GIAC Certified Incident Handler (GCIH) — Questions 1–75

LotL techniques leverage legitimate tools that are signed and trusted by the OS. Antivirus signatures are designed to identify known malicious code; because the binaries themselves are benign, the AV ignores them. Detection must focus on the suspicious flags and command-line arguments, which AV does not typically inspect.

The application trusts the client-supplied account ID without verifying that the authenticated user owns that object, so tampering with the hidden parameter returns other customers' records. Authorisation must be enforced server-side against the session identity, not the submitted identifier.

Chisel is highly effective for creating SOCKS proxies because it encapsulates traffic within HTTP/HTTPS, often bypassing basic firewall egress rules. Because it uses a client-server model, it allows attackers to easily tunnel arbitrary traffic through a compromised node, making it a critical tool to monitor.

Hashcat mode 1000 is standard for NTLM. NTLM is the legacy authentication protocol in Windows, and obtaining the plaintext password or the hash allows an attacker to impersonate the user, move laterally through the network, or escalate privileges within an Active Directory forest.

Cross-checking CVE identifiers against NVD or a similar authoritative database catches misattributions and invented identifiers before they propagate into remediation workflows. The LLM may confuse similar CVEs or invent plausible identifiers, and an external validation step provides deterministic ground truth. This is a reliable control against hallucinated or mismatched vulnerability references.

Parameterised queries and prepared statements separate SQL code from user-supplied data, so input is bound as values rather than concatenated into statements. The database never interprets injected text as executable SQL, satisfying the primary defence requirement against SQL injection.

Automated C2 beacons are programmed to check in at specific intervals, often with added 'jitter' to evade detection. The consistency of these timing patterns across long durations is a primary indicator of automated, non-human network activity, distinguishing it from the erratic nature of human web browsing.

Responder responds to broadcast resolution queries by claiming to be the target resource. When the Windows client tries to authenticate to the 'service', it sends its NTLM challenge-response, which Responder captures. This hash can then be cracked offline or relayed to other network resources.

The NTLM authentication protocol is designed to verify identity using a challenge-response mechanism based on the user's hash. As long as the attacker has the valid hash, they can participate in the challenge-response process just like the legitimate user, gaining unauthorized access to the network resources.

Scheduled tasks are a common persistence mechanism. By configuring a task to run at logon, the attacker ensures the malicious executable executes automatically after a reboot or user session. This allows the attacker to maintain access without needing to re-exploit the system.

LiME is the industry-standard tool for Linux memory acquisition because it is specifically designed to handle the complexities of kernel memory. It minimizes system impact and can be used to stream the memory image over the network, ensuring that the evidence is captured with high fidelity and integrity.

Adding false positives to the training set allows the model to learn the boundary between legitimate admin activity and malicious PowerShell usage. This process of continuous learning improves model accuracy over time, significantly reducing the burden on the SOC by filtering out expected, non-malicious behavior from the daily alert queue.

Null sessions allow anonymous users to query the server's Security Account Manager (SAM) and other internal databases. This provides attackers with a roadmap of the network, including usernames and shared resources, which they then use to craft targeted attacks, brute-force passwords, or plan lateral movement strategies throughout the enterprise.

Argon2id is a memory-hard key derivation function that requires significant memory and CPU resources, making it highly resistant to GPU-based cracking. A high iteration count further increases the computational cost. This combination forces the attacker to expend substantial resources for each guessing attempt, dramatically slowing down offline cracking of the master password.

The -sn option performs host discovery only, skipping port scanning entirely. Nmap still sends ICMP echo, TCP SYN to port 443, TCP ACK to port 80, and an ICMP timestamp request by default, so it can detect hosts that block ICMP but respond on common TCP ports, which fits the flat subnet requirement.

The use of randomly generated subdomains and TXT records with encoded data at regular intervals is a classic sign of DNS tunneling. Attackers encode command-and-control data or exfiltrated information within DNS queries and responses to bypass network controls. The consistent timing suggests automated beaconing, which is typical of such malware.

LLM-generated detection logic frequently over-generalizes, and a rule matching a common HTTP header with broad wildcards will trigger on legitimate traffic. Validating against benign corpora quantifies the false positive rate and reveals which strings are too generic. Tuning before deployment prevents alert fatigue and sensor overload, which is the responsible next step for any generated detection content.

Process hollowing involves creating a legitimate process in a suspended state, unmapping its original memory, and replacing it with malicious code. This allows the attacker to execute their payload under the guise of a trusted, signed application, successfully bypassing many security controls that monitor for process startup patterns.

Salts are stored in the shadow file in plaintext alongside the hash. Their purpose is to prevent precomputed rainbow tables and to ensure identical passwords produce different hashes, but they do not slow down a targeted dictionary attack. An attacker who knows the salt can compute the hash for each candidate password and compare, so salting alone does not prevent offline cracking.

The random subdomains and TXT responses carrying Base64 data are characteristic of DNS tunneling, where an attacker encodes C2 instructions or exfiltrated data within DNS queries and responses. The use of TXT records to return payloads further confirms this, as legitimate DNS TXT records rarely contain such encoded data in this pattern.

This is correct. SHA-512 crypt is a key derivation function that applies thousands of iterations by default, making each guess computationally expensive. Offline cracking is the only viable route because the hashes are not directly usable for authentication. The attacker's success hinges on the entropy of the original passwords, the number of rounds specified in the hash string, and the hardware available for brute-force or dictionary attacks.

Manual analysis provides independent verification of the AI tool's assessment. Static analysis can reveal suspicious imports or strings, while dynamic analysis in a sandbox can show actual behavior. This approach ensures that decisions are based on multiple sources of evidence, reducing the risk of false positives or negatives.

Correlating network connection timestamps with endpoint process execution logs allows analysts to identify the exact binary that initiated the socket. This bridges the visibility gap between network telemetry and host activity, confirming whether an unauthorized script or tool spawned the connection.

The creation of a new local account and its addition to the Administrators group is a classic backdoor technique. Attackers create such accounts to maintain access even if their initial foothold is removed. The fact that the account has never been logged into suggests it is a dormant backdoor, waiting to be used. Event IDs 4720 and 4732 confirm this activity.

The encoded ../ sequences (%2f is URL-encoded '/') combined with a 200 response of 1845 bytes indicate the readfile() call resolved outside the intended directory and returned /etc/passwd contents. Because only reading occurs and no code executes, this is LFI/path traversal, not remote code execution, and it is constrained to files readable by the www-data account.

ntlmrelayx creates a named pipe and listens for incoming SMB connections from a target (e.g., domain controller) and relays the authentication to another server. This matches the description of waiting for a domain controller connection and relaying attempts. It is a classic NTLM relay technique.

Submitting binary analysis data or specific malware fragments to an external LLM puts that information into the provider's domain. If these contain proprietary code structures or highly specific indicators unique to the organization's network, they could be exposed, compromising the current defense efforts and revealing sensitive threat intelligence publicly.

Introspection reveals types, fields, arguments, and mutations, giving attackers a complete blueprint of the API. This enables precise targeting of sensitive operations, such as user data retrieval or privilege escalation via mutations. The exposure significantly reduces the effort needed for further attacks, making it a serious information disclosure issue. This is the primary risk when introspection is left enabled without authentication.

Physical memory is the most volatile and contains running processes, network connections, and encryption keys. It is lost when the system is powered off. According to the order of volatility, RAM should be captured before any disk or less volatile data to preserve critical evidence that may not exist elsewhere.

This accurately describes the mechanism of an SMB Relay attack. By positioning themselves as a man-in-the-middle, the attacker captures the authentication handshake and forwards it to a destination server. This allows the attacker to authenticate as the victim, effectively pivoting to a new host without cracking passwords.

Salts prevent rainbow tables by ensuring that the hash for a password like 'password123' is unique for every user. Because the attacker cannot precalculate the hashes for all possible salts, they cannot use a standard table to crack the stolen database quickly, forcing a much slower brute-force approach.

SMB serves as the backbone for file and resource sharing in Windows. It enables users and applications to request and receive files and print jobs from remote servers, acting as a critical component of network operations that requires careful security management to prevent data leakage and lateral movement attacks.

In SMB2, a single session (established via Session Setup) can be used to connect to multiple shares on the same server by issuing separate Tree Connect requests, each with a different share path. This is standard behavior when a user has permissions to multiple shares and is accessing them concurrently, such as during normal file operations.

The API allows the client to overwrite the 'final_price' attribute, which should be a server-calculated value. This is a classic Mass Assignment flaw where the application layer blindly binds user-supplied JSON properties directly to the backend object model, allowing the attacker to alter critical business logic.

The defining characteristic of a Skeleton Key attack is that the attacker can use a single, hardcoded password to log in as any user on the network. Detecting a sudden spike in diverse user accounts authenticating with the same password is a definitive sign of this attack.

When the domain password is changed, the local cached credential becomes invalid. The workstation continues to send the old password, resulting in authentication failures. This is a common support issue and a potential security concern, as it can lead to account lockouts and indicates that the workstation is misconfigured for current environment security.

Sysmon Event ID 7 logs when a module (DLL) is loaded into a process, including the Image (process) and ImageLoaded (DLL path), along with hashes and signature information. This directly shows which process loaded the malicious DLL and the DLL's location, enabling the responder to identify the hijacked DLL and the legitimate executable involved. It is the most direct evidence source for DLL load events.

SSRF occurs when an application fetches a remote resource without validating the user-supplied URL, allowing attackers to make requests to internal systems. In this scenario, the attacker supplied a URL to the cloud metadata service, and the server fetched it, exposing credentials. This is a classic SSRF exploitation. The other options do not match the behavior of the server making a request to an attacker-controlled or internal URL.

High-volume DNS queries with long, random subdomains to a single domain are characteristic of DNS tunneling. Attackers encode data or commands in the subdomain fields to bypass network controls that allow DNS. The consistent timing and cloud-hosted destination further support a covert channel using DNS as the transport for C2 or exfiltration.

The stack trace from a single quote in a numeric parameter is a classic indicator of SQL injection. The application likely concatenates the `pid` value directly into a SQL query. To confirm impact, the tester should craft payloads to retrieve database metadata, such as table names and user credentials, using UNION SELECT or error-based techniques.

Shadow copies provide a point-in-time snapshot of the system. Investigators often use them to compare the current state of the system against a known-clean state or to recover deleted malicious files and modified configuration files that an attacker attempted to hide by overwriting them on the live disk.

The command dumps the contents of LSASS memory, which often holds cleartext passwords for logged-in users, as well as NTLM hashes and Kerberos tickets. Gaining these credentials allows an attacker to move laterally throughout the domain with the privileges of the victim.

Hosting the model on team-controlled infrastructure keeps all Indicators of Compromise within the boundary permitted by the contract, because no data leaves for a third-party service. Open-weight models can perform summarization and extraction tasks adequately when prompted and validated appropriately. This satisfies the prohibition on sending client data externally while still delivering LLM-assisted analysis, making it the correct approach for the stated constraint.

Deactivating the access key immediately prevents further use of the stolen credentials, stopping the attacker from continuing to access AWS resources. It does not delete the key, so it can be re-enabled if needed for legitimate purposes, and it preserves the key's metadata for audit. This is a critical containment step that balances security with the need to maintain evidence.

Balanced data prevents the model from favoring majority classes. By providing an equal representation of various malware families, the algorithm learns the distinct features of each, leading to higher accuracy during inference. This balanced approach is critical for maintaining high detection rates across diverse threat vectors during active incident investigations.

Credential dumping from LSASS is a common post-exploitation technique to extract plaintext passwords, NTLM hashes, and Kerberos tickets. Attackers use tools like Mimikatz or ProcDump to access LSASS memory. The goal is to harvest credentials that can be used for lateral movement, privilege escalation, or persistence. This matches the scenario's description of extracting credentials from LSASS.

DNS TXT records are often used in tunneling because they can store arbitrary data strings. A significant spike in these requests, especially to an unknown or suspicious domain, is a strong indicator that an attacker is using the DNS protocol as a covert transport mechanism.

Using indirect references decouples the user-supplied input from the actual file system path. By mapping a simple identifier to a specific file location on the back-end, the application ensures that users cannot influence the path resolution process. This is the recommended secure design pattern to prevent directory traversal and related attacks.

The hidden text is indirect prompt injection delivered through content the model treats as trusted context. Structuring prompts so retrieved or scraped material is clearly delimited as data, and never as executable instruction, removes the model's incentive to follow the embedded command. This directly targets the mechanism that caused the rogue recipient suggestion, making it the most precise control for this scenario.

The Security log records security-related events, including successful and failed logon attempts (event IDs 4624 and 4625), account management, and privilege use. This is the primary log for auditing authentication activity. By examining it, the responder can identify which accounts were used and whether unauthorized access occurred, directly addressing the investigation goal.

The same session retrieved two different departments' documents simply by incrementing a numeric parameter. That is the classic signature of an insecure direct object reference: the server accepts the client-supplied identifier and returns the object without verifying entitlement. The unchanged session cookie confirms the requests came from one identity, ruling out session confusion as the explanation.

The application reflects the user-supplied query parameter 'q' directly into the HTML without sanitization. An attacker can inject a payload like '" onmouseover="alert(1)" to execute code. This vulnerability occurs because the server trusts input and fails to perform context-aware encoding before sending the response to the client browser.

The -sn option (ping scan) disables port scanning and only performs host discovery. It sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp requests to determine which hosts are up. This is the fastest way to identify live hosts without scanning ports, making it the correct choice for the scenario.

LotL binaries often require specific, unusual flags to perform malicious tasks like downloading content or executing remote code. Logging and analyzing these command-line arguments is the most effective way to detect misuse of trusted binaries, as the tool itself is legitimate but the parameters reveal the attacker's intent.

Comparing each codename against the reconnaissance dataset turns verification into a deterministic set-membership check against known ground truth. Any codename absent from the collected data is removed before the pretext is used, eliminating invented references. This directly answers the engagement manager's question because it relies on the actual discovered information rather than on the model's own assertions or statistical consistency.

The input `*)(uid=*))(|(uid=*` manipulates the LDAP filter structure, causing the authentication query to match any user. This is classic LDAP injection: unsanitized user input alters the filter logic, allowing the attacker to bypass authentication or enumerate directory objects. The incident handler should recognize this pattern as distinct from SQL injection, even though both involve injection into query languages.

The application fails to validate the file type, allowing the tester to upload a PHP file that is then executed by the web server. This is a classic unrestricted file upload vulnerability that leads to remote code execution, as the attacker can run arbitrary commands on the server.

Periodic connections at regular intervals, often called beaconing, are a hallmark of C2 communication because malware typically checks in with its controller at set times to receive commands or exfiltrate data. This pattern is distinct from normal user traffic, which is more random. The regularity can be configured by the attacker to blend in, but it remains a strong indicator.

Behavioral monitoring focuses on what the malware does rather than its code signature. Polymorphic malware still exhibits malicious behaviors like creating unusual processes, connecting to C2 servers, or modifying registry keys. AI-assisted tools can baseline normal behavior and flag deviations, making this an effective detection method even when signatures change.

BOLA occurs when an application relies on user-provided input to identify an object but fails to verify that the authenticated user actually has the permissions to access that specific object. This enables attackers to interact with resources belonging to other users simply by changing identifiers.

MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It lets the responder map the executable's behavior to specific techniques, understand which threat groups use them, and prioritize detection and response actions. This directly answers the need to contextualize the suspicious binary against known TTPs.

A 4-byte salt provides only 2^32 possible values, which is insufficient to prevent precomputation attacks. If the salt is generated predictably, attackers can precompute hashes for common passwords with all possible salts. This defeats the purpose of salting, which is to ensure unique hashes even for identical passwords and to thwart rainbow tables.

Invalidating active temporary credentials and modifying the role policies stops ongoing unauthorized API access. This directly mitigates the risk of lateral movement across the cloud environment by cutting off the compromised instance profile's valid session tokens.

Pre-commit hooks catch secrets before they are committed to the local repository. This prevents sensitive data from ever reaching the remote server. It is a proactive, shift-left security control that empowers developers to fix mistakes locally, maintaining the integrity of the codebase and preventing accidental credential leakage effectively.

Mass assignment arises when automated object mapping features bind HTTP request parameters directly to internal data structure properties. Attackers exploit this by appending sensitive fields like role or status flags to registration or profile update payloads to gain unauthorized administrative privileges.

Kerberoasting involves requesting service tickets for accounts with SPNs and cracking them offline. Event ID 4769 with RC4 encryption from a single workstation for multiple service accounts is a strong indicator. The detection should correlate the requesting user and the targeted service accounts to identify the compromised account and affected services.

Manual review is a critical step in the AI development pipeline. Replacing deprecated functions with modern, secure alternatives and testing the payload in a controlled environment ensures the code is both functional and safe to use, mitigating the risks associated with the model's tendency to suggest outdated coding patterns.

The attacker defined an external entity in the DOCTYPE that pointed to a local file, and the parser resolved it, returning the file's contents. This is the defining behavior of XXE injection. The SOAP endpoint accepted XML and processed the entity without disabling external entity resolution, allowing local file disclosure.

DNS tunneling often involves encoding data in subdomains, resulting in long, random-looking labels. A high volume of queries to a single domain can indicate a covert channel. This pattern is characteristic of tools like iodine or dnscat2, which use DNS to transfer data. The randomness and length are key indicators.

If the 'alg' header is set to 'none', the token is effectively unsigned. If the API implementation is vulnerable, it will trust the payload without requiring a cryptographic signature, allowing attackers to forge arbitrary tokens by modifying the payload content to elevate privileges or impersonate other users.

IDOR occurs when an application exposes a reference to an internal object, such as a database key, and fails to verify that the requesting user is authorized to access that object. In this scenario, the orderId directly references an order, and the API does not check ownership, allowing Alice to access Bob's order by simply changing the ID. This is a classic horizontal privilege escalation via IDOR.

Analyzing the parent process is essential to determine if a process was spawned by an expected entity. Anomalous process lineages, such as a browser spawning a command shell, are strong indicators of exploitation. This context helps differentiate between normal system operations and malicious activity, enabling effective incident detection and root-cause analysis.

A memory dump preserves the injected code, strings, and network artifacts, allowing the analyst to confirm process hollowing or injection. Examining loaded modules can reveal unsigned or suspicious DLLs. This is the least disruptive first step that gathers crucial evidence before any containment action.

API keys are long-lived static secrets that often appear in source code, configuration files, or logs. Since they typically grant permanent access until revoked, their leakage represents a high risk, as attackers can use the stolen keys indefinitely without needing to re-authenticate or renew session tokens.

Prepared statements separate SQL code from data, so user input is bound as a parameter and cannot alter query structure. This eliminates the injection point regardless of input content. For the profiles query, the username would be passed via a placeholder, making classic payloads like ' OR '1'='1 ineffective. This is the definitive code-level fix for SQL injection.