312-85 Threat Hunting And Detection Practice Test 3 — 15 Questions

Question 1

A threat hunter wants to detect adversaries abusing the Windows Management Instrumentation command-line utility to execute code on remote hosts during a hunt for lateral movement. Which artifact should the hunter prioritize to identify the remote execution attempt on the target machine?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Windows Security Event ID 4688 process creation records showing wmiprvse.exe spawning a child process such as cmd.exe or powershell.exe.. The most direct artifact of remote WMI code execution is the WMI provider host spawning an unexpected child process on the target. Process creation auditing that captures parent image and command line lets the hunter see wmiprvse.exe launching shells or scripting engines, which is difficult to explain as benign. Network-level RPC or logon events are supporting context but do not demonstrate execution.

Answer

Windows Security Event ID 5156 records showing inbound connections to TCP port 135 on the target host.

Answer

Windows Security Event ID 4703 records showing token privilege adjustments on the target host.

Answer

Windows Security Event ID 4624 logon records showing Logon Type 10 on the target host.

Question 2

A threat hunter is reviewing DNS query logs from a corporate recursive resolver to identify hosts that may be beaconing to a domain generation algorithm (DGA) family. The hunter notices that one workstation generates many queries for short, random-looking domains that all fail with NXDOMAIN, while another workstation generates far fewer queries but with a consistent subdomain string appended to a long-lived domain. Which observation most strongly indicates an active DGA-based beacon rather than normal application behavior?

Accepted Answer

A high volume of NXDOMAIN responses for algorithmically generated names from a single internal host.. DGA malware must try many generated domains before finding one the attacker registered, so the resolver sees a burst of NXDOMAIN answers for random-looking names from one host. Stable subdomains, private-space lookups, and popular resolving domains all occur in benign traffic, making them poor DGA indicators. Volume, randomness, and failure ratio together distinguish DGA beaconing.

Answer

Queries for popular public domains that resolve successfully and are repeated across many workstations.

Answer

A consistent subdomain string appended to a single long-lived domain queried at regular intervals.

Answer

Queries for domains that resolve to private RFC1918 address space from an internal host.

Question 3

A threat hunter is examining network traffic to identify potential command-and-control (C2) communication. Which characteristic of the traffic is most indicative of a C2 channel using HTTP?

Accepted Answer

Regular, periodic beaconing with consistent intervals. C2 communication often exhibits beaconing, where the malware periodically contacts the C2 server at regular intervals. This regular timing is a hallmark of automated C2 frameworks like Cobalt Strike or Metasploit. While other characteristics like encryption or port usage can be present, beaconing is the most consistent and specific indicator. Hunters should analyze network flow data for periodic connections to external hosts, especially those with consistent intervals and small data transfers.

Answer

Use of standard ports like 80 and 443

Answer

Encrypted payloads with self-signed certificates

Answer

Large outbound data transfers to a single external IP

Question 4

During a threat hunt for Kerberoasting, an analyst reviews Windows Security event logs and notices Event ID 4769 (Kerberos service ticket request) entries with RC4 encryption (0x17) for multiple service principal names from a single user account within a short window. Which additional context is most important to confirm malicious intent rather than benign service access?

Accepted Answer

The requesting account is a standard user who does not normally access those services, and the requests occur outside normal business hours.. Kerberoasting is possible for any authenticated user, so the reliable signal is behavioral: a low-privilege account requesting RC4 service tickets for many SPNs it never uses, often at odd hours. Target password length, responding DC identity, and default ticket lifetimes are normal environmental facts that do not distinguish abuse from routine Kerberos service access.

Answer

The service accounts associated with the requested SPNs have passwords longer than 25 characters.

Answer

The Kerberos ticket lifetime for the requested service tickets is set to the domain default of ten hours.

Answer

The domain controller that issued the tickets is the primary domain controller emulator.

Question 5

A threat hunter is investigating a suspected Kerberoasting attack. Which Windows event ID should the hunter analyze to identify service tickets being requested for accounts with Service Principal Names (SPNs)?

Accepted Answer

Event ID 4769. Kerberoasting involves requesting Kerberos service tickets for accounts with SPNs and then cracking them offline. Event ID 4769 is generated for each service ticket request. Hunters should look for a high volume of 4769 events, especially with encryption type 0x17 (RC4) and for services that are not normally accessed. This pattern indicates an attacker attempting to extract and crack service account credentials.

Answer

Event ID 4771

Answer

Event ID 4624

Answer

Event ID 4768

Question 6

A threat hunter is investigating a suspected data exfiltration channel that uses DNS tunneling. The organization's DNS logs capture query names, query types, response codes, and source hosts, but not full packet payloads. Which TWO characteristics of the DNS queries would most reliably indicate tunneling activity rather than normal DNS behavior? (Choose two.)

Accepted Answer

Unusually long and high-entropy subdomain labels encoded in the query name.. Without payload visibility, tunneling must be inferred from query shape and type: long, high-entropy subdomain labels carry encoded data, and sustained TXT queries from one host exploit a record type and volume that normal endpoints rarely produce. Popular A-record lookups, organization-wide NXDOMAIN noise, and internal PTR queries all match benign baselines and cannot isolate a tunneling channel.

Answer

Frequent NXDOMAIN responses for typo-like domain names across the entire organization.

Answer

Queries that use the A record type for well-known public domains from many different hosts.

Answer

Periodic PTR record queries for internal RFC1918 addresses from a single host.

Question 7

A threat hunter is reviewing PowerShell operational logs collected via Windows Event Forwarding and notices Event ID 4104 entries that contain a script block defining a function which, when invoked, calls System.Net.WebClient.DownloadString with a hard-coded IP address and then passes the returned content to Invoke-Expression. The parent process is winword.exe. Which hunting conclusion is most defensible?

Accepted Answer

The script block logging captured a defensible indicator of a macro-driven download-and-execute chain that warrants escalation and endpoint containment.. The combination of de-obfuscated script block content, a download cradle using System.Net.WebClient, execution through Invoke-Expression, a hard-coded IP, and Office parentage forms a coherent attack chain that a hunter can defend. Escalation is warranted because the telemetry captures both intent and mechanism.

Answer

The event should be ignored because Event ID 4104 only records the script's file path and never the actual code that ran.

Answer

The event proves a remote code execution vulnerability in Word was exploited, because winword.exe parentage always indicates memory corruption exploitation.

Answer

The event is benign because Script Block Logging only fires for scripts run through the PowerShell ISE, and Word cannot launch the ISE in this manner.

Question 8

A hunter is reviewing Zeek conn.log and notices long-lived, low-volume TLS sessions from several internal workstations to the same external IP on port 443 where the server certificate is self-signed, the JA3S value is identical across all sessions, and the byte counts are almost symmetric over hours. The workstations show no matching DNS queries for that IP and no proxy logs because the traffic bypasses the proxy. Which hypothesis best fits this evidence?

Accepted Answer

The pattern is consistent with beaconing to hard-coded C2 infrastructure using a custom TLS profile, and the hunter should pivot on the JA3S value and destination IP.. Direct-to-IP TLS with a self-signed certificate, a uniform JA3S fingerprint, and steady low-volume symmetric sessions indicates a beacon using a custom TLS profile. Pivoting on the server fingerprint and destination IP lets the hunter find other affected hosts and confirm the campaign before remediation.

Answer

The traffic represents normal HTTPS browsing because port 443 is used and the sessions are encrypted end to end.

Answer

A sanctioned software update service is being reached over a direct TLS channel that bypasses the proxy by design.

Answer

The sessions indicate a misconfigured internal service because self-signed certificates are only used inside an organization's own address space.

Question 9

A threat hunter is examining Sysmon telemetry on a workstation and sees an svchost.exe process whose image path is C:\Users\Public\svchost.exe, whose parent is explorer.exe, and which has an unsigned binary with no version information. Which hunting assessment is most appropriate?

Accepted Answer

The process is likely a masquerading binary executing from an unusual path with a user-mode parent, and the hunter should triage it as a probable malicious implant.. Legitimate svchost.exe must run from System32, carry a Microsoft signature, and be parented by services.exe. A signed-absent copy in a user-writable directory with explorer.exe as parent violates all three invariants, making masquerading the strongest hypothesis and warranting immediate triage.

Answer

The process is a legitimate third-party application because explorer.exe is the standard parent for all user-launched programs.

Answer

The process indicates a Windows service misconfiguration that requires only a registry repair on the host.

Answer

This is a benign service host because svchost.exe is a legitimate Windows component and its presence alone is not suspicious.

Question 10

A threat hunter is investigating possible data staging prior to exfiltration on a file server. The hunter has full Windows Security auditing, Sysmon, and PowerShell logging available. Which TWO telemetry patterns most directly indicate that an adversary is staging and compressing collected data on the host? (Choose two.)

Accepted Answer

A single process creating a large number of file read operations across many directories within a short window, followed by writes to one new archive file.. Staging is characterized by broad collection followed by consolidation into a single archive, and by archiving that deviates from normal administrative patterns. Reading many directories then writing one archive, and creating an encrypted archive with a non-standard extension from a web server parent, both directly evidence that behavior.

Answer

Repeated DNS queries from the server to a single external domain at irregular intervals with varying query types.

Answer

A high volume of failed authentication attempts against the file server from multiple internal workstations.

Answer

Scheduled tasks created by the built-in backup service account to copy files to a known backup share each night.

Question 11

A threat hunter is asked to determine whether a suspected intrusion involved beaconing over HTTPS to an external command-and-control server. The organization has full network metadata but no TLS interception. Which hunting approach is most appropriate to identify beaconing behavior without decrypting traffic?

Accepted Answer

Analyze connection periodicity, duration, and byte-count symmetry for repeated sessions to the same external destination.. Without TLS interception, beaconing is best detected through traffic metadata: regular connection intervals, consistent session durations, and stable payload sizes to the same external destination. SNI, certificates, and DNS cache entries reveal naming and authentication details but not application data, and encrypted HTTP response codes are not observable, so metadata periodicity analysis is the appropriate method.

Answer

Correlate HTTP response codes from the external server with the internal host's DNS cache entries.

Answer

Decode the TLS certificate chain presented by each external server to read the encrypted application data.

Answer

Inspect the Server Name Indication field to recover the plaintext contents of each HTTPS request.

Question 12

A threat hunter wants to detect adversaries abusing the Windows Management Instrumentation command-line utility to execute code on remote hosts during a hunt for lateral movement. Which artifact should the hunter prioritize to identify the remote execution attempt on the target machine?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Monitor Sysmon Event ID 1 for schtasks.exe process creation with create arguments and correlate the resulting task file creation in the Windows Tasks directory.. Correlating schtasks.exe process creation with the task definition file written under the Windows Tasks directory captures both the act of creating persistence and the resulting artifact. This dual-signal approach is more reliable than any single event type and matches the telemetry the hunter already has enabled.

Answer

Monitor Sysmon Event ID 7 for image loads by svchost.exe from non-standard directories.

Answer

Monitor Sysmon Event ID 12 and 13 for registry modifications to the Run key under HKCU.

Answer

Monitor Sysmon Event ID 3 for network connections from taskeng.exe to external addresses.

Question 13

A threat hunter is reviewing Sysmon event logs to detect credential dumping. The hunter observes that a process opened lsass.exe with access rights 0x1410 and then created a memory dump file. Which Sysmon event ID and field combination is most directly relevant for detecting this activity?

Accepted Answer

Event ID 10 (ProcessAccess) with the GrantedAccess field equal to 0x1410 and TargetImage pointing to lsass.exe.. Sysmon Event ID 10 (ProcessAccess) captures when a process opens another process with specific access rights. A GrantedAccess value of 0x1410 on lsass.exe indicates an attempt to read LSASS memory, a common technique for credential dumping. This event provides the direct evidence needed to detect such activity, unlike process creation or file creation events that lack the access mask detail.

Answer

Event ID 1 (Process Create) with the CommandLine field containing 'lsass.exe'.

Answer

Event ID 7 (Image Loaded) with the ImageLoaded field referencing a DLL loaded into lsass.exe.

Answer

Event ID 11 (FileCreate) with the TargetFilename field ending in '.dmp'.

Question 14

A threat hunter is examining network flow data to detect potential lateral movement using the SMB protocol. The hunter notices a series of connections from a single workstation to multiple servers on port 445, each followed by a short-lived session. Which analysis technique would best help identify this as malicious lateral movement?

Accepted Answer

Use frequency analysis to identify workstations connecting to an unusually high number of distinct servers on port 445 within a short time window.. Lateral movement using SMB often manifests as a single source connecting to many destinations on port 445 in a short time, indicative of scanning or spreading. Frequency analysis of destination IPs per source can highlight such anomalous patterns. Other techniques like throughput analysis or dialect inspection may not capture the breadth of connections that signal lateral movement.

Answer

Inspect the SMB dialect negotiated in each session and flag sessions using SMBv1, as it is inherently malicious.

Answer

Monitor for SMB sessions that transfer files with extensions like .exe or .dll, as these are always malicious.

Answer

Calculate the average bytes per second for each SMB session and flag sessions with unusually high throughput.

Question 15

A threat hunter is analyzing Windows event logs to detect an adversary using scheduled tasks for persistence. The hunter wants to identify tasks created with a hidden setting. Which event ID and field should the hunter focus on?

Accepted Answer

Event ID 4698 (A scheduled task was created) and the 'Hidden' element in the task XML.. Windows Security Event ID 4698 records the creation of scheduled tasks and includes the full XML definition. The <Hidden> element in the XML is a direct indicator of a task configured to be hidden, a common technique for persistence. Other events like process creation or task updates lack this specific attribute, making them less effective for detecting hidden tasks.

Answer

Event ID 4702 (A scheduled task was updated) and the 'TaskName' field containing suspicious strings.

Answer

Event ID 4688 (A new process has been created) and the 'ParentProcessName' field showing 'schtasks.exe'.

Answer

Event ID 106 (Task Scheduler operational log) and the 'TaskScheduler' provider.