GCIH Detecting Exploitation and Covert Communication Tools — 15 Questions

Question 1

An analyst observes a series of outbound HTTPS connections to an unknown external IP address. The connections occur at exact 300-second intervals and maintain a consistent packet size. Which detection strategy is most effective for identifying this potential covert channel?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Analyze flow data for rhythmic beaconing patterns and session consistency.. Detecting periodic beacons is best achieved through statistical traffic analysis focusing on temporal regularity. Unlike signature-based detection, which fails against encrypted payloads, entropy and timing analysis identify the non-human pattern of automated heartbeats. This is crucial for incident handlers because command-and-control communication often hides within legitimate protocols, requiring baseline behavioral monitoring to differentiate between legitimate user activity and persistent automated threats.

Answer

Perform deep packet inspection on the encrypted TLS payload.

Answer

Filter outbound traffic based on known malicious domain reputation lists.

Answer

Monitor for anomalous user-agent strings in the HTTP headers.

Question 2

Refer to the exhibit. An analyst identifies this HTTP response during an investigation. Based on the Set-Cookie header content, what tool or technique is potentially being used by the threat actor?

Accepted Answer

JSON Web Token manipulation for privilege escalation. The cookie value is a Base64-encoded JWT (JSON Web Token), a common target for session hijacking or privilege escalation. Incident handlers must recognize these structures as they are often used to store user identity information on the client side. If the signature is weak or missing, attackers can modify the payload to gain administrative access, making this a critical area for detecting unauthorized privilege manipulation within web applications.

Answer

Cross-Site Scripting (XSS) payload delivery

Answer

SQL injection via cookie headers

Answer

DNS tunneling for data exfiltration

Question 3

Which TWO of the following indicators are highly suspicious when analyzing workstation memory for rootkit activity?

Accepted Answer

A process exists in the process list but cannot be found in the task manager.. Rootkits often modify kernel-mode structures or hide processes to maintain persistence. Detecting these requires looking for inconsistencies between system API reports and raw kernel memory analysis. As incident handlers, identifying these discrepancies is vital because it proves the operating system's integrity is compromised, rendering standard tools untrustworthy. Knowing these indicators helps in pivoting from standard analysis to advanced memory forensics.

Answer

Multiple legitimate background services running with high CPU usage.

Answer

Large quantities of temporary files in the user profile directory.

Answer

Increased network latency during peak business hours.

Question 4

Which tool is primarily used for identifying and analyzing covert communication channels by inspecting the timing and entropy of network packets?

Accepted Answer

Wireshark. Tools designed for traffic analysis allow incident handlers to see past simple payload inspection. Entropy analysis reveals the randomness of data, which often indicates encryption or obfuscation, while timing analysis shows the cadence of automated communication. This is vital for detecting sophisticated malware that uses custom protocols or timing intervals to hide its presence from traditional signature-based detection systems in the network.

Answer

Nmap

Answer

Metasploit

Answer

Burp Suite

Question 5

Which THREE of the following are considered hallmarks of steganography when used to hide data in network traffic?

Accepted Answer

High entropy in non-encrypted protocol header fields.. Steganography hides information within seemingly innocuous data, making detection difficult. By identifying these hallmarks, analysts can differentiate between standard protocol behavior and hidden tunnels. This is critical for uncovering data exfiltration or C2 communication that bypasses firewalls and DLP solutions. Understanding these indicators allows handlers to identify anomalies in protocol headers or payloads that are otherwise dismissed as noise.

Answer

Consistent packet headers across all transmitted sessions.

Answer

Frequent use of common protocols like HTTP.

Question 6

Refer to the exhibit. What is the effect of this AWS policy on access to the sensitive-data S3 bucket?

Accepted Answer

It allows access only to users within the 192.168.1.0/24 range.. This policy implements network-based access control, ensuring that only users originating from the specified CIDR block can access the data. This is a critical defensive measure for preventing data exfiltration by unauthorized entities. Incident handlers must understand these policies to determine if a data breach was facilitated by overly permissive IAM policies or if the existing security controls were successfully bypassed by an attacker.

Answer

It allows all users to access the bucket regardless of IP.

Answer

It denies all access to the bucket for all users.

Answer

It blocks access for users within the 192.168.1.0/24 range.

Question 7

An incident responder is investigating a compromised Windows host and suspects the presence of a covert command and control (C2) channel utilizing DNS tunneling. Which TWO registry locations or artifact categories should the analyst examine to identify DNS client cache activity and persistence associated with tunneling software?

Accepted Answer

The DNS Client service cache via PowerShell Get-DnsClientCache. Investigating DNS tunneling requires analyzing both the local DNS client cache to uncover historical malicious domain queries and examining Windows event logs specifically related to DNS client operations. These sources provide verifiable evidence of abnormal query volumes and structural encoding patterns used by tunneling tools.

Answer

SAM registry hive located at System32\config\SAM

Answer

SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key

Answer

NTUSER.DAT registry hive for the currently logged-in user

Question 8

During an incident response engagement on a Linux server, you discover suspicious outbound traffic communicating over raw sockets to an external IP address. The system administrator claims no custom applications are installed. Which utility should you run to inspect the process owning these raw socket file descriptors?

Accepted Answer

Execute lsof -n -P -i 4 -nn to list all open network files and map their socket inodes to active process IDs.. Using lsof with the appropriate flags lists open file descriptors for network sockets, including raw sockets. Incident handlers rely on this capability because malware often bypasses standard TCP/UDP logging by utilizing raw sockets for covert communication channels, making file descriptor inspection essential for uncovering hidden persistence and unauthorized network tunnels on compromised hosts.

Answer

Run netstat -antp to list all established TCP connections and map them to their corresponding process IDs.

Answer

Execute ss -raw to display raw socket statistics and associated socket memory allocation details.

Answer

Run ps auxww to inspect the full command line arguments of all running background system daemons.

Question 9

An incident responder is analyzing a memory dump from a compromised Windows 10 host. The responder suspects a rootkit is hiding a malicious driver. Which Volatility 3 plugin should be used to list loaded kernel modules and detect unlinked or hidden drivers?

Accepted Answer

windows.modules. In Volatility 3, the windows.modules plugin is designed to list loaded kernel modules and can identify hidden or unlinked drivers by comparing the module list with memory pool scans. This makes it the appropriate tool for detecting a rootkit that hides a malicious driver.

Answer

windows.callbacks

Answer

windows.driverscan

Answer

windows.ssdt

Question 10

An incident responder is examining a Windows workstation suspected of being part of a botnet. Network logs show periodic DNS queries for long, random-looking subdomains under the domain 'evil-c2.com'. The queries occur every 60 seconds. Which technique is the attacker most likely using?

Accepted Answer

Domain generation algorithm (DGA). The correct answer is domain generation algorithm (DGA). The scenario shows a compromised host making periodic DNS queries for random-looking subdomains under a single domain. This is a classic DGA pattern where malware generates many domain names to locate its C2 server, making it difficult for defenders to block the C2 domain. The regular 60-second interval suggests automated beaconing.

Answer

DNS cache poisoning

Answer

Fast flux DNS

Answer

DNS tunneling

Question 11

A security analyst notices that a user's workstation is communicating with an external IP address on port 53, but the traffic is not standard DNS. The packets are larger than typical DNS queries and contain binary data. Which type of covert channel is most likely being used?

Accepted Answer

DNS tunneling. The traffic on port 53 with large packets and binary data is most consistent with DNS tunneling. Attackers use DNS tunneling to exfiltrate data or establish command and control because DNS is often allowed through firewalls. The binary data is encoded into DNS queries and responses.

Answer

SSH tunneling

Answer

HTTP tunneling

Answer

ICMP tunneling

Question 12

An incident responder is investigating a suspected covert channel on a Linux server. The responder observes outbound traffic that uses the TCP protocol but does not match any known application signatures. The traffic is encrypted and sent to an external IP address on port 443. Which two indicators would suggest that this is a covert channel established by a tool like Cobalt Strike? (Choose two.)

Accepted Answer

The traffic exhibits regular beaconing intervals with jitter.. Cobalt Strike's HTTPS beacon typically uses regular beaconing with jitter and often employs a self-signed certificate. These two indicators, when combined with encrypted traffic to an external IP on port 443, strongly suggest a covert channel. Other options are either not typical of Cobalt Strike or too generic to be reliable indicators.

Answer

The traffic is sent to a known cloud service IP address.

Answer

The traffic uses the UDP protocol on port 443.

Answer

The traffic contains HTTP GET requests with long, random-looking URIs.

Question 13

An incident responder is analyzing a Linux server that is suspected of being compromised. The server is exhibiting unusual outbound network traffic. Which TWO of the following commands would be most useful to identify processes that have established network connections? (Choose two.)

Accepted Answer

lsof -i. The correct answers are ss -tup and lsof -i. Both commands provide a mapping between network connections and the processes that own them. ss is a modern replacement for netstat and shows established connections with process information. lsof -i lists network sockets and their owning processes. Together, they allow an incident responder to quickly identify suspicious processes communicating over the network.

Answer

ifconfig -a

Answer

ps aux

Answer

netstat -tulpn

Question 14

An incident responder is examining a memory dump from a compromised Windows host. The responder suspects that an attacker used a reflective DLL injection technique to load a malicious payload. Which artifact in memory would best confirm this?

Accepted Answer

A memory region with PAGE_EXECUTE_READWRITE permissions that contains a PE header. The correct answer is a memory region with PAGE_EXECUTE_READWRITE permissions that contains a PE header. Reflective DLL injection maps a DLL into memory without using the Windows loader, often resulting in executable memory regions that contain a PE header. This is a strong indicator of the technique. Other options may indicate injection but are not as specific to reflective loading.

Answer

An entry in the PEB's InLoadOrderModuleList for a DLL that does not exist on disk

Answer

A thread that is not associated with any known module

Answer

A DLL with a suspicious name loaded from a non-standard path

Question 15

An adversary uses PowerShell to establish a reverse shell. The command includes the '-EncodedCommand' flag with a long Base64 string. What is the most effective way to detect this activity without relying on static command signatures?

Accepted Answer

Enable PowerShell Script Block Logging to capture de-obfuscated code.. Static signatures fail against randomized Base64 encoding. Behavioral detection, specifically script block logging, captures the de-obfuscated code before execution. This is essential for incident handlers because attackers frequently use obfuscation to bypass simple keyword filters. Script block logging provides the exact command executed in memory, allowing for accurate analysis of the intent regardless of the obfuscation technique employed by the attacker.

Answer

Block all outbound connections originating from PowerShell processes.

Answer

Monitor for any usage of the 'powershell.exe' process in logs.

Answer

Perform string analysis on all files in the system directories.