GCFA Identification of Malicious and Normal Activity — 10 Questions

Question 1

Which TWO of the following indicators are highly suggestive of credential dumping activity in memory?

Accepted Answer

A user-mode process requesting PROCESS_VM_READ access to lsass.exe.. Credential dumping tools often interact with the Local Security Authority Subsystem Service (LSASS) to extract hashes or plain-text passwords. Observing process access requests to LSASS by non-system processes is a primary indicator. Furthermore, the presence of specific temporary files or unusual command-line arguments used by known post-exploitation frameworks provides high-confidence signatures that security analysts can use to confirm an active credential theft attempt during an investigation.

Answer

lsass.exe process opening a handle to a browser process.

Answer

A non-system process requesting PROCESS_QUERY_LIMITED_INFORMATION on lsass.exe.

Answer

Increase in network traffic volume on port 53.

Question 2

Refer to the exhibit. What type of attack is demonstrated in this server response?

Accepted Answer

Cross-Site Scripting (XSS).. The injected script attempts to capture the user's session cookie and exfiltrate it to an external domain. This is a hallmark of a Cross-Site Scripting (XSS) attack. By embedding malicious JavaScript into the HTML response, the attacker can execute code within the context of the user's browser, potentially stealing session identifiers or performing actions on behalf of the authenticated user to compromise their account access.

Answer

SQL Injection.

Answer

Cross-Site Request Forgery (CSRF).

Answer

Buffer Overflow.

Question 3

Which artifact is most useful for detecting unauthorized persistence via a Windows registry Run key?

Accepted Answer

Sysmon Event ID 12 or 13.. The registry contains several 'Run' and 'RunOnce' keys that launch applications upon user or system startup. Malicious actors frequently modify these keys to ensure their malware survives a reboot. Auditing registry changes (via System Monitor/Sysmon) or examining the registry hive files offline during forensics provides the visibility needed to identify hidden persistence mechanisms that are not easily visible through standard process list reviews.

Answer

Windows Event ID 4688.

Answer

The browser cache folder contents.

Answer

Network flow logs from the border firewall.

Question 4

During a forensic analysis, you find a 'shimcache' (AppCompatCache) entry for an executable that no longer exists on the disk. What does this confirm?

Accepted Answer

The file was executed on the system.. The Shimcache is designed to track application compatibility and is populated upon execution. An entry in the Shimcache confirms that a specific binary was present and executed on the system at some point, even if the file has been subsequently deleted. This is a critical artifact for establishing a timeline of activity, specifically for identifying malware that an attacker attempted to remove to hide their forensic tracks.

Answer

The file was blocked by AppLocker.

Answer

The file was a service that failed to start.

Answer

The system was infected by a rootkit.

Question 5

A security analyst observes a workstation periodically initiating outbound HTTPS connections to an external IP address at exactly 03:00 UTC. The forensic artifact shows the process associated with these connections is 'svchost.exe' with a PID that changes daily. Which indicator strongly suggests malicious activity rather than a standard scheduled task?

Accepted Answer

The parent process of the svchost.exe instance is not services.exe.. Standard Windows services initiated by svchost.exe typically reference a Service Host group and a specific DLL path found in the registry under HKLM\System\CurrentControlSet\Services. When the parent process structure is decoupled from the services.exe hierarchy, or when the binary location deviates from System32, it signals process injection or masquerading. Identifying these discrepancies is vital for isolating beaconing activity in sophisticated persistent threats that attempt to blend into normal system baseline traffic.

Answer

The connections utilize TLS 1.2 for all outbound communication.

Answer

The connections occur at a consistent, predictable daily interval.

Answer

The external IP address belongs to a cloud service provider.

Question 6

An analyst discovers a suspicious file named 'svchost.exe' located in 'C:\Users\Public\'. Why is this highly suspicious from a forensic standpoint?

Accepted Answer

The file name svchost.exe should only exist in the System32 directory.. Core Windows system binaries have a fixed, well-known path, primarily within System32. Placing a binary with a system name in a user-writable directory like Public is a common masquerading tactic. Attackers use this to evade detection by casual administrators who recognize the name but may overlook the path. Identifying incorrect file locations is a fundamental baseline check for forensic analysts during system triage and compromise assessment.

Answer

The file is an executable, which is forbidden in the Public folder.

Answer

The Public folder is not indexed by the Windows Search service.

Answer

Windows automatically deletes any binary named svchost.exe found outside System32.

Question 7

Which THREE of the following artifacts provide the most reliable evidence when determining if a specific user account was used to execute a malicious script?

Accepted Answer

PowerShell operational logs (Event ID 4104).. To definitively link a user to a script execution, an analyst must look for evidence of the execution itself, the user's login session, and the command history. Combining shell history, event logs, and forensic artifacts like Shimcache or Amcache allows the analyst to create a timeline of activity. This rigor is required because attackers often spoof timestamps or use shared accounts, necessitating multi-source validation to confirm actor attribution.

Answer

The size of the system pagefile.sys.

Answer

The content of the .bash_history file.

Question 8

An analyst finds an unusual entry in the Windows 'Run' registry key. What is the most effective next step to evaluate if this entry is malicious?

Accepted Answer

Check the binary associated with the registry key for a known vendor signature.. The Run registry key is a common persistence mechanism. Evaluating it requires verifying the binary integrity, checking the file path, and identifying the process behavior. This step is critical because many legitimate applications use these keys for startup, and misidentifying them as malicious creates false positives. Analysts must correlate registry data with file hashes and process tree analysis to reach an informed conclusion about the entry's intent.

Answer

Immediately delete the registry key to stop the persistence.

Answer

Run a full disk scan using a common consumer-grade antivirus tool.

Answer

Reboot the system to see if the registry entry persists.

Question 9

Which TWO of the following logs should an investigator review to identify potential lateral movement across an enterprise network?

Accepted Answer

Windows Security Event Logs (Logon events).. Lateral movement is often captured in authentication logs and remote service logs. Monitoring for 4624 events with specific logon types or service installation logs helps identify the progression of an attacker. This is critical because lateral movement is the phase where attackers transition from an initial foothold to the target data, and timely detection here is the best opportunity to contain the breach before it expands across the domain.

Answer

DNS query logs from the domain controller.

Answer

Application logs for the local web server.

Answer

DHCP lease logs.

Question 10

During an investigation of a Windows 10 workstation, a forensic analyst runs a tool that parses the NTFS $MFT and observes a file record whose $STANDARD_INFORMATION timestamps are all earlier than the corresponding $FILE_NAME timestamps by roughly 45 minutes. The file resides in C:\Windows\System32 and is named 'lsass.exe'. What is the most accurate interpretation of this timestamp discrepancy?

Accepted Answer

The file was likely timestomped, because an attacker can modify $STANDARD_INFORMATION timestamps with user-mode APIs while $FILE_NAME timestamps are only updated by the kernel during file creation or renaming.. A discrepancy where $STANDARD_INFORMATION timestamps are earlier than $FILE_NAME timestamps on a critical system binary is a classic timestomping indicator. Attackers use user-mode APIs to modify $STANDARD_INFORMATION, but the kernel-managed $FILE_NAME timestamps are harder to alter without specialized techniques. This pattern should prompt further analysis such as hash comparison and memory inspection.

Answer

The file is a legitimate Windows component that was copied from an installation media, which preserves original timestamps in $STANDARD_INFORMATION but writes new $FILE_NAME timestamps at copy time.

Answer

The system clock was adjusted backwards after the file was created, so the $STANDARD_INFORMATION timestamps reflect the corrected time.

Answer

The NTFS journal was replayed after an unclean shutdown, which caused $FILE_NAME timestamps to be refreshed while $STANDARD_INFORMATION timestamps remained unchanged.