CS0-003 Security Operations Practice Question
A security analyst is investigating a potential advanced persistent threat (APT) that uses living off the land binaries (LOLBins). The EDR has flagged several processes. Which THREE process behaviors are most indicative of LOLBin abuse? (Choose THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
mshta.exe executing JavaScript from a remote URL
LOLBin abuse often involves using native tools in unusual ways: wmic for remote execution, mshta for executing malicious scripts, and certutil for downloading payloads. Bitsadmin is also used, but it's less common.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
mshta.exe executing JavaScript from a remote URL
Why this is correct
mshta.exe is a Microsoft HTML Application host that runs .hta files containing VBScript or JavaScript. When invoked with a remote URL, it executes attacker-supplied script directly from the internet, bypassing many application control policies and acting as a living-off-the-land binary (LOLBin). This behavior is highly suspicious because legitimate mshta execution is typically local and user-initiated, not a network fetch of script code.
- ✗
explorer.exe opening the Start menu
Why it's wrong here
explorer.exe is the Windows shell process that handles the desktop, Start menu, taskbar, and File Explorer. Its normal operation includes opening the Start menu when the user clicks the Windows key, so this event alone is routine and non-malicious. In an investigation, analysts would only flag explorer.exe if it were spawning unusual child processes or launching executable code from non-standard paths, neither of which occurs here.
- ✗
notepad.exe opening a .txt file in the user's Documents folder
Why it's wrong here
notepad.exe opening a plain text file from the user's Documents folder is standard, expected behavior with no inherent security risk. Notepad lacks scripting or remote-execution capabilities, and the file path is within the user profile, matching typical user activity. Such an event does not align with advanced threat patterns, which often rely on script hosts or network-aware utilities rather than a text editor.
- ✓
wmic.exe creating a process on a remote system
Why this is correct
wmic.exe is the command-line interface for Windows Management Instrumentation (WMI), and its 'process call create' syntax can start processes on remote systems if the attacker has valid credentials. This is a documented lateral movement technique, and remote process creation via WMIC is a strong indicator of compromise, especially in an advanced persistent threat scenario. While WMIC is a legitimate admin tool, its remote execution capability is frequently abused by attackers moving across a network.
- ✓
certutil.exe downloading an executable from a remote server
Why this is correct
certutil.exe is a legitimate certificate management utility, but its '-urlcache' and '-f' flags allow arbitrary file downloads from any URL. Attackers abuse this trusted binary to fetch malicious executables, relying on certutil being whitelisted by security tools. Observing certutil making an outbound HTTP connection to a remote server and retrieving an executable is clearly anomalous, as its normal certificate operations do not involve downloading binaries.
Go deeper
Related to this question
Learn chapter
Threat Intelligence and Threat Hunting
Key term
Living off the land
Living off the land is an attack technique where cybercriminals use the legitimate tools and software already installed on a computer system to carry out malicious activities, making them harder to detect.
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.