Malware Incidents

Which THREE of the following are considered 'behavioral' indicators of a malware infection?

You are reviewing logs from an EDR and see an indicator of 'Living off the Land' (LotL). Which tool usage would be considered an LotL attack?

You are analyzing a malware sample that uses 'API Hooking'. What is the goal of this technique?

You have identified a malicious DLL that is being loaded by a legitimate process. Which tool allows you to view which DLLs are loaded by a specific process?

You are analyzing a malware sample that uses Domain Generation Algorithms (DGA). What is the primary purpose of DGA in malware?

A malware infection has encrypted several network shares. You decide to restore from backups. What is the most critical step to perform before restoring data to the production environment?

When eradicating malware, which TWO of the following steps are essential to ensure the host is fully cleaned and the entry point is secured?

An analyst is reviewing logs from an EDR solution. They see a 'process hollowing' event. What is the primary purpose of this malware technique?

You are analyzing a malware sample using Cuckoo Sandbox. The report shows the malware is attempting to modify the 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run' registry key. What is the intent of this activity?

You are analyzing a malware sample in a lab. You notice the malware uses the 'CreateRemoteThread' API. What is the objective of this malware activity?

You are using Wireshark to analyze traffic from an infected host. You notice consistent beaconing activity to an external IP on port 443. How do you isolate this traffic in your capture?

When analyzing a potentially malicious script, which THREE of the following techniques help in deobfuscating the code?

You have identified an infected machine and need to perform a memory dump before it is wiped. Which tool is the industry standard for acquiring a full memory dump on a Windows machine for incident response?

A malware sample was found to use a 'Mutex' to ensure only one instance of the malware runs at a time. What tool would you use to find the Mutex name on an infected host?

A system has been infected by a worm that is spreading across the network. What is the most immediate action to stop the spread?

Which THREE of the following are effective methods for protecting backup systems from being encrypted by ransomware?

During an incident, you need to isolate a compromised workstation from the network immediately. Which action is the most effective containment strategy while preserving volatile memory?

During a malware incident response, you identify a suspicious process with PID 4452 using Sysinternals Process Explorer. You need to verify the file's reputation before isolation. Which action allows you to do this directly within the tool?

You are performing forensic analysis on a suspicious file. You need to determine if it is a packed executable. Which tool is most effective for viewing the file's section headers to identify anomalies?

You are using YARA to detect a specific strain of ransomware. You want to match a file if it contains a specific hex string OR a specific string value. How do you construct this in your rule?

You are performing a live memory analysis using Volatility 3. You suspect a rootkit is hiding processes. Which plugin should you run to compare the process list from the EPROCESS block with the thread scheduler's list?

During the 'Recovery' phase of the malware incident, what must be done to ensure the environment is safe before reconnecting the restored systems?

A user reports their system is running slowly, and you observe a suspicious file in 'C:\Users\[User]\AppData\Local\Temp'. What is the most appropriate first step in your investigation?

When reviewing network traffic for C2 communication, which THREE of the following indicators are commonly observed?

Which THREE of the following tools would be most effective for performing live memory forensics on a compromised Windows workstation?

Which TWO of the following sources of information are most helpful for building an Indicators of Compromise (IoC) list during an investigation?

Which TWO of the following activities are considered 'Eradication' steps in the incident response lifecycle?

Which THREE of the following indicators are found in email-based malware delivery?

After eradicating a malware infection, you need to ensure the system is hardened against future occurrences. Which action is most effective against fileless malware?

You suspect a file on a Linux server is malicious. What command can you use to obtain the MD5 hash of the file?

During a malware analysis, which TWO of the following indicators are typically used to identify persistence mechanisms in the Windows registry?

An incident handler is analyzing a malware incident that used a phishing email. What is the most important field to check in the email header to determine the true origin of the email?

You suspect a malware incident caused unauthorized data exfiltration. Which log source is most useful to identify the destination IP of the exfiltrated data?

Which document is essential to maintain during a malware incident to ensure accountability and track the actions taken by the incident response team?