CCNA Host-Based Analysis Questions

User crontab files are stored under /var/spool/cron/crontabs/, with one file per user, making it a standard location attackers modify to schedule recurring commands. This satisfies the cron persistence requirement, unlike directories holding system binaries or logs.

Event ID 4726 is logged by Windows Security auditing when a user account object is deleted from Active Directory. Its appearance for the same account shortly after creation confirms deletion occurred, matching the stem's request to identify the actions performed.

The Startup folder (e.g., %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup) contains shortcuts and executables that run automatically when the user logs on. Malware often places a copy or shortcut here to maintain persistence. Checking this folder is a standard step in host-based analysis for user-level persistence.

Prefetch files record execution metadata for each program, storing the executable name, run count and last-run timestamps in C:\Windows\Prefetch. This directly satisfies the requirement to evidence prior execution on the Windows system, unlike artefacts that merely show presence or download.

Event ID 4720 is logged when a user account is created. It includes the account name, the creator's username, and a timestamp. In this scenario, the analyst needs to determine when the suspicious 'Support' account was created, so 4720 is the correct event to look for. Reviewing this event can help identify the timeframe of the compromise and the account that created it, aiding further investigation.

Correct. sc query lists service status and configuration.

Inspecting the script's content, owner and hash directly addresses the persistence mechanism: cron executes the referenced file, so its code, permissions and provenance reveal intent. Comparing the hash against threat intelligence confirms known malware, satisfying the need to determine whether this scheduled job is malicious rather than merely unusual.

The malfind plugin scans process memory for pages exhibiting characteristics of injected or hidden code, such as executable regions lacking a corresponding mapped file on disk. That directly addresses the requirement to identify injected code within a process during Windows memory forensics.

Analysing PE section entropy directly identifies packing: packed executables compress or encrypt their payload, producing entropy near 8.0 and obfuscated section names such as UPX0. This technique satisfies the stem's requirement to confirm packing by examining the suspicious file's structural characteristics rather than relying on runtime behaviour.

Event ID 4624 records the successful logon that terminated the brute-force sequence, satisfying the stem's requirement to examine the outcome following repeated failures. Its logon type field distinguishes interactive, network, and remote access, letting the analyst confirm whether the successful authentication came from the same source as the failed attempts.

Packing or encrypting compresses and obfuscates the executable, so the PE header signature is no longer readable and 'file' reports generic 'data' rather than PE32 executable. This hides the file's true nature from static inspection.

The sc query command interrogates the Service Control Manager directly, returning the service's current state (running, stopped, paused) plus configuration details such as start type and binary path. This satisfies the requirement to check status and details of a suspicious service from the command line without needing GUI tools.

The /etc/cron.d/ directory contains cron job definitions that run on a schedule. Attackers frequently add malicious cron jobs here to maintain persistence by executing payloads at regular intervals. Reviewing this directory can uncover unauthorized scheduled tasks that are not part of the default system configuration.

The parent process winword.exe launching an encoded, hidden PowerShell command is a classic sign of a malicious macro in an Office document executing a stager. The -enc flag indicates Base64-encoded commands, often used to obfuscate payloads. This combination is a strong indicator of a phishing document exploit leading to code execution.

Attackers commonly name malicious executables after legitimate system processes like lsass.exe to blend in. Placing the binary in a non-standard location such as C:\Windows\Temp is a strong indicator of compromise. The analyst should immediately collect the file, hash it, and investigate its origin and behavior, as this is a classic masquerading technique.

The sc query command interrogates the Windows Service Control Manager, returning each service's status, start type and binary path. This directly satisfies the need to spot non-standard service names or executable paths during host-based analysis, since the SCM holds the authoritative configuration.

SRUM (System Resource Usage Monitor) records per-application network usage and bytes sent/received over time, stored in SRUDB.dat. Malware that hooks live APIs to hide from netstat still generates SRUM entries because the ESE database is populated by the ESE-based SRUM service, not by the APIs the malware hooks. Parsing it can reveal a process that communicated externally even when live tooling shows nothing.

Event ID 4720 is generated when a new user account is created. It includes the target username and the subject (the account that performed the creation). This is the correct event ID to identify user account creation activity, which is a common persistence technique used by attackers to maintain access to a compromised system.

IFEO allows developers to attach a debugger to a process. Malware can abuse this by setting the 'Debugger' value under the IFEO key for a legitimate process (e.g., notepad.exe) to point to a malicious executable. When the legitimate process is launched, the malicious 'debugger' runs instead, achieving persistence and potentially privilege escalation.

Event ID 4648 is generated when a process explicitly supplies alternate credentials for a logon, such as RunAs or scheduled tasks using stored credentials. It records the target account and the subject initiating it, distinguishing explicit credential use from ordinary interactive logons.

The ss utility with -tunap lists TCP, UDP, and Unix sockets, including established connections and the process name and PID that owns each socket. This directly exposes outbound connections to external addresses and identifies the responsible process, which is precisely what the hunter needs to spot C2 communication on the compromised web server.

A web shell is a malicious script uploaded to a web server that allows remote attackers to execute commands and maintain persistence. The outbound connection on a non-standard port like 4444 (often used by Metasploit) from the web server process suggests a reverse shell initiated by the web shell. The obfuscated PHP file is a common indicator.

Attackers often name malicious processes after legitimate services like 'sshd' to avoid detection. Port 4444 is commonly used by Metasploit and other penetration testing tools for reverse shells. The combination of an unexpected port and a process name that does not match the expected behavior (SSH on port 22) strongly indicates a backdoor or reverse shell masquerading as sshd.

Windows Event ID 4625 is logged in the Security log whenever a logon attempt fails, recording the account, source workstation and failure reason. It directly satisfies the stem's requirement to identify what this event indicates.

Legitimate svchost.exe instances are launched by services.exe, so a cmd.exe parent reveals a process masquerading under that name — a common malware technique. The anomalous parentage, not the filename itself, is the indicator satisfying the scenario's suspicious-executable constraint.

Legitimate svchost.exe processes reside in %SystemRoot%\System32. An instance running from C:\Users\Public is a strong indicator of malware, as attackers often name their binaries after system processes and place them in user-writable directories to evade detection. The analyst should investigate further, such as checking digital signatures and parent process.

The HKLM Run key applies machine-wide, launching listed programs at logon for every user. Writing to it requires administrative privileges, so malware using this location typically arrives via elevation or an installer, giving persistence across all accounts.

User crontab entries are stored under /var/spool/cron/crontabs, one file per user, so reviewing this directory reveals scheduled jobs an attacker added for persistence. System-wide schedules live in /etc/crontab and /etc/cron.d, making this the correct user-level location.

The Run key under HKCU executes listed programs automatically each time that user logs on, giving malware persistence without administrative rights. This satisfies the stem's persistence mechanism: the entry survives reboots and relaunches the payload at user logon, unlike one-time execution or system-wide services requiring elevation.

The Microsoft-Windows-DNS-Client/Operational log records DNS query events, including the process name, query name, query type, and timestamp. In this scenario, it can reveal which process resolved the suspicious domain and when, even if the connection is no longer active. This directly addresses the need to correlate a domain with a process and time.

On Debian and Ubuntu systems, the SSH daemon writes authentication events, including failed login attempts, to /var/log/auth.log via the authpriv facility. This makes it the appropriate file for reviewing failed SSH logins on those distributions.

A zero TimeDateStamp means the PE compiler timestamp was never written or was overwritten. Legitimate builds normally carry a real compilation time, so this absence suggests deliberate erasure to hinder timeline correlation during forensic analysis.

On Debian and Ubuntu systems, /var/log/auth.log is the primary file where the authentication subsystem writes messages about successful and failed logins, sudo usage, and PAM events. Reviewing it gives the analyst the chronological authentication record they need to spot unauthorized access attempts on the server.

The `ss -tlnp` command combines `-t` for TCP sockets, `-l` for listening state, `-n` for numeric ports, and `-p` for owning processes, directly satisfying the requirement to enumerate every listening TCP port on the Linux host.

The Services console lists every installed Windows service along with its display name, start type, status, and, under the General tab or via the registry, the path to the service binary. This lets the analyst spot a service whose ImagePath points to an unusual directory or executable, which is a classic masquerading persistence technique. It requires no third-party tools.

Reading `/proc/<pid>/cmdline` returns the exact command line and arguments that launched process 1234, with arguments separated by null bytes. This directly satisfies the scenario's requirement to identify how the process was started on the Linux host, exposing suspicious flags or scripts an attacker used.

High entropy and few imports indicate packing.

Sticky Keys (sethc.exe) can be replaced with cmd.exe to provide a command prompt at login.

User-specific crontab entries are stored under /var/spool/cron/crontabs/ (or /var/spool/cron/ on some distributions), one file per user. Examining this directory directly reveals attacker-added scheduled jobs, satisfying the requirement to identify user-specific cron persistence rather than system-wide schedules held in /etc/crontab or /etc/cron.d/.

The HKLM Run key executes listed programs at logon for every user on the host, making it a machine-wide persistence location. This satisfies the stem's user logon persistence constraint, since malware written here survives reboots and affects all accounts.

Prefetch files record each executable's name, run count and last-run timestamps, so analysts can confirm that a program executed on the host, how often, and when. This directly satisfies the need to establish file execution evidence during host-based analysis.

The HKLM Run key executes programs at logon for all users and needs administrative privileges to modify. Malware with elevated access writes here for system-wide persistence, satisfying the scenario's requirement for a commonly abused Run-key location on the Windows host.

Sysmon logs detailed process creation events (Event ID 1) and image loaded events (Event ID 7), which can show if a legitimate process loaded an unexpected DLL or if a process was created with suspicious parameters. This is the most direct source for detecting code injection, as it captures the loading of images into processes.