An attacker is attempting to use a 'Pass-the-Hash' technique. Which authentication log event code in Windows (Event ID 4624) should you look for to detect this?
A user reports receiving a suspicious email containing an attachment. Which Splunk ES feature allows you to quickly search for this file hash across your environment?
You notice a high volume of traffic from an internal workstation to a non-standard port on an external server. Which search helps identify the frequency of this connection?
While monitoring your Splunk ES environment, you notice a spike in authentication failures for multiple user accounts originating from a single external IP address. The failures occur within a short time window and target different usernames. Which type of attack is most likely occurring?
A security analyst is investigating a potential Kerberoasting attack. Which Splunk ES data model and field would best identify service ticket requests with weak encryption?
A Splunk ES analyst is investigating a potential data exfiltration incident. The analyst suspects that an attacker is using DNS queries to transfer data out of the network. Which of the following Splunk ES correlation searches is specifically designed to detect this type of activity?
During an investigation, an analyst observes a Linux server where the /tmp directory contains an executable that opens a raw socket and communicates with an external IP on port 4444. The process is running as root but the parent process is no longer present. Which Splunk ES data source and field combination best supports confirming this as a reverse shell?
A Splunk ES analyst needs to identify potential data exfiltration over HTTP by looking for large outbound POST requests. Which data model and field should be used to calculate the total bytes sent?
An analyst is investigating a suspected supply chain compromise where a trusted software update mechanism may have delivered malicious code. Which TWO of the following Splunk ES activities best support determining whether the update was tampered with? (Choose two.)
You are investigating a potential insider threat involving unauthorized data exfiltration. Which Splunk ES feature allows you to correlate multiple events occurring over a long duration to a single entity?
A SOC analyst observes an unusual spike in failed login attempts followed by a successful login from a new IP address. Which Splunk Enterprise Security dashboard should the analyst check to confirm if this is a potential brute-force attack?
An analyst wants to investigate a suspicious email attachment. Which Splunk ES notable event field is most effective for pivoting to the 'File' domain investigation dashboard?
You are auditing logs and find that a user has modified an audit policy using 'auditpol.exe'. Which Splunk CIM data model should contain this information?
A malware infection is suspected on a host. You notice traffic on port 445. Which Splunk ES correlation search should be prioritized to investigate lateral movement?
An analyst identifies a command-and-control (C2) beaconing pattern. Which search command would be best used to identify the frequency of connections to a specific domain?
You are investigating a user who has triggered multiple high-risk alerts. Where in Splunk ES can you view the historical risk score progression for this specific user?
You need to ensure that your Splunk ES environment is properly ingesting threat intelligence data. Where can you confirm that threat sources are active?
You notice a system process attempting to connect to a suspicious external domain. Which CIM data model would contain this network connection information?
An attacker is using a technique to hide in plain sight by renaming a common system process. Which data model is most suitable for comparing process names against known good paths?
You want to visualize the geographic origin of incoming connection attempts to identify potentially malicious traffic. Which dashboard is most appropriate?
An attacker is using a technique that involves 'living off the land' by utilizing legitimate system tools. Which data model is most effective to monitor these tools?
An analyst notices that several Windows workstations are repeatedly resolving domain names such as 'update.microsoft.com.security-check.net' and 'login.office365.com.auth-verify.org'. These lookups occur shortly before outbound HTTPS connections to the resolved IPs. Which type of attack technique is most consistent with this observation?
An analyst is investigating a potential ransomware incident. They notice a high volume of file modifications with the .locky extension across multiple shared drives. Which Splunk ES data model is most appropriate to search for these file system changes?
During an investigation of a suspected malware outbreak, an analyst needs to identify all internal hosts that have communicated with a known malicious IP address. Which Splunk ES data model should be used to search for this network communication?
An analyst is reviewing Splunk Enterprise Security correlation search results and notices a notable event for a host named WEB-01 indicating a possible web shell. The analyst wants to quickly identify the exact command and URI used in the initial exploit. Which Splunk ES data model should the analyst examine to find the HTTP request method and URI associated with this event?
An analyst is investigating a potential pass-the-hash attack. They want to search for successful authentications that used NTLM authentication where the source workstation differs from the destination workstation. Which Splunk ES data model and field combination is most appropriate?
An analyst notices a Splunk ES notable event indicating a possible DNS exfiltration. In the Network_Traffic data model, which field contains the domain name being queried by an internal host?
A Splunk ES analyst is investigating a series of notable events related to a possible DNS tunneling attack. The analyst wants to identify domains that are being queried with unusually high frequency or with long subdomain strings, which are common indicators of DNS tunneling. Which Splunk ES data model should the analyst use to efficiently search for these DNS query patterns?
An analyst is investigating a suspected DNS tunneling attack. They need to identify hosts that are generating an unusually high number of DNS queries with long, random-looking subdomains. Which Splunk search is most effective for this detection?
A security analyst receives an alert about a possible DNS tunneling attack. They need to examine DNS query logs to identify unusually long domain names that might indicate data exfiltration. Which Splunk ES data model should they use?
A Splunk ES analyst receives a notable event indicating that a user account has been locked out due to multiple failed login attempts. The analyst wants to determine if this is a brute force attack or a user error. Which data model should the analyst examine to review the authentication activity for that user?
An analyst in Splunk Enterprise Security is investigating a potential DNS tunneling attack. They need to identify hosts that are sending an unusually high number of DNS queries to a single external domain within a short time window. Which search provides the most direct evidence of this behavior?
A Splunk ES analyst notices a spike in `Endpoint` data model events where `process_name` is `powershell.exe` with a command line containing `-EncodedCommand` and `DownloadString`, spawning from `winword.exe` on several finance workstations. Which MITRE ATT&CK technique does this activity most directly map to?
An attacker has gained access to a workstation and is attempting to move laterally within the network. Which TWO of the following techniques are commonly used for lateral movement that you should monitor in Splunk ES? (Choose two.)
An analyst is investigating a suspected credential dumping attack on a Windows host. They want to identify evidence of this activity in Splunk ES. Which TWO of the following are valid indicators of credential dumping that can be found in Splunk ES data? (Choose two.)
An analyst notices a Windows workstation repeatedly resolving long, random-looking subdomains under a single parent domain, followed by outbound DNS TXT queries. Which Splunk ES detection method is most appropriate to identify this as DNS tunneling?
A Splunk ES analyst receives a notable event for 'Excessive Failed Logins' on a Windows server. The analyst wants to determine if this is a brute-force attack or a misconfigured service account. Which field in the notable event would best help differentiate between these two scenarios?
During an investigation, an analyst observes multiple `Endpoint` events where `lsass.exe` is accessed with `PROCESS_VM_READ` by a non-standard binary named `diagtrack.exe` running from `C:\Users\Public\`. Which Splunk ES data model and field combination best supports detecting this credential-dumping behavior?
An analyst is investigating a suspected DNS tunneling attack. Which Splunk ES data model and field should be used to identify hosts making an unusually high number of unique DNS queries with long subdomain strings?
An analyst is investigating a potential pass-the-hash attack in Splunk ES. Which TWO of the following are indicators that should be reviewed in Windows Security event logs? (Choose two.)
An analyst is reviewing a notable event for a potential malware infection on a Windows endpoint. The event includes a file hash. To determine if the file is known malicious, the analyst wants to check its reputation using Splunk ES's threat intelligence framework. Which action should the analyst take?
An analyst observes a series of events where a process creates a child process with a command line that includes encoded PowerShell commands. The parent process is a Microsoft Office application. Which attack technique is most likely being used?
A Splunk ES analyst is investigating a potential ransomware incident. Which TWO of the following are valid indicators of ransomware activity that should be prioritized for detection? (Choose two.)
A Splunk ES analyst is investigating a potential Kerberoasting attack. The analyst wants to identify the key indicators of this activity. Which TWO of the following are primary indicators of a Kerberoasting attack that the analyst should look for in Splunk ES? (Choose two.)
A Splunk ES analyst is investigating a series of notable events indicating possible pass-the-hash attacks. The events show successful authentications using NTLM from unusual source workstations to multiple servers. Which data model should the analyst query to correlate the authentication events and identify the compromised user accounts?
A SOC analyst receives an alert that a user's credentials were used from two geographically distant locations within five minutes. Which Splunk ES capability is designed to surface this type of anomaly by comparing current activity to a learned baseline?
An analyst is investigating a potential ransomware outbreak. They observe a high volume of file encryption activity and want to identify the initial infection vector. Which TWO of the following Splunk ES data models would be most useful to correlate endpoint and network activity to trace the source? (Choose two.)
An attacker uses a weaponized document that exploits a vulnerability to execute code without writing a file to disk. Which detection approach in Splunk ES is best suited to identify this fileless attack?
An analyst is investigating a potential DLL sideloading attack on a Windows host. Which Splunk ES data model and field can be used to detect the loading of a malicious DLL from an unusual path?
An analyst in Splunk Enterprise Security is investigating a suspected Kerberoasting attack. They notice multiple Event Code 4769 events where the ticket encryption type is 0x17 and the service name is not a known service account. Which Splunk search would best identify the affected user accounts and the targeted service principal names (SPNs)?
An analyst is investigating a potential command-and-control (C2) beaconing incident. They observe periodic outbound connections from an internal host to an external IP address at regular intervals with small data transfers. Which two Splunk ES features or techniques would best help confirm and analyze this beaconing activity? (Choose two.)
A Splunk ES analyst receives a notable event for a possible phishing attack. The email contains a malicious link that, when clicked, downloads a payload. Which Splunk ES data model and field would best help the analyst quickly identify all users who clicked the link and the associated URLs?