GCIH Endpoint Attack and Pivoting — Timed 25 Questions

Question 1

An attacker has compromised a Windows workstation and successfully injected a beacon into a legitimate process. They wish to perform lateral movement using Mimikatz to extract credentials from LSASS. Which technique minimizes the likelihood of triggering endpoint detection for credential dumping?

25 minute time limit — choose an answer to begin.

Accepted Answer

Create a minidump of the LSASS process and exfiltrate it for offline analysis.. Extracting credentials directly from the Local Security Authority Subsystem Service (LSASS) memory is a high-fidelity alert for modern EDR solutions. Utilizing a memory-safe approach like leveraging existing cached tokens or performing a minidump via a less suspicious tool helps evade heuristic detection. Incident responders monitor LSASS access patterns closely, so minimizing interaction with this process is crucial for maintaining stealth while performing post-exploitation activities within a compromised network environment.

Answer

Invoke Mimikatz 'sekurlsa::logonpasswords' directly from the command line.

Answer

Use the 'lsadump::sam' command while running as a standard user.

Answer

Inject a malicious DLL into the LSASS process space to capture passwords.

Question 2

An attacker is pivoting through a network using SSH dynamic port forwarding. Which TWO actions should an incident responder perform to identify and disrupt this tunnel?

Accepted Answer

Identify the process holding the open socket using netstat or lsof.. Identifying SSH tunneling requires analyzing network flow data for persistent, low-bandwidth connections originating from an internal host to an external IP, often over non-standard ports or SSH defaults. Disrupting these tunnels necessitates both blocking the external destination at the firewall and killing the specific process on the infected endpoint to prevent persistence. Understanding the mechanics of SSH dynamic forwarding is essential for incident handlers to effectively neutralize active pivot points.

Answer

Reset the user's password on the domain controller.

Answer

Flush the DNS cache on the compromised workstation.

Answer

Clear the Windows Security Event Logs to remove evidence of the login.

Question 3

Which THREE of the following are common indicators of 'living off the land' (LotL) techniques used during pivoting?

Accepted Answer

Execution of encoded PowerShell commands via hidden windows.. Living off the land techniques involve using built-in system tools like PowerShell, WMI, and BITS to execute attacks. Because these tools are trusted and signed by the vendor, they bypass traditional signature-based defenses. Incident responders must focus on behavioral analysis, command-line auditing, and script block logging to detect these activities, as the presence of the binary itself is not an indicator of compromise.

Answer

Presence of a known malicious hash like 'eicar.com'.

Answer

Normal user browsing the internet using Microsoft Edge.

Question 4

Refer to the exhibit. Which security control is most effective at preventing this specific pivot-related activity?

Accepted Answer

Implementing PowerShell Constrained Language Mode (CLM).. The command shows the use of PowerShell to download a file from an internal or external source. Implementing Constrained Language Mode (CLM) and restricting PowerShell's ability to initiate network connections through AppLocker or Windows Defender Application Control (WDAC) are critical. Furthermore, network segmentation prevents compromised endpoints from reaching unauthorized internal servers, limiting the attacker's ability to stage tools during the pivoting phase of an attack.

Answer

Enabling Windows Firewall to block all outbound traffic.

Answer

Disabling the Guest account on all workstations.

Answer

Regularly clearing the system audit logs.

Question 5

During lateral movement, an attacker attempts to clear their tracks. Which TWO actions would effectively prevent the incident responder from identifying the source of the compromise?

Accepted Answer

Deleting the contents of the Prefetch folder.. Attackers prioritize log clearing and artifact removal to slow down incident response. Clearing Windows Event Logs (e.g., Security, System) destroys critical evidence of authentication and process creation. Deleting temporary files and prefetch artifacts makes it difficult for responders to perform timeline analysis, which is essential for determining the initial entry point and the extent of lateral movement across the network.

Answer

Changing the desktop background image.

Answer

Renaming a system file to 'temp.exe'.

Answer

Restarting the computer after the attack.

Question 6

Which of the following is a 'lateral movement' technique that leverages legitimate cloud service APIs?

Accepted Answer

Using 'az login' with stolen credentials to move between instances.. Attackers can use cloud administrative tools (like Azure CLI or AWS CLI) to move between cloud instances if they steal a session token or API key from a compromised endpoint. Since these tools are signed and expected in the environment, their usage is often overlooked by security teams who focus primarily on on-premises threats rather than the hybrid cloud attack surface.

Answer

Running a local brute-force attack against SSH.

Answer

Modifying the local 'hosts' file for DNS spoofing.

Answer

Downloading the entire contents of a public bucket.

Question 7

An incident responder identifies an active SSH port forwarding tunnel originating from a compromised Linux server to an internal database host. The attacker is using this tunnel to query the database. Which command executed on the compromised endpoint would confirm the active listening socket binding details and associated process PID for this tunnel?

Accepted Answer

netstat -tulpn. Using netstat with the -tulpn flags displays TCP ports, listening status, numeric addresses, and the process ID holding the socket open. This is critical during incident response to map network connections directly to running malicious processes, establishing persistence or lateral movement mechanisms on the compromised endpoint.

Answer

ss -tulpn

Answer

ps -ef --forest

Answer

lsof -i -P -n

Question 8

An analyst discovers that an attacker has established persistence and a pivoting channel on a domain-joined Windows server using PsExec. Which TWO forensic artifacts or log sources should the analyst examine to identify evidence of this activity? (Choose TWO)

Accepted Answer

Windows Security Event Log ID 4697 indicating new service installation. PsExec relies on creating a remote service named PSEXESVC and writing corresponding binaries to the ADMIN$ share. Examining Windows Security Event logs for service creation events and inspecting the filesystem for residual temporary binaries provides definitive proof of lateral movement and endpoint compromise.

Answer

PowerShell Script Block Logging Event ID 4104 showing interactive console inputs

Answer

DNS query logs for external command and control domain resolution requests

Answer

DHCP lease allocation logs showing dynamic IP address reassignments

Question 9

An attacker has gained access to a Windows workstation and is attempting to pivot to a database server on the same subnet. The database server only allows connections from the compromised workstation's IP address. The attacker wants to use the compromised workstation as a proxy to interact with the database server. Which two techniques would allow the attacker to achieve this pivot? (Choose two.)

Accepted Answer

Use SSH local port forwarding from the workstation to the database server.. The attacker needs to relay connections through the compromised workstation to reach the database server. netsh interface portproxy creates a port forwarder on the workstation, and SSH local port forwarding tunnels traffic through an SSH connection. Both methods make the database server see connections originating from the workstation's IP, satisfying the access control.

Answer

Use a reverse shell from the database server to the workstation.

Answer

Use ARP spoofing to redirect database traffic through the workstation.

Answer

Use a SOCKS proxy server on the workstation and configure the attacker's tools to use it.

Question 10

An attacker has compromised a Windows workstation and successfully injected a beacon into a legitimate process. They wish to perform lateral movement using Mimikatz to extract credentials from LSASS. Which technique minimizes the likelihood of triggering endpoint detection for credential dumping?

25 minute time limit — choose an answer to begin.

Accepted Answer

netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=3389 connectaddress=10.10.10.5. The netsh interface portproxy command creates a TCP proxy that listens on a specified port and forwards traffic to a target address and port. For a pivot, the compromised host must listen on an interface reachable by the attacker, typically 0.0.0.0, and forward to the internal server. The correct command includes the full context and proper port mapping. The other options contain syntax errors or incorrect port mappings.

Answer

netsh portproxy add v4tov4 listenport=8080 connectport=3389 connectaddress=10.10.10.5

Answer

netsh interface portproxy add v4tov4 listenport=8080 listenaddress=127.0.0.1 connectport=3389 connectaddress=10.10.10.5

Answer

netsh interface portproxy add v4tov4 listenport=3389 listenaddress=0.0.0.0 connectport=8080 connectaddress=10.10.10.5

Question 11

During an investigation, you discover that an attacker used the Windows `runas` command with the `/savecred` option on a compromised workstation to execute a malicious binary under a cached domain administrator account. The attacker then deleted the binary and cleared the Security event log. Which of the following forensic artifacts would MOST likely still contain evidence of the account used and the execution of the binary?

Accepted Answer

Windows Credential Manager vault files under %AppData%\Microsoft\Credentials. The `runas /savecred` option caches credentials in the Windows Credential Manager, which stores them in encrypted vault files within the user's profile. These files persist after log clearing and binary deletion, and can be decrypted to reveal the saved username and domain. Security event logs and execution artifacts like Prefetch or Amcache do not reliably retain the account information or are removed by the attacker's actions.

Answer

Security event log entries for process creation with event ID 4688

Answer

Prefetch file for the malicious binary

Answer

Amcache.hve entries for the malicious binary

Question 12

An incident responder is investigating a suspected pivot on a Windows server. The attacker may have used the Windows Remote Management (WinRM) service to execute commands on the server from a compromised workstation. Which TWO artifacts or indicators should the responder examine to confirm and analyze this lateral movement? (Choose two.)

Accepted Answer

Windows Event Log entries in the Microsoft-Windows-WinRM/Operational log.. To confirm WinRM-based lateral movement, the responder should examine the Microsoft-Windows-WinRM/Operational log for connection and command execution events, and the PowerShell Operational log for script block logging that captures the actual commands run. These artifacts provide direct evidence of WinRM activity and its content. The other options are either normal system states or non-specific indicators.

Answer

The Windows Firewall log for inbound connections on port 5985.

Answer

The Security event log for event ID 4624 with logon type 3.

Answer

The presence of a service named 'WinRM' running on the server.

Question 13

Refer to the exhibit. An attacker attempts to establish persistence by creating a new service. Why did the command fail?

Accepted Answer

The command syntax is incorrect for creating a service.. The 'sc query' command is used to inspect existing services, not to register new ones. The attacker attempted to use the query syntax rather than the 'create' command to define the service. Understanding the proper syntax for service manipulation is critical for incident handlers to identify how attackers attempt to achieve persistence via Windows Service Control Manager or other system-level configuration methods.

Answer

The service has already been deleted by the system.

Answer

The 'sc' command does not support the 'binPath' argument.

Answer

The user lacks sufficient privileges to query services.

Question 14

An attacker is using WMI (Windows Management Instrumentation) to move laterally. Which WMI class and method combination is frequently abused for remote process execution?

Accepted Answer

Win32_Process, Create. The Win32_Process class, specifically the Create method, allows for the execution of arbitrary commands on remote systems. Incident responders often look for WMI-based process creation events in logs to detect lateral movement. Because WMI is a legitimate administrative tool, distinguishing between normal management traffic and malicious movement is a key challenge for detection and response teams.

Answer

Win32_Service, StartService

Answer

Win32_StartupCommand, Create

Answer

Win32_ScheduledJob, Create

Question 15

During an investigation, you observe an attacker using 'PsExec' to move laterally. What is the primary artifact created by PsExec that can be used to track its execution across the network?

Accepted Answer

The installation of a service named 'PSEXESVC'.. PsExec functions by creating a remote service named 'PSEXESVC' on the target machine. This service executes the payload and is then cleaned up. Identifying the creation and deletion of this specific service name in the Windows System event logs (Event ID 7045) is the most reliable way to track PsExec activity, provided that the logs have not been cleared by the attacker.

Answer

The creation of a temporary file named 'psexec.exe' in the root directory.

Answer

An entry in the 'Run' registry key for persistence.

Answer

A specific user-mode process named 'psexec_agent'.

Question 16

An attacker has compromised a Linux host and is pivoting using a SOCKS proxy. Which tool is most commonly utilized for this purpose in a cross-platform environment?

Accepted Answer

Chisel. Chisel is a fast, TCP/UDP tunnel over HTTP, secured via SSH, that is widely used for creating SOCKS proxies. Its ease of use and ability to bypass firewalls make it a favorite for attackers. Incident responders must understand how to detect Chisel traffic, which often mimics standard HTTPS traffic, by inspecting packet sizes and connection duration patterns.

Answer

Netcat

Answer

Tcpdump

Answer

Wget

Question 17

Why are 'Pass-the-Hash' (PtH) attacks effective for pivoting in a Windows environment?

Accepted Answer

Because NTLM authentication does not require the password itself.. PtH attacks leverage the NTLM hash directly to authenticate, bypassing the need for the plaintext password. Because Windows stores these hashes in LSASS for single-sign-on capabilities, an attacker who gains administrative rights can extract them and reuse them to access other systems in the domain. This is a fundamental risk in environments where users have local admin rights on their workstations.

Answer

Because they force a password reset on the target.

Answer

Because they only work on Linux-based domain controllers.

Answer

Because the hash is always encrypted with AES-256.

Question 18

Which of the following describes the 'SMB Relay' attack during lateral movement?

Accepted Answer

Intercepting authentication and relaying it to another machine.. SMB Relay works by intercepting a client's authentication request (SMB) and forwarding it to another target machine. If the client has sufficient privileges, the attacker gains access to the target without ever needing the user's password. This attack is particularly dangerous in environments without SMB signing enabled, as it allows for easy lateral movement through man-in-the-middle positioning within the local network segment.

Answer

Encrypting files on the network share.

Answer

Sending flood packets to crash the SMB service.

Answer

Replacing the SMB.exe binary with a malicious version.

Question 19

What is the primary function of the 'Token Manipulation' technique in Windows pivoting?

Accepted Answer

To impersonate another user's security context.. Token manipulation involves stealing an access token from a process running as a different user (e.g., SYSTEM or an Administrator) and using it to spawn a new process. This allows the attacker to elevate their privileges or move laterally as a different user. Understanding this technique is vital for incident handlers because it explains how attackers maintain high-level access without knowing user passwords.

Answer

To hide files in a hidden directory.

Answer

To bypass user authentication prompts.

Answer

To encrypt the memory of a running process.

Question 20

An incident responder investigating a compromised Windows workstation discovers that an attacker established persistent command and control using a malicious DLL. The DLL was placed in a system directory and loaded by a legitimate, signed Microsoft binary through DLL search order hijacking. Which response action effectively remediates the persistence while preserving the legitimate binary and minimizing host downtime?

Accepted Answer

Locate and securely delete the rogue malicious DLL file from the search path while preserving the legitimate signed binary and auditing registry permissions.. Identifying and removing the malicious payload while keeping the legitimate application intact is critical for operational continuity during incident response. DLL search order hijacking exploits how Windows searches for dependent libraries. Replacing or removing the unauthorized payload neutralizes the execution vector without requiring a full OS reinstallation, allowing investigators to focus on lateral movement and containment.

Answer

Reimage the compromised workstation immediately to ensure all hidden artifacts and registry hooks are completely removed from the operating system.

Answer

Delete the legitimate signed Microsoft binary that loaded the malicious payload to prevent any further execution attempts by the operating system.

Answer

Modify the Windows Registry to disable the DLL loading subsystem entirely across the domain to prevent all future instances of search order hijacking.