CCNA Identification of Malicious and Normal Activity Questions

The hosts file is a common target for malware that redirects known domains to loopback or to attacker infrastructure to intercept or block traffic. Mapping banking domains to 127.0.0.1 is a classic pattern that prevents the real site from loading while potentially enabling credential theft via a local listener. The unexplained modification and recent timestamp justify immediate investigation.

The legitimate parent of svchost.exe is services.exe, so a user Temp directory parent is a strong indicator of process injection, hollowing, or a masquerading loader. The command line matches a valid service host invocation, which an attacker would copy to blend in. Capturing a memory image of the process and checking loaded modules and thread start addresses is the appropriate next step.

The command uses IEX (Invoke-Expression) to download and execute a PowerShell script from a remote URL. This is known as a download cradle and is a classic fileless malware technique because the payload is not written to disk. The use of -W Hidden and -Exec Bypass further indicates an attempt to evade detection. Scheduled tasks are often used for persistence.

Identical SIA timestamps combined with different FNA timestamps are a classic sign of timestomping, where an attacker sets $STANDARD_INFORMATION to a false date. The earlier FNA timestamps reflect when the file name was actually created. The absence of a Prefetch file further suggests the executable may not have run, or Prefetch was cleared, so the analyst cannot assume execution from these artifacts alone.

Logon Type 3 confirms a network authentication (SMB, WMI, or similar), and Event 4672 is logged when a logon is assigned special privileges, here SeDebugPrivilege. The combination of an unexpected source subnet, a non-admin account name, and administrator-equivalent privileges indicates the account is being used with elevated rights from an unauthorized location, which warrants pivoting to the source host for further evidence.

Systematic probes across a large range of ports from a single source are the primary indicator of a port scan. Security analysts use this pattern to identify reconnaissance efforts, allowing them to block the offending IP address before the attacker can identify and exploit vulnerable services on the network.

Sysmon Event ID 3 records network connection events and includes the Image field (full path of the process executable) along with source/destination IP and port. This directly answers which executable initiated the connection to 203.0.113.45:443. If configured with adequate filtering, it captures this even when the process is short-lived, making it the most direct artifact for correlating a connection with an on-disk executable.

Using -EncodedCommand is a classic tactic to hide malicious PowerShell logic from simple string-based logging. Forensic analysts frequently encounter this in fileless attacks, where the script is base64-encoded and passed directly into memory, leaving no direct trace of the script file on the local file system.

Malware often names itself svchost.exe and places itself in user-writable directories like C:\Users\Public to appear legitimate. The parent being services.exe is likely spoofed or the malware was injected into a legitimate svchost process. The external connection on port 443 suggests command and control. This is a classic masquerading technique.

A legitimate lsass.exe should not have handles to arbitrary named pipes unless they are part of normal system operation. The presence of an unusual named pipe like 'evil' suggests code injection or a malicious module loaded into the process, allowing an attacker to communicate with it. This is consistent with credential dumping or persistence mechanisms.

The legitimate lsass.exe resides in C:\Windows\System32 and is digitally signed by Microsoft. A copy in C:\Windows\Temp is highly suspicious because system processes do not normally run from temporary directories. Verifying the digital signature and original location quickly confirms whether the file is the genuine Windows component or a masquerading malicious binary, making this the most direct first check.

Attackers frequently place DLLs in plausible-looking system directories and register them through rundll32 by export name so the payload executes inside a signed Microsoft binary. The author being a domain user who never logged on locally, combined with the DLL creation time matching the intrusion window, strongly supports a persistence mechanism rather than legitimate software installation.

Golden Tickets are often created with extremely long expiration times, sometimes years into the future. Monitoring ticket lifetimes is a highly effective way to identify forged TGTs, as standard Kerberos tickets have strictly enforced, short lifetimes defined by domain policies that a forged ticket would likely bypass or violate.

Attackers often name malicious processes to mimic legitimate system processes like kworker to avoid detection. A kworker process listening on a port is a strong indicator of a backdoor. The analyst should use tools like 'ls -l /proc/1234/exe' to find the executable and 'ps -fp 1234' to see the parent, which can reveal the malware's origin.

The 'Accepted publickey' message and the RSA SHA256 fingerprint confirm that SSH key-based authentication succeeded. The subsequent PAM session-open entry confirms a shell or session was established. With no preceding failed password attempts from that IP, this pattern is consistent with legitimate key-based access — though the analyst should still verify the key belongs to the expected user and that the source IP is trusted.

Decoding the base64 string reveals the original PowerShell code, which is essential for understanding the intended actions. This allows the analyst to identify malicious logic, such as network connections or file system changes, that the attacker was attempting to hide from traditional security monitoring tools and administrative logs.

Legitimate sshd is spawned by systemd and immediately opens its listening socket on port 22. A process named sshd but parented by bash and holding no listener was almost certainly started manually by an interactive shell, which is the hallmark of an attacker renaming a tool to masquerade as a system daemon while it performs other actions such as beaconing or credential collection.

LNK files and Jump Lists are specifically designed to track recent user activity. They record the path, access time, and volume information for files opened by the user. These artifacts remain on the system after the source file is deleted, making them invaluable for reconstructing past user behavior during an investigation.

WMI is a powerful administrative framework that is frequently abused for remote code execution and lateral movement. Because WMI operations are essential for system management, they often blend in with normal administrative traffic, allowing attackers to maintain persistence and control without installing custom, easily detectable malware binaries.

Event ID 4104 captures script block content, and an encoded script that decodes to a reflective loader is a classic fileless technique. Reflective loaders execute code directly in memory without writing to disk. This artifact provides evidence of the initial execution vector and the malicious payload, and when combined with memory injection evidence, strongly confirms an active fileless attack.

Logon Type 3 signifies a network authentication session, and Event ID 4672 explicitly records the assignment of special privileges to new logon sessions. Attackers routinely leverage network shares and administrative credentials to pivot across internal enterprise endpoints seamlessly.

Both the parent process (winlogon.exe) and the image path (C:\Windows\System32\lsass.exe) match the expected configuration for LSASS on a Windows 10 workstation. A masquerading lsass.exe would typically show a non-system path or an unexpected parent. These artifacts therefore support a benign classification, though corroborating evidence such as digital signature or handle analysis should still be reviewed.

Logon Type 3 with the NTLM package means the credentials were presented over the network rather than interactively, and the absence of 4672 special-privilege assignment or 4648 explicit-credential use suggests a straightforward authenticated network access. Because NTLM bypasses Kerberos policy controls, the record must be correlated with the account's normal source hosts to determine whether the authentication is anomalous.

Logon ID 0x3e7 is the well-known logon ID for the SYSTEM account (NT AUTHORITY\SYSTEM). Processes with this logon ID are typically spawned by services, scheduled tasks, or other SYSTEM-level components. While this is normal for many system processes, attackers who gain SYSTEM privileges will also generate events with this logon ID. Therefore, the analyst must correlate the process name and command line to determine if it is suspicious.

Mapping process IDs to remote network connections provides definitive proof of which executable is responsible for the beaconing. By comparing the process creation time and the socket initiation time, the analyst can identify the specific binary responsible for the traffic, which is a foundational step in host-based incident response.

Domain controllers should have strictly controlled outbound traffic profiles. An established connection to an arbitrary external IP address from a core infrastructure process like svchost is a classic indicator of compromise, suggesting the system is acting as a pivot or is participating in a command-and-control communication channel.

The repeated failures followed by a success from the same source IP describe a successful brute-force or password-guessing attack. The subsequent sudo invocation that adds a user to sudoers is a classic privilege escalation and persistence step, since it creates a second account with administrative rights. Both events, tied to the same session, form a coherent intrusion chain.

Event ID 4624 captures successful logons. During a Pass-the-Hash attack, the analyst looks for anomalous authentication patterns, such as the use of NTLM for logons that should be Kerberos, or logins occurring from systems that do not usually communicate with the target, indicating the reuse of intercepted hashes.

All observed attributes — namespace, executable path, argument, owner, and timestamp — align with a standard Edge updater installation. Because scheduled tasks are a common persistence mechanism, best practice is to confirm the binary is signed by Microsoft and that the timestamp matches the known Edge install baseline. This combination of corroboration supports a benign classification while still applying forensic rigor.

Invoke-Expression (IEX) allows PowerShell to execute strings as commands. Downloading a script from a URL and piping it to IEX is a common 'fileless' attack technique. This avoids writing the malicious script to disk, making it difficult for traditional file-based antivirus to detect or analyze the payload.

A high volume of 4625 events signifies repeated failed authentication attempts, which is the textbook definition of a brute-force or password-spraying attack. Locking the account and investigating the source IP is the standard and necessary incident response procedure to mitigate the risk of credential compromise in this scenario.

Event ID 4624 provides the critical context of how the user logged in, specifically via the Logon Type field. This allows investigators to differentiate between local interactive sessions and remote network sessions, which is essential for identifying unauthorized lateral movement across the domain during an incident investigation.

Sysmon event ID 10 logs process access events. When the target is lsass.exe and the granted access mask includes rights like PROCESS_VM_READ and PROCESS_QUERY_INFORMATION (commonly 0x1010 or 0x1410), it strongly indicates an attempt to read LSASS memory, which is a hallmark of credential dumping tools such as Mimikatz.

The connection is from a legitimate process (chrome.exe) to a remote IP on port 443, which is common for HTTPS traffic. However, malware can inject into legitimate processes or use them to communicate with command-and-control servers. Correlating the IP with threat intelligence and examining the process memory for anomalies (e.g., injected code, suspicious strings) is the logical next step to determine if the connection is malicious. This approach balances the need to investigate without assuming benign or malicious.

Logon Type 10 is the specific identifier for Remote Interactive logins, typically associated with RDP connections. This is the primary forensic artifact used to distinguish human-driven remote access from automated system tasks or background service authentication, which use different logon types within the Windows event auditing subsystem.

Residues of credential-dumping frameworks such as the sekurlsa module strings or the Mimikatz kernel driver can persist in memory after execution and are recoverable from a full memory capture. Finding them demonstrates the tooling was present and loaded on the host, which corroborates that LSASS memory was targeted even if the dumping process has already exited.

Multiple failed logon attempts followed by a successful logon for the same account often indicate a user who forgot their password or made typographical errors. While this could also indicate a brute-force attack, the pattern alone without other indicators (like many different accounts or high volume) is most consistent with normal user error.

Sysmon Event ID 3 records outbound network connections with process, source, destination, and port details. Repeated connections to the same external IP at consistent intervals are a hallmark of beaconing and directly evidence command-and-control traffic. Correlating the initiating process image and its hash strengthens the finding, making this one of the most direct artifacts for confirming periodic C2 behavior from the endpoint itself.

The 'Net.WebClient' class is the standard, built-in way for PowerShell scripts to perform HTTP or HTTPS GET/POST requests to download remote data. In incident response, the presence of this class in a script is a strong indicator of a download-and-execute operation used by attackers to pull secondary malicious payloads.

Attackers frequently modify the SI attributes to make malicious files appear older or consistent with other system files. Because they often overlook the FN attributes, comparing the two reveals the manipulation. This discrepancy is a standard forensic indicator used to identify hidden files that were created or modified maliciously.

Attackers frequently use -EncodedCommand to obfuscate PowerShell payloads, and -WindowStyle Hidden to avoid detection. A scheduled task created by a non-administrative user that runs such a command hourly is a classic persistence mechanism. This finding warrants immediate investigation of the encoded command and the task's origin.

A root-owned executable in /tmp that is not tracked by the package manager and is parented by cron strongly suggests an attacker added a cron entry to execute a dropped binary. The name mimics a kernel worker to blend in, but kernel threads lack disk executables. The combination of location, ownership, parent, and missing package record makes a malicious interpretation the most defensible.

The LastWrite time of a registry key indicates when the key was last modified. For a newly created service, the LastWrite time of its key in the SYSTEM hive will reflect the creation or last modification time. If this time correlates with the suspected infection window and the service binary is in a user-writable directory, it strongly suggests the service is malicious. Legitimate Windows services typically have older, consistent LastWrite times.