GCIH Detecting Evasive and Post-Exploitation Techniques Practice Test 1 — 15 Questions

Question 1

Refer to the exhibit. An analyst observes this command in the logs. What is the primary post-exploitation goal of this technique?

Accepted Answer

Downloading and staging a second-stage malicious payload.. The certutil utility is frequently abused to download files from remote servers, bypassing browser-based security controls. By using the -urlcache and -split flags, an attacker can retrieve a payload and store it on the local disk without triggering standard download protection mechanisms. Detecting this specific command-line pattern is essential, as it indicates a stage in the attack lifecycle where the adversary is transitioning from initial access to full malware execution on the targeted endpoint.

Answer

Exfiltrating sensitive user data via HTTP requests.

Answer

Modifying Windows registry keys to achieve persistence.

Answer

Clearing system event logs to hide previous activity.

Question 2

Which THREE indicators are commonly associated with a 'Pass-the-Hash' (PtH) attack during the post-exploitation phase?

Accepted Answer

Network authentication events using NTLM instead of Kerberos.. Pass-the-Hash is a technique where an attacker uses an NTLM hash to authenticate as a user without needing the original plaintext password. Detection is vital because this technique allows attackers to move laterally and escalate privileges across a Windows domain. By monitoring authentication patterns and specific process behavior, responders can identify these unauthorized lateral movements that bypass traditional password-based authentication controls.

Answer

The appearance of new user accounts in the local Administrators group.

Answer

Sudden increase in successful service ticket requests (TGS).

Question 3

During an incident response engagement, an analyst reviews Windows security event logs and observes a burst of Event ID 4769 entries with encryption type 0x17 (RC4-HMAC) for multiple user accounts, all originating from a single non-domain-joined workstation on the internal network. No corresponding Event ID 4768 TGT requests are present for those accounts. Which post-exploitation technique is most consistent with this activity?

Accepted Answer

Kerberoasting using harvested service account SPNs. A flood of Kerberos service ticket requests (Event ID 4769) using RC4 encryption from a single workstation, without corresponding TGT requests, indicates an attacker is requesting service tickets for offline password cracking. This is the defining behavior of Kerberoasting, where any authenticated domain user can request service tickets for accounts with SPNs and crack them offline to recover plaintext passwords.

Answer

AS-REP Roasting against accounts without pre-authentication

Answer

Silver Ticket forgery using a service account hash

Answer

Golden Ticket forgery using the KRBTGT hash

Question 4

An attacker uses living-off-the-land binaries (LotLbins) to execute a malicious PowerShell script. Which detection strategy best identifies this activity while minimizing false positives from administrative scripts?

Accepted Answer

Monitor process lineage for common utilities launching suspicious child processes.. Detecting LotLbins requires focusing on process lineage and behavioral context rather than just the binary name. By correlating parent-child process relationships—specifically looking for common utilities like certutil.exe or mshta.exe spawning suspicious network connections or child shells—defenders can distinguish malicious intent from standard management tasks. This approach is critical in modern environments where native tools are frequently abused to bypass static signature-based detection mechanisms used by legacy EDR solutions.

Answer

Block all PowerShell execution via Group Policy Objects.

Answer

Flag any process execution involving native Windows binaries.

Answer

Implement static file hash signatures for all known LotLbins.

Question 5

An adversary is using reflective DLL injection to evade detection. Which TWO indicators would most reliably suggest this activity is occurring?

Accepted Answer

Memory regions with Read/Write/Execute (RWX) permissions within a process.. Reflective DLL injection works by loading a library from memory rather than the disk, bypassing standard file-based monitoring. Detecting this requires looking for memory-related anomalies such as memory regions with suspicious permissions (e.g., Read/Write/Execute) and the absence of a corresponding file backer for loaded modules in a process. These indicators are crucial because traditional antivirus solutions scanning the disk will miss the payload entirely as it never touches the physical storage layer.

Answer

Presence of a new file with an unusual extension in the system directory.

Answer

Increased usage of CPU by background system services.

Answer

An increase in the number of network connections to unknown IPs.

Question 6

Which technique describes an attacker using a legitimate process to hide malicious code, commonly used to bypass security products that monitor only the primary process?

Accepted Answer

Process Hollowing. Process hollowing is a sophisticated technique where an attacker starts a legitimate process in a suspended state, replaces its memory content with a malicious payload, and then resumes the process. This is effective because security tools often trust the initial process launch and fail to inspect the subsequent memory modification. Understanding this is vital for incident handlers because it explains why legitimate-looking processes may suddenly exhibit malicious behavior during an investigation.

Answer

DLL Side-Loading

Answer

AppInit_DLLs

Answer

Token Impersonation

Question 7

An incident responder notices that a local user account is performing Kerberoasting. Which event log ID should the responder examine to verify this activity?

Accepted Answer

Event ID 4769. Kerberoasting involves requesting service tickets for service accounts from the Key Distribution Center (KDC) to crack service account passwords offline. In Windows event logs, this activity generates a specific event when a service ticket is requested. Detecting this is essential because it is a common post-exploitation technique for lateral movement and privilege escalation, allowing attackers to compromise highly privileged service accounts without interacting with the domain controller directly.

Answer

Event ID 4624

Answer

Event ID 4720

Answer

Event ID 4688

Question 8

What is the primary purpose of 'Time Stomping' during a post-exploitation phase?

Accepted Answer

To blend malicious files into the existing file system timeline.. Time stomping involves modifying the timestamp attributes of files—specifically Created, Accessed, Written, and Mapped (CAWM) times—to match surrounding system files. This technique is designed to hide the presence of malicious files from forensic investigators who look for outliers in file system timelines. By understanding this, defenders know that relying solely on standard file system timestamps during an investigation is insufficient and requires secondary validation methods.

Answer

To crash the file system and hide malicious processes.

Answer

To bypass file integrity monitoring (FIM) signatures.

Answer

To increase the privilege level of the attacker.

Question 9

Which behavior is indicative of a 'Golden Ticket' attack occurring in a Windows environment?

Accepted Answer

Unusually long ticket lifetimes or requests without an initial AS-REQ.. A Golden Ticket attack involves an adversary gaining access to the Krbtgt account hash, which allows them to forge TGTs (Ticket Granting Tickets) for any account. Because the ticket is forged offline and holds virtually infinite lifetime, it bypasses password changes and enables persistent, stealthy domain-wide access. Detecting this requires monitoring for abnormal TGT requests that do not correlate with legitimate authentication events, which is vital for preventing long-term domain compromise.

Answer

The user password is changed without authorization.

Answer

An increase in NTLM traffic across the domain.

Answer

The creation of a new, highly privileged domain administrator.

Question 10

Refer to the exhibit. An attacker bypasses this policy. Why did this control fail?

Accepted Answer

The policy only filters for one specific argument variation.. The policy specifically blocks -enc, but PowerShell supports multiple aliases and variations like -encodedcommand, -e, and -en. Security controls that rely on string matching for specific command-line arguments are brittle because attackers can easily use different syntax or encoding to achieve the same result. Effective detection must look for the behavior of encoded execution regardless of the specific argument shorthand used in the command line.

Answer

PowerShell was not fully patched to the latest version.

Answer

The system was not rebooted after the policy was applied.

Answer

The policy only blocks 'powershell.exe' and not 'pwsh.exe'.

Question 11

Which of the following is a sign of 'Domain Fronting' in network traffic logs?

Accepted Answer

A mismatch between the SNI and the internal HTTP Host header.. Domain fronting uses high-reputation domains (like CDNs) to hide the true destination of malicious traffic. The initial request looks like it is going to a trusted domain, but the HTTP Host header inside the encrypted tunnel points to the attacker's server. Detecting this requires deep packet inspection or analysis of SSL/TLS metadata, which is critical for identifying covert C2 channels that masquerade as legitimate web traffic.

Answer

Large volumes of traffic to a single domain over port 443.

Answer

Unusually slow download speeds for legitimate files.

Answer

Repeated failed authentication attempts to the CDN.

Question 12

Which technique involves an attacker injecting code into a legitimate, running process to perform malicious activity while avoiding the detection of file-based scanning?

Accepted Answer

Process Injection. Process injection is a broad category of techniques where malicious code is forced into the memory space of another, healthy process. This is dangerous because the malicious activity appears to originate from the trusted process, potentially bypassing security controls. Responders must look for inter-process memory manipulation, such as calls to WriteProcessMemory or CreateRemoteThread, to identify when an adversary is attempting to hide their execution within a legitimate container.

Answer

Code signing

Answer

Data Execution Prevention (DEP)

Answer

Memory Forensics

Question 13

What is the primary indicator of a 'Skeleton Key' attack in an Active Directory environment?

Accepted Answer

Successful authentication using a custom password for multiple users.. A Skeleton Key attack injects a patch into the LSASS process on a domain controller, allowing the attacker to authenticate as any user using a single, 'master' password. This is a devastating post-exploitation technique because it grants the attacker domain-wide access without needing to crack individual user hashes. Detecting this requires monitoring for memory anomalies in LSASS on DCs and auditing for suspicious modifications to critical system processes.

Answer

All user passwords in the domain are suddenly reset.

Answer

The domain controller crashes during authentication.

Answer

Increased replication traffic between domain controllers.

Question 14

Which of the following is a reliable method to detect an adversary using 'WMI Event Subscription' for persistence?

Accepted Answer

Auditing WMI event filters and consumers for anomalies.. WMI event subscriptions allow attackers to trigger malicious code execution upon specific system events, such as system startup or a timer. Because WMI is a legitimate administrative interface, malicious subscriptions are often overlooked. Detection requires auditing WMI repositories for suspicious 'ActiveScriptEventConsumer' or 'CommandLineEventConsumer' entries, which are the primary mechanisms used to run code through the WMI system for long-term persistence.

Answer

Monitoring for new files in the Startup folder.

Answer

Blocking all PowerShell execution at the kernel level.

Answer

Scanning the Windows Registry for Run keys.

Question 15

An incident responder investigates a Windows endpoint and discovers an unexpected service running with administrative privileges, executing a binary from an anomalous temporary directory. Reviewing the registry, the responder notices that the service binary path uses a space-separated executable path without surrounding double quotes, and the folder name contains a space. Which post-exploitation persistence and privilege escalation technique has the attacker deployed?

Accepted Answer

Unquoted service path exploitation leveraging Windows path parsing behavior.. Unquoted service paths occur when Windows evaluates a service binary path containing spaces without enclosing quotation marks. The operating system sequentially checks executable candidates from left to right, splitting at spaces. Attackers drop malicious payloads in intermediate directories, leading to automatic execution with SYSTEM privileges during service startup.

Answer

DLL search order hijacking involving system directory redirection.

Answer

Scheduled task modification using legitimate administrator task IDs.

Answer

Windows Management Instrumentation event subscription persistence.