16 questions · Cyber Threats Iocs And Attack Methodology · All types, answers revealed
A system administrator reports high CPU usage on a server. Upon checking task manager, you find 'svchost.exe' running from a temp folder. What is the most immediate action?
Isolation prevents lateral movement and further C2 communication.
Why this answer
Identifying a process running from a suspicious location like Temp is a high-confidence IoC for malware.
You are analyzing a packet capture (PCAP) and find a beaconing pattern with a consistent 30-second interval and jitter of 5%. Which detection strategy is most effective for this IoC?
Analyzing flow intervals and jitter helps identify heartbeat-style C2 traffic.
Why this answer
Beaconing with jitter is a hallmark of C2 communication designed to evade simple threshold-based detection.
You are investigating an incident involving a malicious macro embedded in an Excel document. Which Windows process is typically the 'parent' of the malicious payload execution?
The document process spawns the malicious child process.
Why this answer
When a malicious macro runs, it often triggers 'cmd.exe' or 'powershell.exe' from the 'excel.exe' process tree.
You are tracking a threat actor who uses 'Living off the Land' (LotL) techniques. Which of the following commands is a classic indicator of this methodology?
Encoded PowerShell commands are a hallmark of LotL and obfuscated execution.
Why this answer
LotL techniques use built-in system tools like PowerShell or WMI to execute malicious actions, avoiding the need for custom malware.
A user complains that their browser homepage has changed. Upon inspection, you find a new, unsigned extension installed. Which attack methodology is this?
Modifying browser settings via extensions is browser hijacking.
Why this answer
Installing unauthorized browser extensions is a common technique for persistence and data theft (browser hijacking).
Which THREE of the following are characteristics of 'Advanced Persistent Threat' (APT) attack methodologies?
APTs use bespoke tools to bypass specific defenses.
Why this answer
APTs are characterized by their long-term focus, stealth, and specific target orientation.
Which of the following is considered a 'Network-based' IoC?
Domains are network indicators used for C2 or delivery.
Why this answer
Network-based IoCs include IP addresses, domain names, and URLs associated with malicious activity.
Which TWO of the following are primary goals of the 'Command and Control' (C2) phase?
C2 is the conduit for attacker input.
Why this answer
C2 allows the attacker to maintain access and send instructions to the compromised host.
In a Windows environment, which artifact would provide the best evidence of 'Lateral Movement' using Pass-the-Hash?
Type 9 indicates a NewCredentials logon, often associated with PtH.
Why this answer
Pass-the-Hash relies on NTLM authentication, making Security Event ID 4624 (type 9) the most reliable indicator.
Which TWO of the following are valid examples of 'Host-based' Indicators of Compromise?
System services are artifacts found on the host.
Why this answer
Host-based IoCs are artifacts found on the endpoint itself, such as files, registry changes, or running processes.
Which THREE of the following are commonly monitored artifacts for detecting 'Persistence' mechanisms?
Tasks are frequently used to trigger malicious code.
Why this answer
Persistence often relies on modifying startup folders, registry keys, or scheduled tasks.
An analyst notices a spike in outbound traffic to a known sinkhole IP address. What does this indicate?
The host is infected and is 'calling home' to a now-captured domain.
Why this answer
Sinkholes are used by security researchers to intercept traffic from infected hosts that are trying to contact a C2 domain.
During a forensic analysis, you find a 'shimcache' entry indicating an executable ran from a volume that no longer exists. What does this suggest?
The non-existent path strongly points to transient storage.
Why this answer
Shimcache (AppCompatCache) tracks file execution; if the volume is gone, it suggests a removable drive or virtual volume was used by the attacker.
A SOC analyst is reviewing logs in a SIEM and notices multiple failed login attempts followed by a successful one from an unknown IP. Which specific IoC category does this activity represent?
Failed logins followed by success is a common IoC for unauthorized access.
Why this answer
This behavior is a classic indicator of a brute-force attack or credential stuffing attempt.
Which of the following describes the 'Reconnaissance' phase in the Cyber Kill Chain?
Scanning is a primary recon activity to map the attack surface.
Why this answer
Reconnaissance involves gathering information to identify vulnerabilities before launching an attack.
Which TWO of the following are considered indicators of a 'Data Exfiltration' attempt?
DNS tunneling uses small, frequent requests to move data.
Why this answer
Exfiltration is characterized by large, anomalous outbound transfers and the use of unusual protocols.
Ready to test yourself?
Try a timed practice session using only Cyber Threats Iocs And Attack Methodology questions.