GCIH Detecting Evasive and Post-Exploitation Techniques — Timed 25 Questions

Question 1

Refer to the exhibit. An analyst observes this command in the logs. What is the primary post-exploitation goal of this technique?

Accepted Answer

Downloading and staging a second-stage malicious payload.. The certutil utility is frequently abused to download files from remote servers, bypassing browser-based security controls. By using the -urlcache and -split flags, an attacker can retrieve a payload and store it on the local disk without triggering standard download protection mechanisms. Detecting this specific command-line pattern is essential, as it indicates a stage in the attack lifecycle where the adversary is transitioning from initial access to full malware execution on the targeted endpoint.

Answer

Exfiltrating sensitive user data via HTTP requests.

Answer

Modifying Windows registry keys to achieve persistence.

Answer

Clearing system event logs to hide previous activity.

Question 2

Which THREE indicators are commonly associated with a 'Pass-the-Hash' (PtH) attack during the post-exploitation phase?

Accepted Answer

Network authentication events using NTLM instead of Kerberos.. Pass-the-Hash is a technique where an attacker uses an NTLM hash to authenticate as a user without needing the original plaintext password. Detection is vital because this technique allows attackers to move laterally and escalate privileges across a Windows domain. By monitoring authentication patterns and specific process behavior, responders can identify these unauthorized lateral movements that bypass traditional password-based authentication controls.

Answer

The appearance of new user accounts in the local Administrators group.

Answer

Sudden increase in successful service ticket requests (TGS).

Question 3

During an incident response engagement, an analyst reviews Windows security event logs and observes a burst of Event ID 4769 entries with encryption type 0x17 (RC4-HMAC) for multiple user accounts, all originating from a single non-domain-joined workstation on the internal network. No corresponding Event ID 4768 TGT requests are present for those accounts. Which post-exploitation technique is most consistent with this activity?

Accepted Answer

Kerberoasting using harvested service account SPNs. A flood of Kerberos service ticket requests (Event ID 4769) using RC4 encryption from a single workstation, without corresponding TGT requests, indicates an attacker is requesting service tickets for offline password cracking. This is the defining behavior of Kerberoasting, where any authenticated domain user can request service tickets for accounts with SPNs and crack them offline to recover plaintext passwords.

Answer

AS-REP Roasting against accounts without pre-authentication

Answer

Silver Ticket forgery using a service account hash

Answer

Golden Ticket forgery using the KRBTGT hash

Question 4

An attacker uses living-off-the-land binaries (LotLbins) to execute a malicious PowerShell script. Which detection strategy best identifies this activity while minimizing false positives from administrative scripts?

Accepted Answer

Monitor process lineage for common utilities launching suspicious child processes.. Detecting LotLbins requires focusing on process lineage and behavioral context rather than just the binary name. By correlating parent-child process relationships—specifically looking for common utilities like certutil.exe or mshta.exe spawning suspicious network connections or child shells—defenders can distinguish malicious intent from standard management tasks. This approach is critical in modern environments where native tools are frequently abused to bypass static signature-based detection mechanisms used by legacy EDR solutions.

Answer

Block all PowerShell execution via Group Policy Objects.

Answer

Flag any process execution involving native Windows binaries.

Answer

Implement static file hash signatures for all known LotLbins.

Question 5

An adversary is using reflective DLL injection to evade detection. Which TWO indicators would most reliably suggest this activity is occurring?

Accepted Answer

Memory regions with Read/Write/Execute (RWX) permissions within a process.. Reflective DLL injection works by loading a library from memory rather than the disk, bypassing standard file-based monitoring. Detecting this requires looking for memory-related anomalies such as memory regions with suspicious permissions (e.g., Read/Write/Execute) and the absence of a corresponding file backer for loaded modules in a process. These indicators are crucial because traditional antivirus solutions scanning the disk will miss the payload entirely as it never touches the physical storage layer.

Answer

Presence of a new file with an unusual extension in the system directory.

Answer

Increased usage of CPU by background system services.

Answer

An increase in the number of network connections to unknown IPs.

Question 6

Which technique describes an attacker using a legitimate process to hide malicious code, commonly used to bypass security products that monitor only the primary process?

Accepted Answer

Process Hollowing. Process hollowing is a sophisticated technique where an attacker starts a legitimate process in a suspended state, replaces its memory content with a malicious payload, and then resumes the process. This is effective because security tools often trust the initial process launch and fail to inspect the subsequent memory modification. Understanding this is vital for incident handlers because it explains why legitimate-looking processes may suddenly exhibit malicious behavior during an investigation.

Answer

DLL Side-Loading

Answer

AppInit_DLLs

Answer

Token Impersonation

Question 7

An incident responder notices that a local user account is performing Kerberoasting. Which event log ID should the responder examine to verify this activity?

Accepted Answer

Event ID 4769. Kerberoasting involves requesting service tickets for service accounts from the Key Distribution Center (KDC) to crack service account passwords offline. In Windows event logs, this activity generates a specific event when a service ticket is requested. Detecting this is essential because it is a common post-exploitation technique for lateral movement and privilege escalation, allowing attackers to compromise highly privileged service accounts without interacting with the domain controller directly.

Answer

Event ID 4624

Answer

Event ID 4720

Answer

Event ID 4688

Question 8

What is the primary purpose of 'Time Stomping' during a post-exploitation phase?

Accepted Answer

To blend malicious files into the existing file system timeline.. Time stomping involves modifying the timestamp attributes of files—specifically Created, Accessed, Written, and Mapped (CAWM) times—to match surrounding system files. This technique is designed to hide the presence of malicious files from forensic investigators who look for outliers in file system timelines. By understanding this, defenders know that relying solely on standard file system timestamps during an investigation is insufficient and requires secondary validation methods.

Answer

To crash the file system and hide malicious processes.

Answer

To bypass file integrity monitoring (FIM) signatures.

Answer

To increase the privilege level of the attacker.

Question 9

Which behavior is indicative of a 'Golden Ticket' attack occurring in a Windows environment?

Accepted Answer

Unusually long ticket lifetimes or requests without an initial AS-REQ.. A Golden Ticket attack involves an adversary gaining access to the Krbtgt account hash, which allows them to forge TGTs (Ticket Granting Tickets) for any account. Because the ticket is forged offline and holds virtually infinite lifetime, it bypasses password changes and enables persistent, stealthy domain-wide access. Detecting this requires monitoring for abnormal TGT requests that do not correlate with legitimate authentication events, which is vital for preventing long-term domain compromise.

Answer

The user password is changed without authorization.

Answer

An increase in NTLM traffic across the domain.

Answer

The creation of a new, highly privileged domain administrator.

Question 10

Refer to the exhibit. An attacker bypasses this policy. Why did this control fail?

Accepted Answer

The policy only filters for one specific argument variation.. The policy specifically blocks -enc, but PowerShell supports multiple aliases and variations like -encodedcommand, -e, and -en. Security controls that rely on string matching for specific command-line arguments are brittle because attackers can easily use different syntax or encoding to achieve the same result. Effective detection must look for the behavior of encoded execution regardless of the specific argument shorthand used in the command line.

Answer

PowerShell was not fully patched to the latest version.

Answer

The system was not rebooted after the policy was applied.

Answer

The policy only blocks 'powershell.exe' and not 'pwsh.exe'.

Question 11

Which of the following is a sign of 'Domain Fronting' in network traffic logs?

Accepted Answer

A mismatch between the SNI and the internal HTTP Host header.. Domain fronting uses high-reputation domains (like CDNs) to hide the true destination of malicious traffic. The initial request looks like it is going to a trusted domain, but the HTTP Host header inside the encrypted tunnel points to the attacker's server. Detecting this requires deep packet inspection or analysis of SSL/TLS metadata, which is critical for identifying covert C2 channels that masquerade as legitimate web traffic.

Answer

Large volumes of traffic to a single domain over port 443.

Answer

Unusually slow download speeds for legitimate files.

Answer

Repeated failed authentication attempts to the CDN.

Question 12

Which technique involves an attacker injecting code into a legitimate, running process to perform malicious activity while avoiding the detection of file-based scanning?

Accepted Answer

Process Injection. Process injection is a broad category of techniques where malicious code is forced into the memory space of another, healthy process. This is dangerous because the malicious activity appears to originate from the trusted process, potentially bypassing security controls. Responders must look for inter-process memory manipulation, such as calls to WriteProcessMemory or CreateRemoteThread, to identify when an adversary is attempting to hide their execution within a legitimate container.

Answer

Code signing

Answer

Data Execution Prevention (DEP)

Answer

Memory Forensics

Question 13

What is the primary indicator of a 'Skeleton Key' attack in an Active Directory environment?

Accepted Answer

Successful authentication using a custom password for multiple users.. A Skeleton Key attack injects a patch into the LSASS process on a domain controller, allowing the attacker to authenticate as any user using a single, 'master' password. This is a devastating post-exploitation technique because it grants the attacker domain-wide access without needing to crack individual user hashes. Detecting this requires monitoring for memory anomalies in LSASS on DCs and auditing for suspicious modifications to critical system processes.

Answer

All user passwords in the domain are suddenly reset.

Answer

The domain controller crashes during authentication.

Answer

Increased replication traffic between domain controllers.

Question 14

Which of the following is a reliable method to detect an adversary using 'WMI Event Subscription' for persistence?

Accepted Answer

Auditing WMI event filters and consumers for anomalies.. WMI event subscriptions allow attackers to trigger malicious code execution upon specific system events, such as system startup or a timer. Because WMI is a legitimate administrative interface, malicious subscriptions are often overlooked. Detection requires auditing WMI repositories for suspicious 'ActiveScriptEventConsumer' or 'CommandLineEventConsumer' entries, which are the primary mechanisms used to run code through the WMI system for long-term persistence.

Answer

Monitoring for new files in the Startup folder.

Answer

Blocking all PowerShell execution at the kernel level.

Answer

Scanning the Windows Registry for Run keys.

Question 15

An incident responder investigates a Windows endpoint and discovers an unexpected service running with administrative privileges, executing a binary from an anomalous temporary directory. Reviewing the registry, the responder notices that the service binary path uses a space-separated executable path without surrounding double quotes, and the folder name contains a space. Which post-exploitation persistence and privilege escalation technique has the attacker deployed?

Accepted Answer

Unquoted service path exploitation leveraging Windows path parsing behavior.. Unquoted service paths occur when Windows evaluates a service binary path containing spaces without enclosing quotation marks. The operating system sequentially checks executable candidates from left to right, splitting at spaces. Attackers drop malicious payloads in intermediate directories, leading to automatic execution with SYSTEM privileges during service startup.

Answer

DLL search order hijacking involving system directory redirection.

Answer

Scheduled task modification using legitimate administrator task IDs.

Answer

Windows Management Instrumentation event subscription persistence.

Question 16

During an incident response engagement, you review Windows Security event logs and observe a series of 4624 logons with Logon Type 3 originating from a single workstation. The account name is the computer account of a server, and the source workstation is a user's desktop that normally never authenticates to the target server. Which post-exploitation technique is most consistent with this pattern?

Accepted Answer

Pass-the-Hash using the machine account hash to authenticate laterally. Pass-the-Hash allows an adversary to authenticate using a captured NTLM hash, and machine account hashes are equally usable. A Type 3 network logon claiming to be a server's machine account but originating from an unrelated workstation is a classic lateral movement signature. Kerberoasting, Golden Ticket, and DCSync leave different artifacts such as 4769, 4768, or 4662 events, not this logon pattern.

Answer

Kerberoasting of the server's service account

Answer

Golden Ticket creation using the KRBTGT hash

Answer

DCSync replication of directory credentials

Question 17

An analyst is investigating a suspected compromise on a Windows 10 endpoint. Network telemetry shows periodic outbound HTTPS traffic to a domain that resolves to a legitimate cloud CDN IP, but the SNI in the TLS ClientHello does not match the destination domain. The endpoint has no browser activity at those times. Which technique best explains this traffic pattern?

Accepted Answer

Domain fronting through a CDN to hide the true command-and-control destination. Domain fronting exploits CDN behavior where the TLS SNI and the HTTP Host header can differ, allowing traffic to appear destined for a benign domain while actually reaching attacker infrastructure. The combination of periodic non-browser HTTPS, a legitimate CDN IP, and an SNI that does not match the destination domain is characteristic. DNS tunneling, ICMP covert channels, and fast flux produce different network signatures and would not generate this specific mismatch.

Answer

Fast flux DNS rotating A records to evade blocklists

Answer

DNS tunneling using TXT records to exfiltrate data

Answer

Beaconing over a covert channel using ICMP echo payloads

Question 18

A SOC analyst notices that a scheduled task on a workstation was created shortly after a user opened a malicious email attachment. The task runs a PowerShell command that downloads a file from an external IP every hour. The task is configured to run under the SYSTEM account and has no associated user logon. Which post-exploitation technique does this represent?

Accepted Answer

Persistence via scheduled task. Scheduled tasks are a favored persistence mechanism because they can run under SYSTEM, trigger on schedules or events, and survive reboots without user interaction. The scenario shows a task created after a phishing attachment, executing a recurring download, which matches this technique. Unquoted service path, LSASS credential dumping, and PsExec lateral movement involve different artifacts such as service creation or remote execution, none of which are described.

Answer

Credential dumping using LSASS memory access

Answer

Privilege escalation via unquoted service path

Answer

Lateral movement using PsExec

Question 19

A threat hunter is reviewing Sysmon logs from a Windows workstation that is suspected of being compromised. The hunter sees a process named 'svchost.exe' with a parent process of 'services.exe', but its image path is 'C:\Users\Public\svchost.exe' and it has an active network connection to an external IP address on port 443. Which two indicators should the hunter flag as highly suspicious in this scenario? (Choose two.)

Accepted Answer

The process has an active network connection on port 443.. The two suspicious indicators are the non-standard image path and the external network connection. Legitimate svchost.exe runs from System32, so an instance in C:\Users\Public indicates masquerading. The external connection on port 443 suggests command-and-control or data exfiltration. Together, they strongly point to a compromised host, while the parent process and process name are normal.

Answer

The process name is svchost.exe.

Answer

The process is running under the SYSTEM account.

Answer

The parent process is services.exe.

Question 20

An incident responder is analyzing a suspected process injection on a Windows host. Which two artifacts most reliably indicate that a remote thread was injected into a legitimate process? (Choose two.)

Accepted Answer

A memory region with PAGE_EXECUTE_READWRITE permissions that is not backed by a file on disk. Remote thread injection leaves memory artifacts: a thread whose start address is outside any loaded module, and an unbacked memory region with execute-read-write permissions. These indicate code executing from dynamically allocated memory rather than a legitimate DLL or EXE. Process creation events, failed logons, and DNS volume are unrelated to thread injection and do not directly evidence it.

Answer

Event ID 4688 showing the creation of a new process with a suspicious command line

Answer

An increase in DNS query volume from the host

Answer

A high number of failed logon attempts in the Security event log