CCNA Threat Hunting And Detection Questions

DNS tunnelling exfiltrates data by encoding it in DNS queries, commonly abusing TXT records because they carry larger payloads. A high volume of TXT queries to unusual domains therefore signals tunnelling far more strongly than ordinary A or PTR lookups.

Script Block Logging (Event ID 4104) records the de-obfuscated script text even when the command line was obfuscated, so seeing DownloadString piped into Invoke-Expression with a hard-coded IP under a winword.exe parent is a strong, evidence-backed indicator of macro-based stager execution. The hunter has the actual code, the network destination, and the initiating parent, which together justify escalation rather than dismissal as benign administration.

Beaconing produces repeated connections at regular intervals with similar session durations and roughly symmetric or consistently sized payloads. These metadata patterns remain visible without decryption and can be baselined per host. Periodicity combined with destination reputation and payload size consistency is the standard method for finding C2 beacons in encrypted traffic.

PowerShell Script Block Logging records the actual script content executed in memory, which is essential because fileless malware leaves no executable on disk. It captures the malicious commands attackers run through PowerShell, providing the primary forensic evidence for such infections.

-WindowStyle Hidden suppresses the PowerShell console window, a technique attackers use to conceal malicious execution from the logged-in user. Legitimate administrative scripts rarely need to hide their window, making this parameter a strong indicator of suspicious activity in telemetry.

Process Explorer displays running processes in a hierarchical tree, showing each process's parent and children, which directly reveals process lineage during a hunt. This parent-child visualisation exposes suspicious spawning relationships that flat process listings or network-focused tools cannot show.

Scheduled task creation leaves two complementary traces: the schtasks.exe command line and the task definition file written under the Tasks directory. Correlating process creation with the subsequent file creation ties the actor to the artifact and enables detection even when the command line uses unusual arguments. This pairing gives the hunter both the mechanism and the persistence artifact, which is the most direct coverage available with the deployed configuration.

Event ID 4104 in the Microsoft-Windows-PowerShell/Operational log records script block logging, capturing the de-obfuscated script text after PowerShell decodes the Base64 -EncodedCommand payload. The engine log (400/800) only shows the encoded string, so 4104 is the provider that reveals actual content.

Get-ScheduledTask queries the Task Scheduler service and, combined with the -CimSession parameter, enumerates scheduled tasks on remote hosts, enabling enterprise-wide auditing for unauthorised entries. It returns task definitions including actions and triggers, exposing persistence mechanisms hidden in the scheduler.

Port 445 carries SMB directly over TCP, the channel PSExec and similar tools abuse for remote service creation and lateral movement. Monitoring 445 for anomalous internal connections exposes unauthorised admin shares and credential relay activity.

Hypothesis-driven hunting begins with a known adversary tactic, technique or procedure, then forms a testable hypothesis and searches logs for matching evidence. This satisfies the stem's requirement of starting from the tactic and working backward, unlike data-driven or intelligence-driven approaches that begin with anomalies or feeds.

Lateral movement via SMB often involves a compromised host connecting to many servers in a short period, attempting to spread. Frequency analysis of distinct destination IPs per source on port 445 can reveal this pattern. The short-lived sessions suggest automated scanning or exploitation, making this technique effective for detecting such behavior.

Remote WMI execution runs through the WMI provider host, wmiprvse.exe, which spawns the attacker's command as a child process on the target. Seeing wmiprvse.exe as the parent of a shell or scripting engine is a strong, direct indicator of remote code execution via WMI and is available through process creation auditing.

Legitimate svchost.exe lives in System32, is digitally signed by Microsoft, and is spawned by services.exe. An unsigned copy without version information running from C:\Users\Public with explorer.exe as parent violates all three of those invariants simultaneously, which is a strong masquerading signal. Escalating for memory acquisition, hash lookup, and network correlation is the defensible next step rather than assuming a benign anomaly.

Sysmon Event ID 10 logs process access events, including the source image, target image, and granted access rights. When a process accesses lsass.exe with access rights like 0x1010 or 0x1410, it strongly indicates credential dumping tools such as Mimikatz. This event provides the necessary telemetry to detect unauthorized memory reads of LSASS, making it the correct choice for this hunt.

Domains registered recently with no reputation are often used for malicious purposes, including exfiltration. Attackers frequently use new domains to avoid blocklists. Outbound traffic to such a domain, especially combined with other factors like data volume, is highly suspicious and indicative of exfiltration.

A JA3S fingerprint is the server-side TLS hello hash. A value unique to your environment and recurring across multiple hosts indicates one distinct server implementation, consistent with a specific C2 listener such as Cobalt Strike, rather than legitimate shared infrastructure.

Sysmon Event ID 1 records process creation with full command-line arguments and parent process details, exposing LotL abuse such as renamed system binaries or suspicious PowerShell invocations. This process-level telemetry satisfies the requirement to hunt adversary misuse of legitimate built-in tools.

Kerberoasting abuses any authenticated user's ability to request service tickets, so the strongest signal is a low-privilege account suddenly requesting RC4 tickets for many SPNs it has no business need for, especially at unusual times. This behavioral deviation distinguishes attacker enumeration from routine service access by authorized accounts during working hours.

certutil.exe includes URL cache and decode switches that fetch remote files and write them to disk, letting attackers download payloads using a signed Microsoft binary. This living-off-the-land abuse evades application allowlisting that blocks standalone download tools.

Event ID 4698 logs the creation of a scheduled task and includes the task's XML definition. The XML may contain a <Hidden>true</Hidden> setting, which indicates the task is hidden from the default view in Task Scheduler. Attackers often use this to conceal persistence. Focusing on this event and field directly addresses the scenario.

The StartUp folder is a classic autostart location; any new file created there indicates a program will execute at user logon, a common persistence technique. Monitoring this path detects unauthorised startup entries that other FIM events would miss.

Event ID 4769 is generated when a Kerberos service ticket is requested. In a Kerberoasting attack, the attacker requests service tickets for accounts with SPNs, which are encrypted with the service account's password hash. The attacker can then extract the ticket and crack it offline. Monitoring Event ID 4769 for requests with weak encryption types (e.g., RC4) and unusual service names is key to detecting Kerberoasting.

Attributing DNS queries to the originating process distinguishes malicious tooling from browsers and updaters. Sysmon Event ID 22 or equivalent DNS client logging shows which image issued the query, so a non-browser process generating thousands of random subdomain lookups strongly confirms tunneling or DGA behavior and identifies the compromised binary.

Direct-to-IP TLS, self-signed certificates, identical server fingerprints across multiple hosts, and periodic symmetric low-volume traffic are classic hallmarks of beaconing with a custom or malleable C2 profile. Because DNS and proxy data are absent, the JA3S value and destination IP become the highest-fidelity pivots. Correlating those across the estate can reveal additional compromised hosts and confirm the campaign scope before containment.

WMI persistence relies on `__EventFilter`, `__EventConsumer` and `__FilterToConsumerBinding` instances, all of which reside in the `root\subscription` namespace. Hunting there surfaces suspicious permanent event subscriptions, whereas default namespaces such as `root\cimv2` do not host these consumer classes.

Logon Type 3 is a network logon, and a single account authenticating to many hosts in a short burst is a classic lateral movement signature, typically via SMB, PsExec-style service creation, or remote scheduled tasks. Pivoting to share access events and service installation telemetry on the target machines confirms whether tools were dropped or executed.

Mimikatz extracts credentials by reading LSASS process memory, where Windows stores plaintext passwords, hashes and Kerberos tickets. Endpoint telemetry showing unusual processes opening lsass.exe with read access is therefore the strongest credential-dumping indicator during threat hunting.

Reading many files across disparate directories and then writing a single consolidated archive is the canonical staging signature: collection followed by compression into one artifact for exfiltration. Sysmon Event ID 11 file-create telemetry combined with Event ID 1 process creation for a compression utility lets the hunter tie the reads and the archive write to one parent process. This pattern is far more indicative of staging than ordinary backup or indexing activity.

DGA-generated domains often consist of random alphanumeric strings, resulting in high entropy. They may also use unusual TLDs to avoid blocklists. Length can vary, but high entropy and non-standard TLDs are strong indicators. This combination is commonly seen in malware using DGAs for command-and-control.

Domain Controllers hold authentication authority; interactive RDP sessions to them are rare in normal administration, which typically uses RSAT or WinRM. Such access often indicates credential theft and privileged lateral movement, warranting immediate investigation during threat hunting.

Pass-the-Hash reuses captured NTLM hashes over SMB, producing Type 3 network logons between workstations where no legitimate file-share access should occur. Workstation-to-workstation Type 3 authentication therefore indicates lateral movement with stolen credentials rather than normal user behaviour.

Standard deviation on interval deltas exposes beaconing because consistent command-and-control check-ins produce uniformly small deltas, yielding a low deviation, whereas irregular human traffic scatters widely. This aggregation directly satisfies the stem's requirement to reveal periodicity in connection intervals within ELK Stack, surfacing the regularity that other functions obscure.

DNS tunneling encodes exfiltrated data into subdomain labels, producing long, high-entropy strings that differ sharply from human-readable domain names. Because the logs lack payloads, label length and entropy are the most direct remnants of the encoded data. Legitimate services rarely generate such labels at scale, making this a high-value detection characteristic.

DGA malware rapidly cycles through many generated domain names until one resolves, producing a distinctive burst of NXDOMAIN answers from a single host. This pattern is not typical for legitimate applications, which query stable, known domains. The volume, randomness, and failure ratio together separate DGA activity from ordinary web traffic or typo-squatting by users.

AS-REP Roasting exploits accounts with Kerberos pre-authentication disabled, so the domain controller issues a Ticket Granting Ticket without verifying the requester's identity. Event ID 4768 records TGT requests, and its pre-auth not required field flags exactly those vulnerable accounts, satisfying the stem's requirement for a specific domain controller log indicator.

Sysmon Event ID 10 logs process access events, including the GrantedAccess mask and the target process. A GrantedAccess of 0x1410 (PROCESS_QUERY_INFORMATION | PROCESS_VM_READ) on lsass.exe is a strong indicator of credential dumping tools like Mimikatz. This event directly captures the suspicious access to LSASS memory.

C2 frameworks often use beaconing, where the infected host periodically checks in with the C2 server at fixed intervals (e.g., every 60 seconds) to receive commands. This regular, predictable timing is a strong indicator of automated C2 communication. While some malware uses jitter to randomize intervals, consistent beaconing remains a primary hunting lead. The other options are less specific to C2 and can occur in normal traffic.