GCIH Detecting Evasive and Post-Exploitation Techniques — 10 Questions

Question 1

Refer to the exhibit. An analyst observes this command in the logs. What is the primary post-exploitation goal of this technique?

Accepted Answer

Downloading and staging a second-stage malicious payload.. The certutil utility is frequently abused to download files from remote servers, bypassing browser-based security controls. By using the -urlcache and -split flags, an attacker can retrieve a payload and store it on the local disk without triggering standard download protection mechanisms. Detecting this specific command-line pattern is essential, as it indicates a stage in the attack lifecycle where the adversary is transitioning from initial access to full malware execution on the targeted endpoint.

Answer

Exfiltrating sensitive user data via HTTP requests.

Answer

Modifying Windows registry keys to achieve persistence.

Answer

Clearing system event logs to hide previous activity.

Question 2

Which THREE indicators are commonly associated with a 'Pass-the-Hash' (PtH) attack during the post-exploitation phase?

Accepted Answer

Network authentication events using NTLM instead of Kerberos.. Pass-the-Hash is a technique where an attacker uses an NTLM hash to authenticate as a user without needing the original plaintext password. Detection is vital because this technique allows attackers to move laterally and escalate privileges across a Windows domain. By monitoring authentication patterns and specific process behavior, responders can identify these unauthorized lateral movements that bypass traditional password-based authentication controls.

Answer

The appearance of new user accounts in the local Administrators group.

Answer

Sudden increase in successful service ticket requests (TGS).

Question 3

During an incident response engagement, an analyst reviews Windows security event logs and observes a burst of Event ID 4769 entries with encryption type 0x17 (RC4-HMAC) for multiple user accounts, all originating from a single non-domain-joined workstation on the internal network. No corresponding Event ID 4768 TGT requests are present for those accounts. Which post-exploitation technique is most consistent with this activity?

Accepted Answer

Kerberoasting using harvested service account SPNs. A flood of Kerberos service ticket requests (Event ID 4769) using RC4 encryption from a single workstation, without corresponding TGT requests, indicates an attacker is requesting service tickets for offline password cracking. This is the defining behavior of Kerberoasting, where any authenticated domain user can request service tickets for accounts with SPNs and crack them offline to recover plaintext passwords.

Answer

AS-REP Roasting against accounts without pre-authentication

Answer

Silver Ticket forgery using a service account hash

Answer

Golden Ticket forgery using the KRBTGT hash

Question 4

An attacker uses living-off-the-land binaries (LotLbins) to execute a malicious PowerShell script. Which detection strategy best identifies this activity while minimizing false positives from administrative scripts?

Accepted Answer

Monitor process lineage for common utilities launching suspicious child processes.. Detecting LotLbins requires focusing on process lineage and behavioral context rather than just the binary name. By correlating parent-child process relationships—specifically looking for common utilities like certutil.exe or mshta.exe spawning suspicious network connections or child shells—defenders can distinguish malicious intent from standard management tasks. This approach is critical in modern environments where native tools are frequently abused to bypass static signature-based detection mechanisms used by legacy EDR solutions.

Answer

Block all PowerShell execution via Group Policy Objects.

Answer

Flag any process execution involving native Windows binaries.

Answer

Implement static file hash signatures for all known LotLbins.

Question 5

An adversary is using reflective DLL injection to evade detection. Which TWO indicators would most reliably suggest this activity is occurring?

Accepted Answer

Memory regions with Read/Write/Execute (RWX) permissions within a process.. Reflective DLL injection works by loading a library from memory rather than the disk, bypassing standard file-based monitoring. Detecting this requires looking for memory-related anomalies such as memory regions with suspicious permissions (e.g., Read/Write/Execute) and the absence of a corresponding file backer for loaded modules in a process. These indicators are crucial because traditional antivirus solutions scanning the disk will miss the payload entirely as it never touches the physical storage layer.

Answer

Presence of a new file with an unusual extension in the system directory.

Answer

Increased usage of CPU by background system services.

Answer

An increase in the number of network connections to unknown IPs.

Question 6

Which technique describes an attacker using a legitimate process to hide malicious code, commonly used to bypass security products that monitor only the primary process?

Accepted Answer

Process Hollowing. Process hollowing is a sophisticated technique where an attacker starts a legitimate process in a suspended state, replaces its memory content with a malicious payload, and then resumes the process. This is effective because security tools often trust the initial process launch and fail to inspect the subsequent memory modification. Understanding this is vital for incident handlers because it explains why legitimate-looking processes may suddenly exhibit malicious behavior during an investigation.

Answer

DLL Side-Loading

Answer

AppInit_DLLs

Answer

Token Impersonation

Question 7

An incident responder notices that a local user account is performing Kerberoasting. Which event log ID should the responder examine to verify this activity?

Accepted Answer

Event ID 4769. Kerberoasting involves requesting service tickets for service accounts from the Key Distribution Center (KDC) to crack service account passwords offline. In Windows event logs, this activity generates a specific event when a service ticket is requested. Detecting this is essential because it is a common post-exploitation technique for lateral movement and privilege escalation, allowing attackers to compromise highly privileged service accounts without interacting with the domain controller directly.

Answer

Event ID 4624

Answer

Event ID 4720

Answer

Event ID 4688

Question 8

What is the primary purpose of 'Time Stomping' during a post-exploitation phase?

Accepted Answer

To blend malicious files into the existing file system timeline.. Time stomping involves modifying the timestamp attributes of files—specifically Created, Accessed, Written, and Mapped (CAWM) times—to match surrounding system files. This technique is designed to hide the presence of malicious files from forensic investigators who look for outliers in file system timelines. By understanding this, defenders know that relying solely on standard file system timestamps during an investigation is insufficient and requires secondary validation methods.

Answer

To crash the file system and hide malicious processes.

Answer

To bypass file integrity monitoring (FIM) signatures.

Answer

To increase the privilege level of the attacker.

Question 9

Which behavior is indicative of a 'Golden Ticket' attack occurring in a Windows environment?

Accepted Answer

Unusually long ticket lifetimes or requests without an initial AS-REQ.. A Golden Ticket attack involves an adversary gaining access to the Krbtgt account hash, which allows them to forge TGTs (Ticket Granting Tickets) for any account. Because the ticket is forged offline and holds virtually infinite lifetime, it bypasses password changes and enables persistent, stealthy domain-wide access. Detecting this requires monitoring for abnormal TGT requests that do not correlate with legitimate authentication events, which is vital for preventing long-term domain compromise.

Answer

The user password is changed without authorization.

Answer

An increase in NTLM traffic across the domain.

Answer

The creation of a new, highly privileged domain administrator.

Question 10

Refer to the exhibit. An attacker bypasses this policy. Why did this control fail?

Accepted Answer

The policy only filters for one specific argument variation.. The policy specifically blocks -enc, but PowerShell supports multiple aliases and variations like -encodedcommand, -e, and -en. Security controls that rely on string matching for specific command-line arguments are brittle because attackers can easily use different syntax or encoding to achieve the same result. Effective detection must look for the behavior of encoded execution regardless of the specific argument shorthand used in the command line.

Answer

PowerShell was not fully patched to the latest version.

Answer

The system was not rebooted after the policy was applied.

Answer

The policy only blocks 'powershell.exe' and not 'pwsh.exe'.