GCIH Endpoint Attack and Pivoting — 15 Questions

Question 1

An attacker has compromised a Windows workstation and successfully injected a beacon into a legitimate process. They wish to perform lateral movement using Mimikatz to extract credentials from LSASS. Which technique minimizes the likelihood of triggering endpoint detection for credential dumping?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a minidump of the LSASS process and exfiltrate it for offline analysis.. Extracting credentials directly from the Local Security Authority Subsystem Service (LSASS) memory is a high-fidelity alert for modern EDR solutions. Utilizing a memory-safe approach like leveraging existing cached tokens or performing a minidump via a less suspicious tool helps evade heuristic detection. Incident responders monitor LSASS access patterns closely, so minimizing interaction with this process is crucial for maintaining stealth while performing post-exploitation activities within a compromised network environment.

Answer

Invoke Mimikatz 'sekurlsa::logonpasswords' directly from the command line.

Answer

Use the 'lsadump::sam' command while running as a standard user.

Answer

Inject a malicious DLL into the LSASS process space to capture passwords.

Question 2

An attacker is pivoting through a network using SSH dynamic port forwarding. Which TWO actions should an incident responder perform to identify and disrupt this tunnel?

Accepted Answer

Identify the process holding the open socket using netstat or lsof.. Identifying SSH tunneling requires analyzing network flow data for persistent, low-bandwidth connections originating from an internal host to an external IP, often over non-standard ports or SSH defaults. Disrupting these tunnels necessitates both blocking the external destination at the firewall and killing the specific process on the infected endpoint to prevent persistence. Understanding the mechanics of SSH dynamic forwarding is essential for incident handlers to effectively neutralize active pivot points.

Answer

Reset the user's password on the domain controller.

Answer

Flush the DNS cache on the compromised workstation.

Answer

Clear the Windows Security Event Logs to remove evidence of the login.

Question 3

Which THREE of the following are common indicators of 'living off the land' (LotL) techniques used during pivoting?

Accepted Answer

Execution of encoded PowerShell commands via hidden windows.. Living off the land techniques involve using built-in system tools like PowerShell, WMI, and BITS to execute attacks. Because these tools are trusted and signed by the vendor, they bypass traditional signature-based defenses. Incident responders must focus on behavioral analysis, command-line auditing, and script block logging to detect these activities, as the presence of the binary itself is not an indicator of compromise.

Answer

Presence of a known malicious hash like 'eicar.com'.

Answer

Normal user browsing the internet using Microsoft Edge.

Question 4

Refer to the exhibit. Which security control is most effective at preventing this specific pivot-related activity?

Accepted Answer

Implementing PowerShell Constrained Language Mode (CLM).. The command shows the use of PowerShell to download a file from an internal or external source. Implementing Constrained Language Mode (CLM) and restricting PowerShell's ability to initiate network connections through AppLocker or Windows Defender Application Control (WDAC) are critical. Furthermore, network segmentation prevents compromised endpoints from reaching unauthorized internal servers, limiting the attacker's ability to stage tools during the pivoting phase of an attack.

Answer

Enabling Windows Firewall to block all outbound traffic.

Answer

Disabling the Guest account on all workstations.

Answer

Regularly clearing the system audit logs.

Question 5

During lateral movement, an attacker attempts to clear their tracks. Which TWO actions would effectively prevent the incident responder from identifying the source of the compromise?

Accepted Answer

Deleting the contents of the Prefetch folder.. Attackers prioritize log clearing and artifact removal to slow down incident response. Clearing Windows Event Logs (e.g., Security, System) destroys critical evidence of authentication and process creation. Deleting temporary files and prefetch artifacts makes it difficult for responders to perform timeline analysis, which is essential for determining the initial entry point and the extent of lateral movement across the network.

Answer

Changing the desktop background image.

Answer

Renaming a system file to 'temp.exe'.

Answer

Restarting the computer after the attack.

Question 6

Which of the following is a 'lateral movement' technique that leverages legitimate cloud service APIs?

Accepted Answer

Using 'az login' with stolen credentials to move between instances.. Attackers can use cloud administrative tools (like Azure CLI or AWS CLI) to move between cloud instances if they steal a session token or API key from a compromised endpoint. Since these tools are signed and expected in the environment, their usage is often overlooked by security teams who focus primarily on on-premises threats rather than the hybrid cloud attack surface.

Answer

Running a local brute-force attack against SSH.

Answer

Modifying the local 'hosts' file for DNS spoofing.

Answer

Downloading the entire contents of a public bucket.

Question 7

An incident responder identifies an active SSH port forwarding tunnel originating from a compromised Linux server to an internal database host. The attacker is using this tunnel to query the database. Which command executed on the compromised endpoint would confirm the active listening socket binding details and associated process PID for this tunnel?

Accepted Answer

netstat -tulpn. Using netstat with the -tulpn flags displays TCP ports, listening status, numeric addresses, and the process ID holding the socket open. This is critical during incident response to map network connections directly to running malicious processes, establishing persistence or lateral movement mechanisms on the compromised endpoint.

Answer

ss -tulpn

Answer

ps -ef --forest

Answer

lsof -i -P -n

Question 8

An analyst discovers that an attacker has established persistence and a pivoting channel on a domain-joined Windows server using PsExec. Which TWO forensic artifacts or log sources should the analyst examine to identify evidence of this activity? (Choose TWO)

Accepted Answer

Windows Security Event Log ID 4697 indicating new service installation. PsExec relies on creating a remote service named PSEXESVC and writing corresponding binaries to the ADMIN$ share. Examining Windows Security Event logs for service creation events and inspecting the filesystem for residual temporary binaries provides definitive proof of lateral movement and endpoint compromise.

Answer

PowerShell Script Block Logging Event ID 4104 showing interactive console inputs

Answer

DNS query logs for external command and control domain resolution requests

Answer

DHCP lease allocation logs showing dynamic IP address reassignments

Question 9

An attacker has gained access to a Windows workstation and is attempting to pivot to a database server on the same subnet. The database server only allows connections from the compromised workstation's IP address. The attacker wants to use the compromised workstation as a proxy to interact with the database server. Which two techniques would allow the attacker to achieve this pivot? (Choose two.)

Accepted Answer

Use SSH local port forwarding from the workstation to the database server.. The attacker needs to relay connections through the compromised workstation to reach the database server. netsh interface portproxy creates a port forwarder on the workstation, and SSH local port forwarding tunnels traffic through an SSH connection. Both methods make the database server see connections originating from the workstation's IP, satisfying the access control.

Answer

Use a reverse shell from the database server to the workstation.

Answer

Use ARP spoofing to redirect database traffic through the workstation.

Answer

Use a SOCKS proxy server on the workstation and configure the attacker's tools to use it.

Question 10

An attacker has compromised a Windows workstation and successfully injected a beacon into a legitimate process. They wish to perform lateral movement using Mimikatz to extract credentials from LSASS. Which technique minimizes the likelihood of triggering endpoint detection for credential dumping?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=3389 connectaddress=10.10.10.5. The netsh interface portproxy command creates a TCP proxy that listens on a specified port and forwards traffic to a target address and port. For a pivot, the compromised host must listen on an interface reachable by the attacker, typically 0.0.0.0, and forward to the internal server. The correct command includes the full context and proper port mapping. The other options contain syntax errors or incorrect port mappings.

Answer

netsh portproxy add v4tov4 listenport=8080 connectport=3389 connectaddress=10.10.10.5

Answer

netsh interface portproxy add v4tov4 listenport=8080 listenaddress=127.0.0.1 connectport=3389 connectaddress=10.10.10.5

Answer

netsh interface portproxy add v4tov4 listenport=3389 listenaddress=0.0.0.0 connectport=8080 connectaddress=10.10.10.5

Question 11

During an investigation, you discover that an attacker used the Windows `runas` command with the `/savecred` option on a compromised workstation to execute a malicious binary under a cached domain administrator account. The attacker then deleted the binary and cleared the Security event log. Which of the following forensic artifacts would MOST likely still contain evidence of the account used and the execution of the binary?

Accepted Answer

Windows Credential Manager vault files under %AppData%\Microsoft\Credentials. The `runas /savecred` option caches credentials in the Windows Credential Manager, which stores them in encrypted vault files within the user's profile. These files persist after log clearing and binary deletion, and can be decrypted to reveal the saved username and domain. Security event logs and execution artifacts like Prefetch or Amcache do not reliably retain the account information or are removed by the attacker's actions.

Answer

Security event log entries for process creation with event ID 4688

Answer

Prefetch file for the malicious binary

Answer

Amcache.hve entries for the malicious binary

Question 12

An incident responder is investigating a suspected pivot on a Windows server. The attacker may have used the Windows Remote Management (WinRM) service to execute commands on the server from a compromised workstation. Which TWO artifacts or indicators should the responder examine to confirm and analyze this lateral movement? (Choose two.)

Accepted Answer

Windows Event Log entries in the Microsoft-Windows-WinRM/Operational log.. To confirm WinRM-based lateral movement, the responder should examine the Microsoft-Windows-WinRM/Operational log for connection and command execution events, and the PowerShell Operational log for script block logging that captures the actual commands run. These artifacts provide direct evidence of WinRM activity and its content. The other options are either normal system states or non-specific indicators.

Answer

The Windows Firewall log for inbound connections on port 5985.

Answer

The Security event log for event ID 4624 with logon type 3.

Answer

The presence of a service named 'WinRM' running on the server.

Question 13

Refer to the exhibit. An attacker attempts to establish persistence by creating a new service. Why did the command fail?

Accepted Answer

The command syntax is incorrect for creating a service.. The 'sc query' command is used to inspect existing services, not to register new ones. The attacker attempted to use the query syntax rather than the 'create' command to define the service. Understanding the proper syntax for service manipulation is critical for incident handlers to identify how attackers attempt to achieve persistence via Windows Service Control Manager or other system-level configuration methods.

Answer

The service has already been deleted by the system.

Answer

The 'sc' command does not support the 'binPath' argument.

Answer

The user lacks sufficient privileges to query services.

Question 14

An attacker is using WMI (Windows Management Instrumentation) to move laterally. Which WMI class and method combination is frequently abused for remote process execution?

Accepted Answer

Win32_Process, Create. The Win32_Process class, specifically the Create method, allows for the execution of arbitrary commands on remote systems. Incident responders often look for WMI-based process creation events in logs to detect lateral movement. Because WMI is a legitimate administrative tool, distinguishing between normal management traffic and malicious movement is a key challenge for detection and response teams.

Answer

Win32_Service, StartService

Answer

Win32_StartupCommand, Create

Answer

Win32_ScheduledJob, Create

Question 15

During an investigation, you observe an attacker using 'PsExec' to move laterally. What is the primary artifact created by PsExec that can be used to track its execution across the network?

Accepted Answer

The installation of a service named 'PSEXESVC'.. PsExec functions by creating a remote service named 'PSEXESVC' on the target machine. This service executes the payload and is then cleaned up. Identifying the creation and deletion of this specific service name in the Windows System event logs (Event ID 7045) is the most reliable way to track PsExec activity, provided that the logs have not been cleared by the attacker.

Answer

The creation of a temporary file named 'psexec.exe' in the root directory.

Answer

An entry in the 'Run' registry key for persistence.

Answer

A specific user-mode process named 'psexec_agent'.