GCIH Endpoint Attack and Pivoting — Timed 10 Questions

Question 1

An attacker has compromised a Windows workstation and successfully injected a beacon into a legitimate process. They wish to perform lateral movement using Mimikatz to extract credentials from LSASS. Which technique minimizes the likelihood of triggering endpoint detection for credential dumping?

10 minute time limit — choose an answer to begin.

Accepted Answer

Create a minidump of the LSASS process and exfiltrate it for offline analysis.. Extracting credentials directly from the Local Security Authority Subsystem Service (LSASS) memory is a high-fidelity alert for modern EDR solutions. Utilizing a memory-safe approach like leveraging existing cached tokens or performing a minidump via a less suspicious tool helps evade heuristic detection. Incident responders monitor LSASS access patterns closely, so minimizing interaction with this process is crucial for maintaining stealth while performing post-exploitation activities within a compromised network environment.

Answer

Invoke Mimikatz 'sekurlsa::logonpasswords' directly from the command line.

Answer

Use the 'lsadump::sam' command while running as a standard user.

Answer

Inject a malicious DLL into the LSASS process space to capture passwords.

Question 2

An attacker is pivoting through a network using SSH dynamic port forwarding. Which TWO actions should an incident responder perform to identify and disrupt this tunnel?

Accepted Answer

Identify the process holding the open socket using netstat or lsof.. Identifying SSH tunneling requires analyzing network flow data for persistent, low-bandwidth connections originating from an internal host to an external IP, often over non-standard ports or SSH defaults. Disrupting these tunnels necessitates both blocking the external destination at the firewall and killing the specific process on the infected endpoint to prevent persistence. Understanding the mechanics of SSH dynamic forwarding is essential for incident handlers to effectively neutralize active pivot points.

Answer

Reset the user's password on the domain controller.

Answer

Flush the DNS cache on the compromised workstation.

Answer

Clear the Windows Security Event Logs to remove evidence of the login.

Question 3

Which THREE of the following are common indicators of 'living off the land' (LotL) techniques used during pivoting?

Accepted Answer

Execution of encoded PowerShell commands via hidden windows.. Living off the land techniques involve using built-in system tools like PowerShell, WMI, and BITS to execute attacks. Because these tools are trusted and signed by the vendor, they bypass traditional signature-based defenses. Incident responders must focus on behavioral analysis, command-line auditing, and script block logging to detect these activities, as the presence of the binary itself is not an indicator of compromise.

Answer

Presence of a known malicious hash like 'eicar.com'.

Answer

Normal user browsing the internet using Microsoft Edge.

Question 4

Refer to the exhibit. Which security control is most effective at preventing this specific pivot-related activity?

Accepted Answer

Implementing PowerShell Constrained Language Mode (CLM).. The command shows the use of PowerShell to download a file from an internal or external source. Implementing Constrained Language Mode (CLM) and restricting PowerShell's ability to initiate network connections through AppLocker or Windows Defender Application Control (WDAC) are critical. Furthermore, network segmentation prevents compromised endpoints from reaching unauthorized internal servers, limiting the attacker's ability to stage tools during the pivoting phase of an attack.

Answer

Enabling Windows Firewall to block all outbound traffic.

Answer

Disabling the Guest account on all workstations.

Answer

Regularly clearing the system audit logs.

Question 5

During lateral movement, an attacker attempts to clear their tracks. Which TWO actions would effectively prevent the incident responder from identifying the source of the compromise?

Accepted Answer

Deleting the contents of the Prefetch folder.. Attackers prioritize log clearing and artifact removal to slow down incident response. Clearing Windows Event Logs (e.g., Security, System) destroys critical evidence of authentication and process creation. Deleting temporary files and prefetch artifacts makes it difficult for responders to perform timeline analysis, which is essential for determining the initial entry point and the extent of lateral movement across the network.

Answer

Changing the desktop background image.

Answer

Renaming a system file to 'temp.exe'.

Answer

Restarting the computer after the attack.

Question 6

Which of the following is a 'lateral movement' technique that leverages legitimate cloud service APIs?

Accepted Answer

Using 'az login' with stolen credentials to move between instances.. Attackers can use cloud administrative tools (like Azure CLI or AWS CLI) to move between cloud instances if they steal a session token or API key from a compromised endpoint. Since these tools are signed and expected in the environment, their usage is often overlooked by security teams who focus primarily on on-premises threats rather than the hybrid cloud attack surface.

Answer

Running a local brute-force attack against SSH.

Answer

Modifying the local 'hosts' file for DNS spoofing.

Answer

Downloading the entire contents of a public bucket.

Question 7

An incident responder identifies an active SSH port forwarding tunnel originating from a compromised Linux server to an internal database host. The attacker is using this tunnel to query the database. Which command executed on the compromised endpoint would confirm the active listening socket binding details and associated process PID for this tunnel?

Accepted Answer

netstat -tulpn. Using netstat with the -tulpn flags displays TCP ports, listening status, numeric addresses, and the process ID holding the socket open. This is critical during incident response to map network connections directly to running malicious processes, establishing persistence or lateral movement mechanisms on the compromised endpoint.

Answer

ss -tulpn

Answer

ps -ef --forest

Answer

lsof -i -P -n

Question 8

An analyst discovers that an attacker has established persistence and a pivoting channel on a domain-joined Windows server using PsExec. Which TWO forensic artifacts or log sources should the analyst examine to identify evidence of this activity? (Choose TWO)

Accepted Answer

Windows Security Event Log ID 4697 indicating new service installation. PsExec relies on creating a remote service named PSEXESVC and writing corresponding binaries to the ADMIN$ share. Examining Windows Security Event logs for service creation events and inspecting the filesystem for residual temporary binaries provides definitive proof of lateral movement and endpoint compromise.

Answer

PowerShell Script Block Logging Event ID 4104 showing interactive console inputs

Answer

DNS query logs for external command and control domain resolution requests

Answer

DHCP lease allocation logs showing dynamic IP address reassignments

Question 9

An attacker has gained access to a Windows workstation and is attempting to pivot to a database server on the same subnet. The database server only allows connections from the compromised workstation's IP address. The attacker wants to use the compromised workstation as a proxy to interact with the database server. Which two techniques would allow the attacker to achieve this pivot? (Choose two.)

Accepted Answer

Use SSH local port forwarding from the workstation to the database server.. The attacker needs to relay connections through the compromised workstation to reach the database server. netsh interface portproxy creates a port forwarder on the workstation, and SSH local port forwarding tunnels traffic through an SSH connection. Both methods make the database server see connections originating from the workstation's IP, satisfying the access control.

Answer

Use a reverse shell from the database server to the workstation.

Answer

Use ARP spoofing to redirect database traffic through the workstation.

Answer

Use a SOCKS proxy server on the workstation and configure the attacker's tools to use it.

Question 10

An attacker has compromised a Windows workstation and successfully injected a beacon into a legitimate process. They wish to perform lateral movement using Mimikatz to extract credentials from LSASS. Which technique minimizes the likelihood of triggering endpoint detection for credential dumping?

10 minute time limit — choose an answer to begin.

Accepted Answer

netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=3389 connectaddress=10.10.10.5. The netsh interface portproxy command creates a TCP proxy that listens on a specified port and forwards traffic to a target address and port. For a pivot, the compromised host must listen on an interface reachable by the attacker, typically 0.0.0.0, and forward to the internal server. The correct command includes the full context and proper port mapping. The other options contain syntax errors or incorrect port mappings.

Answer

netsh portproxy add v4tov4 listenport=8080 connectport=3389 connectaddress=10.10.10.5

Answer

netsh interface portproxy add v4tov4 listenport=8080 listenaddress=127.0.0.1 connectport=3389 connectaddress=10.10.10.5

Answer

netsh interface portproxy add v4tov4 listenport=3389 listenaddress=0.0.0.0 connectport=8080 connectaddress=10.10.10.5