Cyber Threats Iocs And Attack Methodology

A SOC analyst is reviewing DNS logs and observes a workstation issuing hundreds of unique subdomain queries under the domain telemetry-sync[.]net, each returning an NXDOMAIN response within seconds. No matching HTTP traffic appears in the proxy logs. Which attack technique is most consistent with this pattern?

A system administrator reports high CPU usage on a server. Upon checking task manager, you find 'svchost.exe' running from a temp folder. What is the most immediate action?

A SOC analyst reviews network telemetry and finds that an internal workstation is sending periodic DNS queries for randomly generated subdomains under a single parent domain, and each query receives an immediate NXDOMAIN response. The queries occur roughly every 30 seconds with high entropy in the leftmost label. There is no corresponding HTTP or TLS traffic to those hostnames. Which attack activity is MOST consistent with this pattern?

You are analyzing a packet capture (PCAP) and find a beaconing pattern with a consistent 30-second interval and jitter of 5%. Which detection strategy is most effective for this IoC?

An analyst is reviewing a packet capture and observes periodic, fixed-interval HTTPS sessions from an internal host to a single external IP, each transferring roughly the same small number of bytes. The destination has no reputation data, and the certificate is self-signed. Which IOC category and interpretation best fits this observation?

A SOC analyst is building detection logic for the Execution phase of an intrusion. The team wants to identify host artifacts that reliably indicate a process was launched with malicious intent. Which TWO of the following are the most appropriate host-based artifacts to monitor for this purpose? (Choose two.)

You are investigating an incident involving a malicious macro embedded in an Excel document. Which Windows process is typically the 'parent' of the malicious payload execution?

A SOC analyst is correlating EDR process-creation events with Windows Security logs during an investigation of an intrusion. The analyst notices that on a domain controller, the account 'svc_backup' authenticated successfully at 02:14, and two minutes later a new service named 'WinDefendHelper' was created, whose binary path points to C:\Windows\Temp\svc.exe. The service account configured for this service is the local SYSTEM account. Which attack technique is MOST consistent with this sequence?

A SOC analyst is reviewing proxy logs and notices a series of HTTP POST requests to 'update.accounts-check.com' with large, encoded payloads occurring outside business hours. The domain was registered two days ago and has a low reputation. Which type of attack activity is most likely occurring?

A SOC analyst is investigating a suspected malware outbreak and needs to identify host-based indicators of compromise (IoCs) that would support the hypothesis of a compromised endpoint. Which TWO of the following are host-based IoCs that should be prioritized for collection and analysis? (Choose two.)

A SOC analyst is investigating a suspected credential-dumping incident on a Windows workstation. The analyst has EDR telemetry, Windows Security event logs, and memory capture available. Which TWO artifacts would MOST reliably confirm that credential material was accessed from LSASS memory? (Choose two.)

You are tracking a threat actor who uses 'Living off the Land' (LotL) techniques. Which of the following commands is a classic indicator of this methodology?

A user complains that their browser homepage has changed. Upon inspection, you find a new, unsigned extension installed. Which attack methodology is this?

An analyst notices that a workstation's registry Run key now points to a binary located in the user's AppData\Roaming directory, and the binary is unsigned and has no version information. The change occurred shortly after the user opened an email attachment. Which attacker objective does this artifact most directly support?

Which THREE of the following are characteristics of 'Advanced Persistent Threat' (APT) attack methodologies?

Which of the following is considered a 'Network-based' IoC?

A threat hunter observes that an internal host is sending periodic HTTPS beacons to a rare external IP address at consistent 60-second intervals, with identical packet sizes and no corresponding user browsing activity. The TLS certificate on the destination is self-signed and the JA3 fingerprint does not match any known browser. Which phase of the Cyber Kill Chain does this activity most directly represent?

Which TWO of the following are primary goals of the 'Command and Control' (C2) phase?

A SOC analyst receives an alert that a workstation has an outbound connection to a known command-and-control IP address over TCP port 4444. The connection is long-lived and the process making it is 'rundll32.exe' with a command line referencing a DLL in the user's AppData folder. Which phase of the attack lifecycle does this activity MOST directly represent?

Which TWO of the following are valid examples of 'Host-based' Indicators of Compromise?

Which THREE of the following are commonly monitored artifacts for detecting 'Persistence' mechanisms?

A SOC analyst is reviewing EDR telemetry and observes that a user-level process named 'wscript.exe' spawned a child process 'powershell.exe' with the command line 'powershell.exe -nop -w hidden -enc JABjAGwAaQBlAG4AdAA...'. The parent process had been launched from an email attachment. Which attack technique is most strongly indicated by this chain of events?

During an incident response, a SOC analyst examines a Windows host and finds that the 'Image Path Name' for a service named 'UpdaterSvc' points to 'C:\Windows\Temp\svc.exe'. The service is set to start automatically and runs as LocalSystem. The file 'svc.exe' is unsigned and has a creation timestamp from yesterday. Which persistence technique is most likely in use?

A SOC analyst is reviewing DNS logs and sees a host repeatedly querying subdomains like 'a1b2c3d4e5.evil-domain.com' every 60 seconds, with each subdomain being a random 10-character string. The responses are consistently NXDOMAIN. Which attack technique is most likely indicated?

An analyst notices a spike in outbound traffic to a known sinkhole IP address. What does this indicate?

During a forensic analysis, you find a 'shimcache' entry indicating an executable ran from a volume that no longer exists. What does this suggest?

A SOC analyst receives an alert about a workstation making an outbound connection to a known malicious IP address on port 443. The connection is encrypted and occurs every 5 minutes with small, consistent packet sizes. Which phase of the Cyber Kill Chain does this activity most directly represent?

A SOC analyst is reviewing logs in a SIEM and notices multiple failed login attempts followed by a successful one from an unknown IP. Which specific IoC category does this activity represent?

During triage of a suspected intrusion, a SOC analyst observes that a user account belonging to the finance department successfully authenticated from an IP address geolocated in a country where the company has no operations, at 03:00 local time. The account had no prior logins from that region. Which phase of the attack lifecycle does this most directly represent?

A SOC analyst receives an alert from the SIEM showing a workstation repeatedly querying an algorithmically generated set of domain names, most of which resolve to NXDOMAIN, with a handful resolving to short-lived IP addresses. The analyst wants to map this behavior to the most likely stage of the Cyber Kill Chain and the corresponding IOC category. Which of the following best describes this activity?

Which of the following describes the 'Reconnaissance' phase in the Cyber Kill Chain?

A SOC analyst is building detection content for credential access techniques on Windows endpoints. Which two artifacts would most reliably indicate an attempt to dump credentials from LSASS? (Choose two.)

Which TWO of the following are considered indicators of a 'Data Exfiltration' attempt?