312-39 Cyber Threats Iocs And Attack Methodology — Timed 25 Questions

Question 1

During an investigation of an APT, you observe a process executing from C:\Users\Public\ and reaching out to a suspicious domain. Which TTP from the MITRE ATT&CK framework is primarily being demonstrated?

25 minute time limit — choose an answer to begin.

Accepted Answer

T1547: Boot or Logon Autostart Execution. Running binaries from non-standard user-writable directories is a common technique for persistence or execution within a compromised environment.

Answer

T1059: Command and Scripting Interpreter

Answer

T1105: Ingress Tool Transfer

Answer

T1204: User Execution

Question 2

In a Windows environment, which artifact would provide the best evidence of 'Lateral Movement' using Pass-the-Hash?

Accepted Answer

Security Event ID 4624 (Logon Type 9). Pass-the-Hash relies on NTLM authentication, making Security Event ID 4624 (type 9) the most reliable indicator.

Answer

Registry key creation in RunOnce

Answer

Prefetch file modification

Answer

DNS query logs

Question 3

During an incident response, a SOC analyst observes that a compromised host is periodically resolving a domain that was registered three days ago and has no reputation data. The domain resolves to an IP address that also hosts a legitimate content delivery network (CDN) service. Which technique is the attacker most likely using to evade detection?

Accepted Answer

Domain fronting by leveraging the CDN's TLS SNI and HTTP Host header mismatch. Domain fronting allows an attacker to hide the true destination behind a CDN by using a legitimate domain in the TLS SNI while the HTTP Host header specifies the attacker's domain. The new domain resolving to a CDN IP that also hosts legitimate services is a strong indicator of this technique, as it blends malicious traffic with benign CDN traffic.

Answer

Fast flux by rapidly changing the domain's A records across many IP addresses

Answer

DNS tunneling by encoding command-and-control data in DNS query names

Answer

Use of a domain generation algorithm (DGA) to create many pseudorandom domains

Question 4

During an investigation, an analyst finds that a user's Outlook client spawned a child process of powershell.exe with an encoded command line, and the parent process no longer exists. Which attack technique does this behavior most directly indicate?

Accepted Answer

Spearphishing link exploiting a client-side vulnerability. Outlook directly generating a PowerShell child process with an encoded command is characteristic of a client-side exploit delivered through a phishing link or crafted message, where code execution occurs inside the mail client and then hands off to a scripting interpreter. Macro-based delivery would show an Office application as the parent, and credential dumping or scheduled-task persistence would leave different process and artifact traces.

Answer

Credential dumping from the LSASS process memory

Answer

Scheduled task created for persistence

Answer

Spearphishing attachment delivering a malicious macro

Question 5

A threat hunter notices that on several endpoints, a signed Microsoft binary located in System32 spawned a child process that wrote a file to a user's Startup folder and then exited. The parent process path is legitimate, and the file's signature is valid. Which technique does this most likely represent, and what is the key artifact for confirming it?

Accepted Answer

Signed binary proxy execution, confirmed by correlating the parent process command line with the child process's file creation event. A trusted, signed System32 binary launching a child process that drops a file into a Startup folder fits signed binary proxy execution. The confirming artifact is the linkage between the parent's command line and the child's file creation event, which ties the trusted binary to the persistence action. Other techniques do not match the observed file-write behavior.

Answer

Masquerading via renamed binary, confirmed by comparing the file's hash against a known-good baseline

Answer

Scheduled task creation, confirmed by inspecting the Task Scheduler operational log for task registration events

Answer

Process injection, confirmed by examining the parent process's memory for unbacked executable regions

Question 6

A SOC analyst is investigating a suspected phishing campaign. Which TWO of the following artifacts are most indicative of a malicious document exploiting a client-side vulnerability? (Choose two.)

Accepted Answer

A Windows Event Log entry showing winword.exe spawning cmd.exe. The two artifacts that directly indicate a malicious document exploiting a client-side vulnerability are a Word document with a macro executing PowerShell and a process creation event showing winword.exe spawning cmd.exe. Both demonstrate code execution resulting from opening a document. The other options represent delivery methods or post-exploitation activity, not the exploitation of a document vulnerability itself.

Answer

An email attachment with a double extension, such as invoice.pdf.exe

Answer

An email with a link to a legitimate cloud storage service hosting a PDF

Answer

A firewall log showing an outbound connection to a known malicious IP on port 4444

Question 7

You are analyzing a packet capture (PCAP) and find a beaconing pattern with a consistent 30-second interval and jitter of 5%. Which detection strategy is most effective for this IoC?

Accepted Answer

Frequency analysis on connection flow metadata. A beaconing pattern with a consistent 30-second interval and 5% jitter is best detected through frequency analysis on connection flow metadata, since the regularity of the timing is the defining characteristic. Analyzing flow records (NetFlow, Zeek conn.log) for periodic connections to the same destination reveals the beacon regardless of payload encryption. This approach detects the behavior rather than relying on known signatures or IPs.

Answer

Port-based blocking

Answer

Signature-based IDS alert

Answer

Static IP blocklisting

Question 8

An analyst notices a spike in outbound traffic to a known sinkhole IP address. What does this indicate?

Accepted Answer

A compromised host attempting to reach a C2. A sinkhole IP is a controlled address that security teams or law enforcement redirect malicious traffic to, typically to neutralize botnet C2 communications. When an internal host repeatedly attempts to contact a known sinkhole IP, it strongly indicates the host is infected with malware that is trying to reach its command-and-control server. This is a classic indicator of compromise (IoC) for a C2 channel.

Answer

An attempted DDoS attack

Answer

A network misconfiguration

Answer

A successful data exfiltration

Question 9

A SOC analyst is reviewing logs in a SIEM and notices multiple failed login attempts followed by a successful one from an unknown IP. Which specific IoC category does this activity represent?

Accepted Answer

Unauthorized access attempt. Multiple failed login attempts followed by a successful login from an unknown IP is a textbook indicator of unauthorized access — specifically a brute-force or password-spraying attack that eventually succeeded. This pattern is categorized as an unauthorized access attempt IoC because it shows an attacker gained access without authorization. The sequence of failures then success is the key signature.

Answer

Data exfiltration indicator

Answer

Network anomaly signature

Answer

System resource exhaustion

Question 10

You are tracking a threat actor who uses 'Living off the Land' (LotL) techniques. Which of the following commands is a classic indicator of this methodology?

Accepted Answer

powershell.exe -enc JABz.... Living off the Land (LotL) techniques use legitimate, pre-installed system tools to carry out attacks, avoiding the need to drop custom malware. 'powershell.exe -enc JABz...' is a classic LotL indicator: it uses the built-in PowerShell interpreter with a Base64-encoded command (-enc) to obfuscate malicious activity. This allows attackers to execute code without introducing foreign binaries.

Answer

malware.exe

Answer

mimikatz.exe

Answer

netcat.exe

Question 11

A system administrator reports high CPU usage on a server. Upon checking task manager, you find 'svchost.exe' running from a temp folder. What is the most immediate action?

Accepted Answer

Isolate the host from the network. The presence of svchost.exe running from a temp folder is a classic indicator of a process masquerading attack, where malware names itself after a legitimate Windows process to evade detection. The most immediate action is to isolate the host from the network to prevent lateral movement, data exfiltration, or command-and-control communication. Containment must precede any remediation or investigation to avoid tipping off the attacker or allowing further damage.

Answer

Delete the file

Answer

Update antivirus signatures

Answer

Restart the server

Question 12

Which of the following describes the 'Reconnaissance' phase in the Cyber Kill Chain?

Accepted Answer

Scanning for open ports and services. The Reconnaissance phase of the Cyber Kill Chain (Lockheed Martin's seven-phase model) is the first stage, where the adversary gathers information about the target before launching an attack. Scanning for open ports and services is a classic active reconnaissance technique (e.g., using nmap or masscan) that maps the attack surface and identifies exploitable services. This aligns with the phase's goal of intelligence gathering to inform later weaponization and delivery stages.

Answer

Deploying a remote access trojan

Answer

Exploiting a software vulnerability

Answer

Encrypting data for ransom

Question 13

Which of the following is considered a 'Network-based' IoC?

Accepted Answer

Suspicious domain name. A suspicious domain name is a network-based indicator of compromise because it appears in DNS queries, HTTP/TLS SNI, or proxy logs — artifacts observable on the network. Network IoCs include IPs, domains, URLs, and JA3 hashes.

Answer

Mutex name

Answer

Registry key path

Answer

File hash (SHA-256)

Question 14

You are investigating an incident involving a malicious macro embedded in an Excel document. Which Windows process is typically the 'parent' of the malicious payload execution?

Accepted Answer

excel.exe. When a user opens an Excel document with a malicious macro, Excel.exe executes the VBA, and any spawned payload (e.g., PowerShell, cmd, or a dropped executable) is a child process of excel.exe. Thus excel.exe is the parent process in the process tree.

Answer

explorer.exe

Answer

wininit.exe

Answer

svchost.exe

Question 15

A user complains that their browser homepage has changed. Upon inspection, you find a new, unsigned extension installed. Which attack methodology is this?

Accepted Answer

Browser Hijacking. Browser hijacking is the class of attack where malicious code or an unwanted extension modifies browser settings — homepage, default search engine, new-tab page, or redirects — without the user's consent. The scenario (changed homepage plus a new unsigned extension) is the textbook signature of browser hijacking. The unsigned extension is the delivery/persistence mechanism, and the homepage change is the observable symptom.

Answer

Man-in-the-Middle (MitM)

Answer

Cross-Site Scripting (XSS)

Answer

SQL Injection

Question 16

Which TWO of the following are primary goals of the 'Command and Control' (C2) phase?

Accepted Answer

Obtaining instructions from the threat actor. Option A is correct because the Command and Control (C2) phase is defined by the compromised host receiving tasking and instructions from the threat actor's C2 infrastructure, enabling the attacker to direct post-exploitation activity. Option C is correct because C2 specifically requires establishing and maintaining a persistent communication channel (often over HTTP/HTTPS, DNS, or other protocols) between the implant and the attacker-controlled server so commands and results can flow reliably. Option B is not a C2 goal; exploiting a zero-day vulnerability belongs to the initial exploitation phase that precedes C2. Option D is not a C2 goal; gathering system information is part of reconnaissance or discovery, which occurs before or alongside C2 but is not its defining objective. Option E is not a C2 goal; encrypting files for ransom is the impact/actions-on-objectives stage of ransomware, distinct from establishing command and control.

Answer

Exploiting a zero-day vulnerability

Answer

Gathering system information

Answer

Encrypting files for ransom

Question 17

During a forensic analysis, you find a 'shimcache' entry indicating an executable ran from a volume that no longer exists. What does this suggest?

Accepted Answer

Use of removable media or virtual volumes. Shimcache (AppCompatCache) records metadata about executables that were present on the system, including the volume path from which they executed. An entry referencing a volume that no longer exists (e.g., a drive letter or GUID not currently mounted) strongly suggests the executable ran from removable media (USB drive) or a virtual/mounted volume that has since been detached. This is a classic indicator of tool execution from external media.

Answer

Memory corruption

Answer

Log manipulation

Answer

System update failure

Question 18

Which TWO of the following are considered indicators of a 'Data Exfiltration' attempt?

Accepted Answer

Increased DNS request volume (DNS Tunneling). Option D is correct because DNS tunneling is a classic data exfiltration technique: malware encodes stolen data into DNS queries (often TXT, NULL, or CNAME records) sent to an attacker-controlled authoritative name server, so a sudden spike in DNS request volume—especially long or high-entropy subdomain labels—signals data being smuggled out through port 53. Option E is correct because exfiltration inherently requires outbound transfer, and a high volume of outbound traffic to an unfamiliar or foreign IP address (particularly over common ports like 80/443 or via protocols such as FTP/SMTP) indicates data being sent to an external command-and-control or collection server. Option A does not belong because multiple failed logins indicate a brute-force or password-guessing attempt (an access/authentication attack), not the transfer of data out of the environment. Option B does not belong because system clock synchronization errors point to NTP misconfiguration or time drift, which is a reliability/availability issue rather than evidence of data theft. Option C does not belong because installing new system drivers is a host configuration or persistence/rootkit-related change, not an indicator of outbound data exfiltration.

Answer

Multiple failed login attempts

Answer

System clock synchronization errors

Answer

Installation of new system drivers

Question 19

Which THREE of the following are characteristics of 'Advanced Persistent Threat' (APT) attack methodologies?

Accepted Answer

Custom-tailored malware and tools. Option A is correct because APT actors develop custom-tailored malware, exploits, and tooling specific to the target environment rather than relying solely on commodity or off-the-shelf malware, which helps them evade signature-based detection. Option B is correct because APTs are defined by a long-term commitment to a specific objective, often persisting for months or years while pursuing espionage, intellectual property theft, or strategic access rather than a one-off hit. Option C is correct because APTs emphasize a high degree of stealth and low-and-slow activity, using techniques like living-off-the-land binaries, long dwell times, and minimal footprint to avoid triggering alerts. Option D is not correct because automated mass-scale scanning is characteristic of opportunistic, untargeted attacks (e.g., worms or botnet scanning), not the deliberate, targeted reconnaissance of an APT. Option E is not correct because immediate data destruction is not a defining APT trait; APTs typically prioritize stealthy, prolonged access and exfiltration, and destructive actions (if any) usually come at the end of the campaign.

Answer

Automated mass-scale scanning

Answer

Immediate data destruction

Question 20

Which THREE of the following are commonly monitored artifacts for detecting 'Persistence' mechanisms?

Accepted Answer

Windows Scheduled Tasks. Windows Scheduled Tasks (B) are a classic persistence artifact because an attacker can register a task that re-executes malware at logon, on a schedule, or at system startup, and defenders monitor task creation (e.g., Event ID 4698 and the \Windows\System32\Tasks folder) to detect it. Registry Run keys (D), such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\...\Run, are monitored because any value placed there causes a program to launch automatically at user logon or system boot, a well-known autostart persistence location. System startup folder files (E), in paths like %AppData%\Microsoft\Windows\Start Menu\Programs\Startup and the all-users equivalent, are monitored because shortcuts or executables dropped there execute automatically at logon. Network interface throughput (A) is a performance/availability metric, not a persistence artifact, and browser history logs (C) reflect user web activity rather than mechanisms that ensure code re-executes after reboot or logon.

Answer

Network interface throughput

Answer

Browser history logs