312-85 Threat Hunting And Detection — Timed 15 Questions

Question 1

When conducting a hunt for lateral movement using MITRE ATT&CK T1021.001 (Remote Desktop Protocol), which log source is most effective for detecting anomalous RDP connections?

Accepted Answer

Microsoft-Windows-TerminalServices-LocalSessionManager/Operational Event ID 21. The Microsoft-Windows-TerminalServices-LocalSessionManager/Operational log provides specific evidence of session authentication and connection events.

Answer

System Event ID 7045

Answer

Security Event ID 1102

Answer

Security Event ID 4624

Question 2

A threat hunter is using Sysmon to identify potential process hollowing. Which Event ID should the analyst prioritize in their hunting query?

Accepted Answer

Event ID 8. Event ID 8 (CreateRemoteThread) is a primary indicator of process hollowing, where a process injects code into another process.

Answer

Event ID 1

Answer

Event ID 11

Answer

Event ID 3

Question 3

When hunting for malicious DLL side-loading, which file property is most critical to verify?

Accepted Answer

Code signing certificate. Side-loading relies on a legitimate binary loading a malicious DLL with the same name as a required dependency from a different directory.

Answer

File extension

Answer

Creation timestamp

Answer

File size

Question 4

While hunting for hidden network traffic, you identify anomalous 'Beacon' activity in the proxy logs. Which metric is the most effective way to filter out normal traffic noise?

Accepted Answer

Response size variance. By filtering on low-entropy and uniform intervals, analysts can isolate beacons from human-generated web traffic.

Answer

HTTP User-Agent strings

Answer

DNS lookup failure counts

Answer

Source IP addresses

Question 5

When conducting a hunt for 'Golden Ticket' attacks, which attribute should be checked for anomalies in the Kerberos ticket?

Accepted Answer

Ticket lifetime (e.g., 10 years). The ticket lifetime and the account SID are key indicators; Golden Tickets often use a fake domain admin SID.

Answer

Domain controller name

Answer

Client IP address

Answer

Ticket encryption algorithm

Question 6

Which THREE techniques are commonly associated with the 'Execution' phase of the MITRE ATT&CK framework and should be prioritized in a threat hunt?

Accepted Answer

PowerShell Script Execution. PowerShell Script Execution (B) is a canonical ATT&CK Execution technique (T1059.001) because adversaries use powershell.exe to run payloads, downloaders, and post-exploitation scripts directly on a host. WMI Event Subscription (C) is also an Execution technique (T1546.003) since attackers register permanent WMI event consumers/filters to trigger malicious code automatically when specified events occur. Scheduled Task Creation (D) belongs to Execution (T1053.005), as schtasks.exe or the Task Scheduler service is abused to launch programs at defined times or triggers. ARP Spoofing (A) is a Collection/credential-access-adjacent network technique (T1557.002), and DNS Tunneling (E) is a Command and Control/exfiltration technique (T1071.004), so neither is categorized under Execution.

Answer

ARP Spoofing

Answer

DNS Tunneling

Question 7

To effectively hunt for C2 communication, which THREE indicators should be monitored in your proxy or firewall logs?

Accepted Answer

High frequency of connections (beaconing). Option A is correct because C2 implants typically beacon at regular intervals, so proxy/firewall logs showing a high frequency of repeated connections to the same destination (e.g., every 60 seconds) are a strong hunting indicator. Option B is correct because newly registered domains (young domain age, often days or weeks old) are frequently used for C2 infrastructure, and correlating destination domains with low domain age in logs helps surface malicious callbacks. Option E is correct because consistent or anomalous User-Agent strings across many connections to the same host can reveal automated C2 traffic, especially when the same User-Agent appears in regular beaconing patterns. Option C is not the best indicator here because traffic volume spikes are more associated with data exfiltration or bulk transfer than with the low-and-slow beaconing typical of C2. Option D is not appropriate because TCP window size changes are a host/network stack behavior seen in packet captures, not a reliable field monitored in proxy or firewall logs for C2 hunting.

Answer

Traffic volume spikes

Answer

TCP Window size changes

Question 8

A threat hunter is analyzing Windows event logs to detect pass-the-hash attacks. Which TWO event IDs are most indicative of this technique when observed together? (Choose two.)

Accepted Answer

Event ID 4672 (Special privileges assigned to new logon). Pass-the-hash attacks typically generate a network logon (Event ID 4624 Type 3) because the attacker uses the stolen NTLM hash to authenticate to a remote system via SMB or WMI. If the compromised account has administrative rights, Event ID 4672 will also be logged, showing special privileges assigned. The combination of these two events, especially when the source is unusual, is a strong indicator of pass-the-hash lateral movement.

Answer

Event ID 4625 (An account failed to log on)

Answer

Event ID 4768 (A Kerberos authentication ticket was requested)

Answer

Event ID 4624 with Logon Type 10 (RemoteInteractive)

Question 9

A hunter is reviewing Sysmon telemetry on a workstation suspected of hosting an implant that maintains persistence through a scheduled task. The hunter wants to identify the moment the task was created or modified, not merely when it executed. Which Sysmon event should the hunter prioritize to capture the creation or modification of the scheduled task?

Accepted Answer

Sysmon Event ID 11, FileCreate, filtered for files written under C:\Windows\System32\Tasks.. Scheduled tasks exist as XML files under the Tasks directory, so a FileCreate event for that path records the installation or modification regardless of the creation method. Filtering process creation for schtasks.exe only catches command-line creation, while network connect and image load events describe runtime behavior, not the moment persistence was written to disk.

Answer

Sysmon Event ID 7, ImageLoad, filtered for modules loaded by the Task Scheduler service.

Answer

Sysmon Event ID 1, ProcessCreate, filtered for schtasks.exe with the /create argument.

Answer

Sysmon Event ID 3, NetworkConnect, filtered for outbound connections from the Task Scheduler service.

Question 10

When hunting for credential dumping using Mimikatz, which process memory access pattern is the most common indicator?

Accepted Answer

Access to lsass.exe. Mimikatz is a credential-dumping tool that extracts plaintext passwords, hashes, PINs, and Kerberos tickets from memory. Its primary target is the Local Security Authority Subsystem Service (lsass.exe), which stores credential material in Windows. Therefore, the most common indicator of credential dumping is a process accessing lsass.exe memory, often via OpenProcess with PROCESS_VM_READ and ReadProcessMemory calls.

Answer

Access to csrss.exe

Answer

Access to svchost.exe

Answer

Access to explorer.exe

Question 11

A threat hunter wants to identify unauthorized DNS tunneling. Which data point is most indicative of this activity?

Accepted Answer

High volume of TXT record queries. DNS tunneling exfiltrates data or establishes C2 by encoding payloads in DNS query names and responses, most commonly using TXT records because they can carry arbitrary text up to 255 characters per string and are rarely queried in bulk during normal operations. A high volume of TXT record queries — especially to a single domain or with long, encoded subdomains — is a strong indicator of tunneling tools like iodine, dnscat2, or DNSExfiltrator.

Answer

Low volume of DNS failures

Answer

High volume of A record queries

Answer

Frequent SRV record updates

Question 12

You are hunting for Cobalt Strike C2 using JA3/JA3S fingerprinting. If the JA3S value is unique for your environment and observed across multiple hosts, what does this suggest?

Accepted Answer

It indicates a specific C2 listener implementation. JA3S is the server-side TLS fingerprint derived from the ServerHello (TLS version, cipher suite, extensions). A JA3S value that is unique in the environment and appears across multiple hosts strongly indicates a specific C2 listener implementation — for example, a particular Cobalt Strike malleable profile or team server build — because legitimate servers usually share fingerprints with many peers.

Answer

The connection is encrypted with an expired certificate

Answer

The client has been compromised

Answer

It is a standard browser connection

Question 13

An analyst is investigating potential persistence via WMI event subscriptions. Which WMI namespace should the hunter focus on for suspicious event consumers?

Accepted Answer

root\subscription. The root\subscription namespace is the correct focus because it is the dedicated WMI repository location where permanent event subscriptions are stored. Attackers use this namespace to create __EventFilter, __EventConsumer, and __FilterToConsumerBinding instances that persist across reboots, enabling fileless persistence and code execution. Unlike transient subscriptions that exist only in memory, these permanent subscriptions reside in root\subscription and are automatically reinstated by the WMI service at startup, making them a prime hunting ground for suspicious event consumers.

Answer

root\default

Answer

root\security

Answer

root\cimv2

Question 14

During an investigation, you observe suspicious PowerShell execution with the -EncodedCommand flag. Which log provider should you consult to see the decoded script block content?

Accepted Answer

Microsoft-Windows-PowerShell/Operational ID 4104. The Microsoft-Windows-PowerShell/Operational log (Event ID 4104) captures the full script block text, even if obfuscated or encoded.

Answer

System Event ID 7040

Answer

Application Event ID 1000

Answer

Security Event ID 4688

Question 15

While using ELK Stack for threat hunting, you need to identify beaconing behavior. Which aggregation function would best reveal periodicity in connection intervals?

Accepted Answer

Standard deviation on interval deltas. Beaconing is characterized by regular, periodic callbacks from an infected host to C2 infrastructure. To detect periodicity, you must analyze the intervals between successive connections from the same source to the same destination. Computing the standard deviation of those interval deltas reveals how consistent the timing is — a low standard deviation indicates highly regular beaconing (e.g., every 60 seconds ± 2s), which is a strong indicator of automated C2.

Answer

Sum aggregation on connection counts

Answer

Min/Max aggregation on bytes

Answer

Cardinality count on source IPs