CCNA Host-Based Analysis Questions

Scheduled tasks are a common persistence mechanism. The task name 'WindowsUpdateCheck' mimics a legitimate update check, but the action points to a binary in C:\Users\Public, which is an unusual location for a legitimate update executable. The frequent trigger (every 5 minutes) ensures the malware runs regularly, maintaining persistence and possibly beaconing to a command-and-control server.

The ASCII characters 'MZ' (0x4D5A) form the DOS header magic number that every Windows Portable Executable begins with, as defined by the PE format specification. Its presence at offset zero identifies the file as a Windows PE binary rather than a script or document.

Correct. Systemd services can be used for persistence.

C:\ProgramData is writable by standard users, unlike system directories, making it a common staging ground for malicious binaries. The service name 'WinDefendSvc' closely mimics the legitimate 'WinDefend' to evade casual inspection. Combined with the non-standard binary path, this is a classic masquerading persistence technique. The analyst should treat it as malicious and investigate the binary and its network behavior.

Entropy near 7.8 approaches the theoretical maximum of 8, indicating compressed or encrypted data rather than readable code. Packers and crypters use this to obscure payloads, defeating signature-based detection. This satisfies the stem's requirement to explain what high entropy indicates and its malware-analysis relevance.

The parent process winword.exe spawning powershell.exe with an encoded command is a classic sign of a malicious Microsoft Word macro. Attackers use macros to execute PowerShell commands that download or run payloads, often encoding the command to evade detection. The '-enc' parameter indicates base64-encoded script, a common obfuscation method in macro-based attacks, making this the most likely technique.

Prefetch files, stored in C:\Windows\Prefetch with a .pf extension, record executable name, file path, run count and last-run timestamps. This directly satisfies the stem's requirement for an artifact evidencing file execution with path and run count.

/var/log/auth.log records PAM authentication events on Debian-based Linux systems, capturing both successful and failed SSH login attempts with source addresses and usernames. This directly satisfies the stem's requirement to investigate brute-force activity, since repeated failures from one origin become visible there.

The pstree plugin reconstructs parent-child relationships by following inherited process identifiers, revealing the ancestry and nesting that pslist's flat enumeration omits. This satisfies the stem's comparison requirement, exposing processes whose parent has exited and been reparented, which a simple listing cannot show.

Magic bytes are fixed signature values at the start of a file's binary content, so they identify the true format independently of the filename extension. An attacker can rename a malicious executable to .txt, but the magic bytes still reveal the actual type, satisfying the requirement to determine file type regardless of extension.

modinfo displays information about a kernel module, including its filename, description, author, and license. Running 'modinfo hideproc' will show the full path to the module file, which can then be analyzed or removed. This directly helps identify the rootkit's location.

pstree renders the parent-child process hierarchy, exposing anomalous parentage such as a word processor spawning cmd.exe, which hints at injected or masquerading code. Combined with network and injection plugins, it satisfies the requirement to identify suspicious processes during memory analysis.

The magic bytes 50 4B 03 04 are the ZIP local file header signature ('PK\x03\x04'). Despite the .pdf extension, the file's actual container format is ZIP, which is typical of Office documents and JAR archives and indicates the extension has been spoofed.

On Linux, when an executable is deleted while a process is running, the /proc/<PID>/exe symlink still exists but points to the original path with a ' (deleted)' suffix, and the file is no longer visible on disk. This is a common malware technique to hide the binary while keeping it running. The analyst can recover the binary from /proc/<PID>/exe before the process exits.

Process Explorer displays a live process tree, exposing parent-child relationships that reveal suspicious spawning, such as Office launching PowerShell. Its command-line column shows the exact arguments passed to each process, satisfying the investigation's requirement to inspect execution details on the suspect Windows host.

systemctl disable removes the service's symlinks from the systemd unit configuration, preventing it from starting automatically at boot while leaving the unit file intact. This directly addresses the autostart constraint, unlike stop, which only halts the running instance.

The Startup folder is a directory that contains shortcuts or executables that run automatically when a user logs in. Malware often places a copy of itself or a shortcut in this folder to achieve persistence. The scenario describes an executable named 'updater.exe' in the Startup folder, which is a classic persistence technique. Thus, the Startup folder is the correct answer.

This directory contains per-package cron definitions.

Rootkits often manipulate the module's reference count (refcount) to prevent removal. They may increment it or hook the `delete_module` syscall to return an error. This makes the module appear 'in use' even when no legitimate process uses it. Thus, the rootkit maintains persistence by blocking `rmmod`. This is a common rootkit technique.

This file stores the XML definition of the scheduled task, including its creation time, author, and actions. It is the authoritative source for the task's configuration and metadata. Analyzing this file can reveal when and by whom the task was created, which is crucial for determining if it is malicious.

Image File Execution Options supports a Debugger value that Windows launches instead of the named executable. Attackers abuse this for persistence by pointing the debugger at malicious code, so the key's legitimate purpose is specifying a debugger for the image.

ldrmodules enumerates loaded modules via three linked lists (InLoad, InInit, InMem) and flags discrepancies, exposing injected DLLs unlinked from the loader's lists. This directly satisfies the scenario's requirement to detect code injection in the memory dump.

Kerberoasting involves requesting Kerberos service tickets (TGS) for service accounts and cracking them offline. Event ID 4769 is logged when a TGS is requested. Multiple requests for different services in a short time by the same user is a classic sign. The attacker then extracts the ticket and attempts to crack the service account's password.

User-specific Run key.

Procdump is a legitimate Sysinternals tool, but when used to dump the memory of lsass.exe, it is a common technique for credential dumping. The -ma flag captures a full memory dump, which can then be parsed with tools like Mimikatz to extract plaintext passwords or hashes. This is a clear indicator of credential theft.

Event ID 4625 is logged whenever a logon attempt fails, recording the account and source. Repeated occurrences from one source IP suggest brute-force or password-guessing activity, and Windows writes this event to the Security log.

Event ID 4625 is logged whenever a logon attempt fails, and repeated occurrences from one source IP address indicate sustained authentication failures consistent with brute-force activity. This directly satisfies the stem's constraint of multiple 4625 events from the same source, distinguishing it from successful logons (4624) or lockouts (4740).

The UserAssist key under HKCU stores ROT13-encoded entries for programs launched through Windows Explorer, including the executable name and a run counter. Inspecting the Count subkey under the GUID path reveals execution history for the current user, which is exactly what the threat hunter needs to confirm recent execution.

A non-standard SSH port suggests possible backdoor or compromised service, so the analyst must determine whether anyone authenticated successfully. /var/log/auth.log records SSH authentication events, letting the analyst confirm or rule out unauthorised logins before containment.

The output shows that the executable for process 1234 was deleted from the filesystem but is still running. This is a common technique used by malware to hide its executable, making it difficult to find on disk. The path '/tmp/.hidden/backdoor' suggests a suspicious location. Thus, this indicates potential malware activity.

Prefetch files record run count and last-write execution timestamps for each executable, letting the analyst establish when MALWARE.EXE last ran and how frequently. This supports timeline reconstruction, though it does not reveal command-line arguments or network connections.

Get-NetTCPConnection is a PowerShell cmdlet that returns TCP connection objects, and its OwningProcess property gives the PID responsible for each connection. Filtering on the Established state focuses the output on active sessions and makes it straightforward to correlate them with process information.

HKCU\Software\Microsoft\Windows\CurrentVersion\Run loads programs automatically at user logon, satisfying the persistence requirement. Because it resides in the per-user hive, malware needs no administrative rights to write there, making it a favoured autostart location. HKLM's equivalent requires elevation, so HKCU is the common low-privilege choice.

Entropy near 8.0 indicates near-random byte distribution, and randomised section names are typical of packers. Legitimate compiled code shows lower entropy with recognisable section names like .text, so packing or encryption is the likely explanation.

Changing a user's UID to 0 in /etc/passwd grants that account full root privileges. Attackers often do this to create a backdoor root account that blends in with legitimate users. The discrepancy between the expected UID (1001) and the actual UID (0) is a strong indicator of malicious modification and should be investigated immediately.

Processes executing from a user's Temp directory with randomised filenames evade signature-based detection and are atypical of legitimate software, which installs to Program Files or AppData. This masquerading behaviour satisfies the stem's request for a malicious parent-child indicator.

Each scheduled task has an XML definition stored in the Tasks folder that contains the complete action list, including the executable path, arguments, working directory, triggers, and principal. Reading it with schtasks /query /xml reveals exactly what the task would run when enabled, regardless of the GUI's disabled indicator, making it the correct artifact to inspect.

Event ID 4648 is logged when a process explicitly supplies alternate credentials for a logon, such as RunAs or scheduled tasks using stored credentials. It records the target account and the subject account, distinguishing it from ordinary interactive logons.

The /etc/systemd/system/ directory holds administrator-defined systemd unit files, including custom services and timers that start automatically at boot. Examining it reveals malicious units an attacker added for persistence, satisfying the requirement to identify persistence mechanisms on the compromised Linux phishing server.

Long base64-encoded command line arguments indicate encoded payloads, a common obfuscation technique used by malware to hide scripts or commands from casual inspection. Legitimate processes rarely pass such blobs as arguments, so the analyst should suspect obfuscated malicious code.

PSReadLine records every command entered in an interactive PowerShell console to ConsoleHost_history.txt under the user's AppData. It persists across sessions and shows the exact command lines typed, including paths, parameters, and any encoded strings, making it a direct record of user PowerShell activity on that host.

The per-user `.bash_history` file in the home directory records commands typed in interactive Bash sessions, directly satisfying the requirement to recover a user's command history. Unlike system-wide logs, it captures the exact command lines executed, which may expose malicious activity such as reconnaissance or privilege escalation attempts.

When a process's parent terminates, the child is re-parented to PID 1 (init or systemd) on Linux. This can happen if the original Apache master process crashed or was killed, leaving orphaned worker processes. An attacker might also kill the parent to hide the lineage. Thus, PPID 1 for `apache2` suggests the original parent is gone, which is suspicious.

The command 'vssadmin delete shadows /all /quiet' is a known technique used by ransomware to delete shadow copies, making it impossible to restore encrypted files. This is a common precursor to encryption. The use of cmd.exe to execute it is typical for scripted attacks, indicating ransomware activity.

The malfind plugin scans process memory regions for injected code by looking for pages marked executable that lack a corresponding mapped file on disk, exposing code injection and hidden payloads. This directly satisfies the stem's requirement to detect hidden or injected code during memory analysis.

The ss command with -tlnp lists TCP sockets in listening state, numeric ports, and the owning process. It reads kernel socket tables directly, making it faster than netstat and satisfying the requirement to show listening TCP ports with associated processes.

The /proc/<PID>/exe symlink points to the actual executable file. For a legitimate kernel worker, this link is typically absent or points to nothing because kernel threads have no user-space executable. If it points to a file in /tmp or another suspicious location, it indicates a masquerading process. This is a quick and effective check.

Windows writes a .pf Prefetch file into C:\Windows\Prefetch each time an executable launches, recording the binary name, run count and timestamps. Its presence therefore proves execution, unlike .lnk shortcuts or registry keys, which merely evidence access or configuration.

The /var/spool/cron/crontabs/ directory holds per-user cron schedules on Linux, so any malicious job an attacker added for persistence appears here as a readable file. This directly satisfies the stem's requirement for evidence of attacker activity, revealing scheduled commands that re-establish access or execute payloads after reboot.

Correct. Shows command-line arguments for the process.

Entropy near 7.8 approaches the theoretical maximum for byte data, indicating compressed or encrypted content rather than readable code. Packers and obfuscators compress or encrypt the payload, so high entropy in a PE file suggests packing.

The audit log, when auditd is configured, records detailed system call and command execution events, including the user ID (UID) and effective user ID (EUID) of the process that executed the command. This provides direct evidence of which user account was used to run the command, making it the most reliable source for this scenario.

Security Event IDs 4656 and 4663 record handle requests and object access, and when they reference lsass.exe with rights such as PROCESS_VM_READ, they strongly suggest a tool attempted to read credential material from LSASS memory. This is a classic indicator of credential dumping activity on a Windows host.

Systemd services can start automatically on boot.

Legitimate Windows services almost always execute from protected system locations such as C:\Windows\System32, not user-writable directories. C:\Users\Public is world-writable, allowing any local user to replace update.exe and gain persistence with SYSTEM privileges, since the service runs under a privileged account. This path anomaly satisfies the stem's suspicion constraint.

Event ID 4625 records a failed logon attempt. Many such entries originating from one IP address indicate repeated authentication failures, the signature of a brute-force password guessing attack, rather than a single mistyped password or a successful compromise.

Process Explorer displays a live process tree showing parent-child relationships, and its properties pane exposes full command-line arguments for each process. Task Manager and basic tasklist lack this combined hierarchical and command-line visibility, meeting the analyst's investigative requirement.

Security Event ID 4624 records successful logons, and Logon Type 2 specifically indicates an interactive logon at the console. Filtering 4624 events by Logon Type 2 and the desired time window gives the analyst exactly the list of accounts used for interactive console access on the server.

The `-enc` parameter (short for `-EncodedCommand`) tells PowerShell to interpret the following string as Base64-encoded UTF-16LE text. Attackers use this to hide malicious scripts from command-line logging and casual inspection. Decoding the Base64 string reveals the actual PowerShell commands, which often download or execute further payloads.

Legitimate svchost.exe instances are spawned by services.exe, which hosts service DLLs. A parent of explorer.exe indicates process injection or masquerading, since explorer.exe never launches service hosts. This parent-child anomaly is the specific indicator the analyst must flag.

A PAGE_EXECUTE_READWRITE VAD containing 'MZ' reveals a PE header mapped into memory, the signature of injected executable code. Legitimate modules are not both writable and executable, so this satisfies the stem's request to interpret the malfind output.

Security Event ID 4688 is generated when a new process is created and, when process creation auditing is enabled, includes the 'SubjectUserName' and 'TargetUserName' fields that identify the account that initiated the process. This directly answers the analyst's need to attribute process execution to a specific user account on the endpoint.

bcdedit is the correct tool to view and modify Windows Boot Configuration Data (BCD). It displays settings such as nointegritychecks and testsigning, which, if enabled, disable driver signature enforcement. An analyst can run 'bcdedit /enum' to inspect these values and determine if malware altered boot settings to load unsigned drivers.

The malfind plugin scans process memory for pages exhibiting characteristics of injected or hidden code, such as executable permissions combined with no file backing on disk. This directly targets the scenario's goal of revealing injected code within a process from the memory dump.

Event ID 4624 is written to the Windows Security log whenever an account successfully authenticates, capturing logon type, account name and source. It is the definitive indicator of a successful user logon, unlike 4625, which records failures.

Process masquerading occurs when malware names its executable after a legitimate system process, such as lsass.exe, but runs from an unusual location and with an unexpected parent. Here, the path 'C:\Users\Public\lsass.exe' and parent 'cmd.exe' are clear indicators that this is a fake lsass.exe, not the genuine one that runs from System32 and is spawned by wininit.exe.

An established outbound connection to an external host on port 4444, a common Metasploit and netcat listener port, indicates a reverse shell or backdoor. The compromised host initiated the session, letting the attacker bypass inbound firewall rules.

lsof with -i lists open Internet sockets, -P suppresses port-name resolution, and -n suppresses hostname resolution. The output shows the owning process name, PID, user, and the remote endpoint, which is exactly what is needed to tie a suspicious outbound connection to a user and process. It complements ss by showing file descriptors and the process that opened each socket.

The /proc/1234/exe link points to the executable file of the process. A root-owned process running from /tmp/.hidden/backdoor is highly suspicious because /tmp is commonly used by attackers to drop and execute malware, and the hidden directory name suggests an attempt to avoid casual observation. This is a clear indicator of compromise.

schtasks with /query lists scheduled tasks, /fo LIST selects a list format, and /v adds verbose details such as the task's action, trigger, author, and run-as account. This gives the analyst the full configuration needed to spot a malicious recurring task offline without clicking through the GUI.

On Linux, user-specific cron jobs are stored per-account in /var/spool/cron/crontabs/, with one file per user. Inspecting this directory reveals unauthorised scheduled tasks created by individual accounts, which is exactly what the analyst needs to check.

Task Scheduler exposes each task's triggers, actions, conditions and author, letting the analyst inspect exactly what the PowerShell script runs and when. Other tools show process or file artefacts but not the task definition itself.

Volatile artifacts such as memory-resident processes, active network connections, and the malicious script file can disappear on reboot or be deleted by the attacker. Capturing them first preserves evidence for later analysis. Only after acquisition should the analyst disable the task and isolate the host to stop reinfection. This order follows the standard order of volatility principle in incident response.

Event ID 4720 logs account creation and 4726 logs account deletion. Occurring minutes apart for the same username, the pair indicates an account was provisioned then removed, a pattern consistent with an attacker creating a temporary backdoor account for short-lived unauthorised access.

Event ID 4720 is logged in the Windows Security log whenever a user account is created. Monitoring for it surfaces unauthorised account creation, since legitimate provisioning should be attributable to known administrators or automated processes.