312-85 Threat Hunting And Detection — Timed 10 Questions

Question 1

When conducting a hunt for lateral movement using MITRE ATT&CK T1021.001 (Remote Desktop Protocol), which log source is most effective for detecting anomalous RDP connections?

Accepted Answer

Microsoft-Windows-TerminalServices-LocalSessionManager/Operational Event ID 21. The Microsoft-Windows-TerminalServices-LocalSessionManager/Operational log provides specific evidence of session authentication and connection events.

Answer

System Event ID 7045

Answer

Security Event ID 1102

Answer

Security Event ID 4624

Question 2

A threat hunter is using Sysmon to identify potential process hollowing. Which Event ID should the analyst prioritize in their hunting query?

Accepted Answer

Event ID 8. Event ID 8 (CreateRemoteThread) is a primary indicator of process hollowing, where a process injects code into another process.

Answer

Event ID 1

Answer

Event ID 11

Answer

Event ID 3

Question 3

When hunting for malicious DLL side-loading, which file property is most critical to verify?

Accepted Answer

Code signing certificate. Side-loading relies on a legitimate binary loading a malicious DLL with the same name as a required dependency from a different directory.

Answer

File extension

Answer

Creation timestamp

Answer

File size

Question 4

While hunting for hidden network traffic, you identify anomalous 'Beacon' activity in the proxy logs. Which metric is the most effective way to filter out normal traffic noise?

Accepted Answer

Response size variance. By filtering on low-entropy and uniform intervals, analysts can isolate beacons from human-generated web traffic.

Answer

HTTP User-Agent strings

Answer

DNS lookup failure counts

Answer

Source IP addresses

Question 5

When conducting a hunt for 'Golden Ticket' attacks, which attribute should be checked for anomalies in the Kerberos ticket?

Accepted Answer

Ticket lifetime (e.g., 10 years). The ticket lifetime and the account SID are key indicators; Golden Tickets often use a fake domain admin SID.

Answer

Domain controller name

Answer

Client IP address

Answer

Ticket encryption algorithm

Question 6

Which THREE techniques are commonly associated with the 'Execution' phase of the MITRE ATT&CK framework and should be prioritized in a threat hunt?

Accepted Answer

PowerShell Script Execution. PowerShell Script Execution (B) is a canonical ATT&CK Execution technique (T1059.001) because adversaries use powershell.exe to run payloads, downloaders, and post-exploitation scripts directly on a host. WMI Event Subscription (C) is also an Execution technique (T1546.003) since attackers register permanent WMI event consumers/filters to trigger malicious code automatically when specified events occur. Scheduled Task Creation (D) belongs to Execution (T1053.005), as schtasks.exe or the Task Scheduler service is abused to launch programs at defined times or triggers. ARP Spoofing (A) is a Collection/credential-access-adjacent network technique (T1557.002), and DNS Tunneling (E) is a Command and Control/exfiltration technique (T1071.004), so neither is categorized under Execution.

Answer

ARP Spoofing

Answer

DNS Tunneling

Question 7

To effectively hunt for C2 communication, which THREE indicators should be monitored in your proxy or firewall logs?

Accepted Answer

High frequency of connections (beaconing). Option A is correct because C2 implants typically beacon at regular intervals, so proxy/firewall logs showing a high frequency of repeated connections to the same destination (e.g., every 60 seconds) are a strong hunting indicator. Option B is correct because newly registered domains (young domain age, often days or weeks old) are frequently used for C2 infrastructure, and correlating destination domains with low domain age in logs helps surface malicious callbacks. Option E is correct because consistent or anomalous User-Agent strings across many connections to the same host can reveal automated C2 traffic, especially when the same User-Agent appears in regular beaconing patterns. Option C is not the best indicator here because traffic volume spikes are more associated with data exfiltration or bulk transfer than with the low-and-slow beaconing typical of C2. Option D is not appropriate because TCP window size changes are a host/network stack behavior seen in packet captures, not a reliable field monitored in proxy or firewall logs for C2 hunting.

Answer

Traffic volume spikes

Answer

TCP Window size changes

Question 8

A threat hunter is analyzing Windows event logs to detect pass-the-hash attacks. Which TWO event IDs are most indicative of this technique when observed together? (Choose two.)

Accepted Answer

Event ID 4672 (Special privileges assigned to new logon). Pass-the-hash attacks typically generate a network logon (Event ID 4624 Type 3) because the attacker uses the stolen NTLM hash to authenticate to a remote system via SMB or WMI. If the compromised account has administrative rights, Event ID 4672 will also be logged, showing special privileges assigned. The combination of these two events, especially when the source is unusual, is a strong indicator of pass-the-hash lateral movement.

Answer

Event ID 4625 (An account failed to log on)

Answer

Event ID 4768 (A Kerberos authentication ticket was requested)

Answer

Event ID 4624 with Logon Type 10 (RemoteInteractive)

Question 9

A hunter is reviewing Sysmon telemetry on a workstation suspected of hosting an implant that maintains persistence through a scheduled task. The hunter wants to identify the moment the task was created or modified, not merely when it executed. Which Sysmon event should the hunter prioritize to capture the creation or modification of the scheduled task?

Accepted Answer

Sysmon Event ID 11, FileCreate, filtered for files written under C:\Windows\System32\Tasks.. Scheduled tasks exist as XML files under the Tasks directory, so a FileCreate event for that path records the installation or modification regardless of the creation method. Filtering process creation for schtasks.exe only catches command-line creation, while network connect and image load events describe runtime behavior, not the moment persistence was written to disk.

Answer

Sysmon Event ID 7, ImageLoad, filtered for modules loaded by the Task Scheduler service.

Answer

Sysmon Event ID 1, ProcessCreate, filtered for schtasks.exe with the /create argument.

Answer

Sysmon Event ID 3, NetworkConnect, filtered for outbound connections from the Task Scheduler service.

Question 10

When hunting for credential dumping using Mimikatz, which process memory access pattern is the most common indicator?

Accepted Answer

Access to lsass.exe. Mimikatz is a credential-dumping tool that extracts plaintext passwords, hashes, PINs, and Kerberos tickets from memory. Its primary target is the Local Security Authority Subsystem Service (lsass.exe), which stores credential material in Windows. Therefore, the most common indicator of credential dumping is a process accessing lsass.exe memory, often via OpenProcess with PROCESS_VM_READ and ReadProcessMemory calls.

Answer

Access to csrss.exe

Answer

Access to svchost.exe

Answer

Access to explorer.exe