IoC?

Accepted Answer

Suspicious domain name. Network-based IoCs include IP addresses, domain names, and URLs associated with malicious activity.

Answer

Mutex name

Answer

Registry key path

Answer

File hash (SHA-256)

Question 10

You are investigating an incident involving a malicious macro embedded in an Excel document. Which Windows process is typically the 'parent' of the malicious payload execution?

Accepted Answer

excel.exe. When a malicious macro runs, it often triggers 'cmd.exe' or 'powershell.exe' from the 'excel.exe' process tree.

Answer

explorer.exe

Answer

wininit.exe

Answer

svchost.exe