312-85 Threat Hunting And Detection — 25 Questions

Question 1

When conducting a hunt for lateral movement using MITRE ATT&CK T1021.001 (Remote Desktop Protocol), which log source is most effective for detecting anomalous RDP connections?

Accepted Answer

Microsoft-Windows-TerminalServices-LocalSessionManager/Operational Event ID 21. The Microsoft-Windows-TerminalServices-LocalSessionManager/Operational log provides specific evidence of session authentication and connection events.

Answer

System Event ID 7045

Answer

Security Event ID 1102

Answer

Security Event ID 4624

Question 2

While hunting for hidden network traffic, you identify anomalous 'Beacon' activity in the proxy logs. Which metric is the most effective way to filter out normal traffic noise?

Accepted Answer

Response size variance. By filtering on low-entropy and uniform intervals, analysts can isolate beacons from human-generated web traffic.

Answer

HTTP User-Agent strings

Answer

DNS lookup failure counts

Answer

Source IP addresses

Question 3

When hunting for credential dumping using Mimikatz, which process memory access pattern is the most common indicator?

Accepted Answer

Access to lsass.exe. Mimikatz typically attempts to access LSASS.exe with specific access masks to read memory.

Answer

Access to csrss.exe

Answer

Access to svchost.exe

Answer

Access to explorer.exe

Question 4

A threat hunter wants to identify unauthorized DNS tunneling. Which data point is most indicative of this activity?

Accepted Answer

High volume of TXT record queries. Extremely high volumes of TXT or NULL record queries are classic indicators of DNS tunneling for data exfiltration.

Answer

Low volume of DNS failures

Answer

High volume of A record queries

Answer

Frequent SRV record updates

Question 5

You are hunting for Cobalt Strike C2 using JA3/JA3S fingerprinting. If the JA3S value is unique for your environment and observed across multiple hosts, what does this suggest?

Accepted Answer

It indicates a specific C2 listener implementation. A unique JA3S value in a specific environment often points to a specific server-side implementation of a C2 listener.

Answer

The connection is encrypted with an expired certificate

Answer

The client has been compromised

Answer

It is a standard browser connection

Question 6

An analyst is investigating potential persistence via WMI event subscriptions. Which WMI namespace should the hunter focus on for suspicious event consumers?

Accepted Answer

root\subscription. The root\subscription namespace stores the classes (EventFilter, EventConsumer, FilterToConsumerBinding) used to execute malicious payloads.

Answer

root\default

Answer

root\security

Answer

root\cimv2

Question 7

A threat hunter is using Sysmon to identify potential process hollowing. Which Event ID should the analyst prioritize in their hunting query?

Accepted Answer

Event ID 8. Event ID 8 (CreateRemoteThread) is a primary indicator of process hollowing, where a process injects code into another process.

Answer

Event ID 1

Answer

Event ID 11

Answer

Event ID 3

Question 8

During an investigation, you observe suspicious PowerShell execution with the -EncodedCommand flag. Which log provider should you consult to see the decoded script block content?

Accepted Answer

Microsoft-Windows-PowerShell/Operational ID 4104. The Microsoft-Windows-PowerShell/Operational log (Event ID 4104) captures the full script block text, even if obfuscated or encoded.

Answer

System Event ID 7040

Answer

Application Event ID 1000

Answer

Security Event ID 4688

Question 9

While using ELK Stack for threat hunting, you need to identify beaconing behavior. Which aggregation function would best reveal periodicity in connection intervals?

Accepted Answer

Standard deviation on interval deltas. Calculating the variance or standard deviation of time intervals between connections (the 'delta') is the standard method for identifying programmatic beaconing.

Answer

Sum aggregation on connection counts

Answer

Min/Max aggregation on bytes

Answer

Cardinality count on source IPs

Question 10

You are hunting for unauthorized scheduled tasks. Which PowerShell cmdlet allows you to audit these tasks remotely across the enterprise?

Accepted Answer

Get-ScheduledTask. Get-ScheduledTask is the standard management cmdlet for listing and inspecting scheduled tasks in Windows.

Answer

Get-Service

Answer

Get-Process

Answer

Get-WmiObject Win32_StartupCommand

Question 11

Which hunting methodology involves starting with a known adversary tactic and working backward to identify evidence in your logs?

Accepted Answer

Hypothesis-driven hunting. Hypothesis-driven hunting starts with a theory or a TTP and searches for evidence to confirm or deny it.

Answer

Incident response forensics

Answer

Machine learning-based hunting

Answer

Alert-driven hunting

Question 12

When hunting for malicious DLL side-loading, which file property is most critical to verify?

Accepted Answer

Code signing certificate. Side-loading relies on a legitimate binary loading a malicious DLL with the same name as a required dependency from a different directory.

Answer

File extension

Answer

Creation timestamp

Answer

File size

Question 13

While hunting for living-off-the-land (LotL) binaries, you identify suspicious use of 'certutil.exe'. What is the most likely malicious purpose for this utility?

Accepted Answer

Downloading remote payloads. Certutil.exe is frequently abused to download files from remote URLs using the -urlcache -split -f flags.

Answer

Extracting browser passwords

Answer

Clearing event logs

Answer

Modifying system registry keys

Question 14

Which tool is most effective for visualizing the parent-child process relationships during a threat hunt?

Accepted Answer

Process Explorer. Sysinternals Process Explorer is the industry standard for viewing hierarchical process structures (tree view).

Answer

Resource Monitor

Answer

PowerShell ISE

Answer

Wireshark

Question 15

A hunt for unusual Kerberos activity reveals an 'AS-REP Roasting' attack. What specific event indicator should the analyst look for in domain controller logs?

Accepted Answer

Event ID 4768 with pre-auth not required. AS-REP Roasting targets accounts that do not require Kerberos pre-authentication.

Answer

Event ID 4771

Answer

Event ID 4624

Answer

Event ID 4769

Question 16

An analyst is hunting for unauthorized network connections. Which port is commonly associated with SMB, frequently used for lateral movement (e.g., PSExec)?

Accepted Answer

Port 445. TCP Port 445 is the standard port for SMB/CIFS, which is essential for lateral movement tools like PSExec.

Answer

Port 80

Answer

Port 3389

Answer

Port 22

Question 17

When conducting a hunt for 'Golden Ticket' attacks, which attribute should be checked for anomalies in the Kerberos ticket?

Accepted Answer

Ticket lifetime (e.g., 10 years). The ticket lifetime and the account SID are key indicators; Golden Tickets often use a fake domain admin SID.

Answer

Domain controller name

Answer

Client IP address

Answer

Ticket encryption algorithm

Question 18

Which TWO log sources are most essential when hunting for adversary use of living-off-the-land binaries (LotL)?

Accepted Answer

Sysmon Event ID 1. Security logs (4688) capture process launches with command lines, while Sysmon (Event ID 1) provides the parent-child context and hash data.

Answer

System Event Log (Event ID 7045)

Answer

DHCP Server logs

Answer

DNS Query logs

Question 19

Which TWO artifacts are most important when investigating a possible 'Fileless Malware' infection?

Accepted Answer

PowerShell Script Block Logging. Fileless malware resides in memory or the registry, so WMI and PowerShell logs are primary sources.

Answer

File System MFT records

Answer

Browser Cache History

Answer

Windows Update logs

Question 20

Which THREE techniques are commonly associated with the 'Execution' phase of the MITRE ATT&CK framework and should be prioritized in a threat hunt?

Accepted Answer

PowerShell Script Execution. PowerShell, WMI, and Scheduled Tasks are the most common vectors for adversary code execution on Windows systems.

Answer

ARP Spoofing

Answer

DNS Tunneling