GIAC Certified Incident Handler (GCIH) — Questions 226–300

IIS worker processes (w3wp.exe) should rarely spawn PowerShell. When they do, it is a high-confidence indicator of a web application compromise, such as a web shell executing commands. This detection is tailored to catch the specific behavior of attackers attempting to pivot from a web exploit to system-level execution.

PID 4 is the System process, which handles network traffic for the Server service, including SMB (TCP 445). This traffic is typical for a server responding to legitimate client requests. An analyst should differentiate between standard operating system network behavior and suspicious outbound connections to unauthorized external IP addresses.

The API trusted the client-supplied identifier without verifying that the authenticated user owned or was authorised for that record. Changing /users/104 to /users/1 returned another user's administrative data, which is the defining pattern of Insecure Direct Object Reference.

Pass-the-Hash relies on the NTLM authentication protocol. If target systems are configured to only accept Kerberos authentication, the attack will fail. Therefore, NTLM must be enabled and permitted on the target systems for the hash to be used directly for authentication. This is a fundamental requirement for the attack to succeed.

Modifying /etc/ld.so.preload to load a malicious shared object causes the dynamic linker to preload that library into every process. The library can hook functions like readdir and open to hide files and processes, producing manipulated output from commands like ls and ps. This is a classic userland rootkit technique on Linux that does not require kernel modifications.

The 'sc query' command is designed to retrieve the status of a registered service, not to define a new one. To register a service, the attacker must use 'sc create [ServiceName] binPath=...'. The provided command failed because it was querying for an object that was never defined.

The workstation normally uses SMB 3.1.1, but the capture shows only SMB 2.0.2 offered and NTLMSSP authentication instead of Kerberos, indicating a man-in-the-middle stripped higher dialects and forced weaker authentication. This aligns with an SMB downgrade attack, where the attacker manipulates negotiation to weaken security and capture or relay credentials.

Running generated commands in a disposable, isolated sandbox contains any destructive or unintended action the model produces, including commands induced by crafted input. Because the environment is ephemeral and lacks network reach into production or client systems, manipulation cannot translate into real-world impact. Review and approval before promotion to live systems adds a human gate, directly limiting blast radius as required by the scenario.

IAM roles provide temporary security credentials that expire automatically, effectively mitigating the risk of credential theft. By leveraging AWS Security Token Service (STS), developers can assume roles only when needed. This approach eliminates the need for managing static keys, significantly reducing the attack surface for programmatic cloud access.

Sysmon event ID 1 logs process creation and includes rich details such as the full command line, parent process ID, user account, and hashes. This directly answers the analyst's need to see the exact PowerShell command line and its parent process, enabling reconstruction of the attack chain. Sysmon is commonly used in incident response for this level of detail.

The IPC$ share is a primary target for attackers during the reconnaissance phase. It allows them to interact with the system's administrative features without needing a standard file share. Frequent connections to IPC$ are a hallmark of an attacker mapping the network or attempting to execute remote commands via SMB.

SSE-KMS with a customer managed key uses AWS KMS to manage the encryption keys, providing centralized control, audit trails via CloudTrail, and the ability to rotate keys. Enabling default encryption ensures all new objects are encrypted automatically without relying on users to specify encryption headers. This directly satisfies the requirement for KMS-managed keys and enforced encryption.

Missing authorization checks on resource identifiers allow authenticated users to access or modify objects by altering parameters like user IDs in the URI. This represents a classic failure of object-level access controls within modern RESTful API architectures.

The --reason option makes Nmap display the reason code for each port state, such as syn-ack, resets, or no-response, directly in the output. This lets the responder differentiate a closed port that returned a TCP RST from a filtered port that produced no reply, which is exactly what the DMZ analysis requires.

The source IP address and timestamp provide a unique combination that can be used to correlate the web request with other log sources, such as database logs, firewall logs, or authentication logs. This allows the incident handler to trace the attacker's actions across multiple systems and determine if the SQL injection led to further compromise.

AI models are only as good as the data they process. High-quality, normalized telemetry from across the environment is essential for the AI to identify meaningful patterns. Inconsistent or poor-quality logs lead to missed detections and high false-positive rates, rendering even the most sophisticated AI models ineffective for malware hunting efforts.

The policy is flawed because it only looks for the '-enc' string. PowerShell accepts various abbreviations for encoded commands, such as '-encoded', '-e', and '-en'. By using a different variation, the attacker effectively circumvents the filter, demonstrating the weakness of signature-based argument blocking.

OpenAPI documents provide a ground truth of the API's intended design, including expected input formats, authentication methods, and endpoint definitions. Responders use this to detect anomalies by comparing actual request structures against the documented schema to identify malicious variations or unexpected inputs.

Event ID 4624 is critical because Pass-the-Hash attacks result in successful authentication sessions without requiring plaintext passwords. Analysts examine the logon type and authentication package fields within this event to identify anomalous network logons utilizing NTLM.

Base64 is a reversible encoding scheme, not an encryption method. Attackers can easily decode and modify the payload before re-encoding it. The security failure stems from the reliance on this 'obfuscation' instead of implementing robust server-side authorization checks to verify if the user is permitted to access the modified ID.

SMB signing adds a cryptographic signature to each packet, ensuring that the traffic has not been modified in transit. This is a primary defense against man-in-the-middle attacks, as an attacker cannot forge or alter packets without the server detecting the invalid signature, effectively neutralizing the relay attack vector.

Model output can contain unintended functionality that exceeds the authorized scope. Running it in an isolated replica lets the operator observe actual behavior, confirm no destructive or out-of-scope actions occur, and verify the payload does what the engagement intends. This directly enforces the rules of engagement before any live delivery and is a core validation step for AI-assisted offensive tooling.

The attacker uses `../` sequences to navigate outside the intended directory and access a system file. This is the definition of Path Traversal, also known as directory traversal. The application fails to sanitize the file path, allowing access to files outside the web root. The success of retrieving `/etc/passwd` confirms the vulnerability.

When a large number of users suddenly report account takeovers, it is a strong indicator that their credentials have been exfiltrated and are being actively used by an attacker. This is often the first real-world sign that a database has been breached and the hashes cracked offline.

Enabling the HttpOnly attribute instructs browsers to restrict cookie access exclusively to the HTTP protocol. Consequently, malicious JavaScript running inside an exploited browser session cannot read or exfiltrate the session identifier via document.cookie properties during an XSS attack.

Restricting the model to advisory output means no containment action occurs without an analyst deliberately authorizing it, so a manipulated recommendation cannot disable production services on its own. Routing approvals through the existing ticketing workflow preserves accountability and gives responders context to judge each suggestion. This design directly addresses leadership's concern by ensuring the model never holds execution authority over critical systems.

The attacker is using ../ sequences to escape the intended base directory and read files outside it, which is classic Path Traversal. The Java code concatenates user input directly onto a base path without canonicalization or a whitelist, so the servlet opens /etc/passwd instead of a permitted file. The presence of root:x:0:0 in responses confirms successful traversal, making Path Traversal the accurate classification.

Path traversal directly affects the server's file system, making it an OS-level concern. IDOR is a logic flaw within the application's authorization implementation, where the application fails to distinguish between users when accessing data objects in its database. This structural difference dictates how each must be tested and remediated.

Raw ICMP tunnelling hides commands inside payloads, so signature or content inspection fails once obfuscated. Statistical analysis of packet frequency, inter-arrival timing and payload size distributions exposes the anomalous traffic pattern inherent to the covert channel, regardless of payload encoding.

The API authenticated the caller but never verified that the caller owned account 8842 before returning its transactions, which is the defining characteristic of broken object level authorization. Access control must be enforced per object on every request using the authenticated identity, not merely by requiring a valid session. This is why a legitimate user can read another customer's financial records simply by changing the identifier.

The policy strictly restricts scripts to the origin and a specific CDN. Inline scripts are not allowed by the policy, so the browser identifies the violation, stops the script from running, and sends a report to the configured CSP reporting endpoint. This protects users from the malicious script execution.

When a document exceeds the model's context window, the input is truncated, and content beyond the limit is never processed, so indicators in later sections are silently dropped. A 200-page report easily exceeds typical context limits. Chunking the document or using a retrieval pipeline ensures all content is seen before summarization.

AI-generated domains may follow different statistical patterns than traditional DGAs. If the detection model was trained primarily on known DGA families, it may not generalize to novel AI-generated domains. This is a common limitation of machine learning models when faced with evolving threats, requiring retraining with new data.

NoSQL injection occurs when user input is not properly sanitized before being included in a NoSQL query. Operators like `$ne` (not equal) and `$gt` (greater than) can alter query logic. For example, injecting `{"$ne": null}` into a password field can bypass authentication by matching any non-null value. This statement correctly identifies the attack type and its root cause.

In Linux shadow files, the $1$ prefix denotes MD5 crypt, a legacy hashing scheme that is fast and therefore weak against modern cracking. Recognizing this prefix is important because it tells the analyst to select the corresponding mode in cracking tools and to recommend migration to a stronger algorithm such as yescrypt or SHA-512 crypt.

Key stretching algorithms like PBKDF2 force the hashing operation to run thousands of times. This dramatically increases the computational cost of testing a single password candidate, which slows down offline cracking attacks by orders of magnitude compared to un-stretched hash functions.

By logging in as User A and attempting to access an object owned by User B, the auditor confirms if the application performs authorization checks. If the request succeeds, it proves the system only validates the session, not the ownership of the referenced object, confirming the IDOR flaw.

AI assistants can produce plausible but incorrect commands or outdated syntax. Verifying against authoritative vendor documentation and testing in a lab or non-production system prevents accidental disruption of production services. This validation step is essential before executing any AI-recommended action, especially commands that modify system state or delete data.

High-latency networks require longer wait times for packet responses. Aggressive timing templates use very short timeouts, meaning probes are marked as 'filtered' before a reply can return. This results in an inaccurate scan that reports services as unavailable when they are actually operational, which is a major failure for any assessment.

This describes an adversarial perturbation. Attackers use these to exploit the mathematical weaknesses in the way AI models process features. Because the change is minimal and non-functional, the malware continues to behave normally while the AI model incorrectly tags it as legitimate, demonstrating the core mechanism of adversarial machine learning attacks.

Flow data is specifically designed to provide summary information about network traffic. This includes the source IP, destination IP, ports, protocol, and the volume of data transferred, which is essential for identifying anomalous communication patterns during a post-incident forensic investigation.

Impersonation is the core goal of token manipulation. By taking the security token of a higher-privileged process, the attacker can execute commands with those elevated permissions. This is a common and powerful technique used during lateral movement to gain control over critical system components and administrative resources.

IDOR occurs when an application provides direct access to objects based on user-supplied input. By manipulating the ID parameter, the attacker accesses unauthorized data records. APIs are particularly susceptible to this when they rely on sequential IDs for object retrieval without verifying user permissions.

SMB signing ensures the integrity and authenticity of SMB communications. If signing is disabled or not required, an attacker can modify and relay authentication messages without detection. This is a critical condition for SMB relay, as signing would prevent the relay by invalidating the tampered authentication.

The `portfwd` command in Meterpreter creates a TCP relay that listens on a specified port on the compromised host and forwards all incoming connections to a target IP and port. Here, it listens on TCP 8080 on the victim and relays to the HR server's TCP 3389, effectively pivoting into the internal network segment.

__EventFilter instances define the events that trigger a WMI event subscription. In a malicious persistence setup, the attacker creates an event filter to specify a trigger, such as a system uptime or user logon. Examining the root\subscription namespace for __EventFilter instances will reveal the filter name, query, and other details, which can be used to identify the malicious subscription and its trigger condition.

Java serialization streams begin with the magic bytes AC ED 00 05. Their presence in HTTP request bodies indicates that the application is accepting serialized Java objects from the client. When combined with other suspicious behavior, this is a strong indicator of an insecure deserialization attack attempt, as attackers must deliver a serialized payload to the vulnerable endpoint.

Changing `user_id` from 1001 to 1002 accesses another user's profile at the same privilege level, which is horizontal privilege escalation. The application fails to verify that the authenticated user owns the requested object, which is the definition of IDOR. This is the correct characterization because the attacker is not elevating to an admin role but accessing peer data.

The combination of multiple failed logins and immediate post-exploitation commands is a high-confidence indicator of account compromise. The attacker is mapping the environment to plan further movement. Detecting this progression allows the responder to isolate the compromised account before the adversary can escalate privileges or deploy additional malicious tools.

GraphQL allows clients to request nested fields, and without depth limiting, an attacker can craft a query with many levels of nesting. This can cause exponential resource consumption as the server resolves each level, leading to denial of service. This is known as a query depth attack.

The Win32_Process Create method is a standard technique used by attackers to execute commands on remote systems via WMI. It is favored because it does not require a persistent installation, allowing for stealthy lateral movement that is easily integrated into automated post-exploitation scripts and tools.

Full packet capture at the perimeter preserves both the timing of each connection and the payload bytes, allowing the handler to calculate beacon jitter and inspect command-and-control content. Filtering by the known destination IP keeps the capture volume manageable. Because no endpoint agent is installed, this satisfies the requirement without touching the host.

A TCP SYN flood is a denial-of-service attack where the attacker sends numerous SYN packets, often with spoofed source IPs, to exhaust the target's connection table. The lack of SYN-ACK responses is typical because the target is either overwhelmed or the spoofed IPs do not complete the handshake. This matches the scenario exactly.

String concatenation allows attackers to inject SQL syntax directly into the final command sent to the database. By using quotes and operators, an attacker can escape the data field and alter the query logic. This is the root cause of most SQL injection vulnerabilities in legacy and poorly written applications.

This occurs when an attacker convinces a service that has sufficient permissions to act on their behalf. Without checks like External IDs, the service might unknowingly perform actions, such as reading private data, because it trusts the requester. This is a major security concern in multi-tenant cloud environments.

Limiting each account to one failed attempt per lockout window ensures the account never reaches the lockout threshold. Tools like Spray or custom scripts can enforce this by tracking attempts and waiting the requisite time. This approach allows the tester to test one password per account per window, gradually building a list of valid credentials without locking accounts.

Analyzing parent-child relationships allows security teams to identify anomalies such as a web server process spawning cmd.exe or a utility like certutil.exe initiating an outbound connection. This behavioral pattern is a hallmark of post-exploitation activity, providing high-fidelity signals that distinguish administrative use cases from malicious abuse of trusted binaries.

The architecture of a GPU allows it to perform thousands of concurrent calculations. Because each hash attempt is independent of the others, this parallel architecture allows for immense throughput. This turns what would take years on a CPU into a task that takes hours or days on a GPU.

Memory regions marked as RWX are highly unusual in normal applications. Attackers use these permissions to write their malicious code into memory and then execute it immediately. Detecting these memory segments is a primary indicator of injected code or shellcode running within the address space of a legitimate process.

AI models trained on insufficient or biased data often fail to distinguish between malicious and legitimate system activity. This leads to the generation of false-positive signatures that flag critical OS files. Deploying such signatures in a production environment causes significant operational disruption, effectively creating a self-inflicted denial-of-service attack for the organization.

The -sn flag performs a ping scan (host discovery) only, without port scanning. Nmap sends ICMP echo, TCP SYN to port 443, TCP ACK to port 80, and an ARP request on local networks. Because it uses multiple probe types, it can detect liveness even when ICMP is filtered, making it ideal for a quick, low-noise check.

The application fails to validate the file type and allows a file with a double extension to be stored and executed. The attacker bypasses a naive check for `.jpg` by including `.php` before it. This is a classic Unrestricted File Upload vulnerability, leading to remote code execution. Incident handlers should treat this as a critical finding and review upload validation logic.

The `php://filter` wrapper with `convert.base64-encode` is a known technique to read PHP source code. Normally, including a PHP file would execute it, but by Base64-encoding the output, the attacker can view the raw source, which may contain sensitive logic or credentials. This is a direct objective of the attack.

Verification is mandatory. By analyzing the memory of the svchost instance and the network connection patterns, the responder confirms whether the process is indeed acting maliciously. This technical validation bridges the gap between an automated alert and actionable intelligence, allowing for a decisive and informed response to the identified threat.

Domain fronting places a benign SNI in the TLS handshake while the HTTP Host header points to the attacker's fronted domain on the same CDN. The mismatch between SNI and the actual destination, combined with non-browser beaconing, is a strong indicator. This technique abuses CDN routing to blend C2 with legitimate traffic.

This is the definition of credential stuffing. Because users often reuse passwords, attackers leverage large databases of leaked username/password pairs to gain unauthorized access to accounts on other services, assuming that the credentials will be valid in multiple locations due to human password reuse habits.

Prepared statements separate code and data completely at the database driver level. When parameters are bound correctly, any user-supplied string like a UNION query is treated strictly as literal literal data values, neutralizing injection attempts and protecting backend data assets permanently.

The /etc/ld.so.preload file specifies shared libraries to be loaded by the dynamic linker before any others for all executables. Attackers can place a malicious library there to intercept function calls, log keystrokes, or escalate privileges. This is a stealthy persistence mechanism because it affects all dynamically linked programs and is not obvious in process lists.

Modifying /root/.ssh/authorized_keys to add an attacker-controlled public key allows passwordless SSH access. The suspicious root login from an external IP at an unusual time, combined with the file modification, strongly indicates that the attacker added a key for persistence. This is a common technique to maintain access even if passwords are changed.

The Remote Desktop Services operational log records successful and failed RDP connections, including the source and target. Attackers commonly use RDP for lateral movement, so entries showing connections from unusual hosts or at odd times are strong indicators. This artifact directly evidences remote access between systems.

Repeated failed logins for an account, especially an administrator account, using NTLM indicate a brute-force or dictionary attack. The sub-status code 0xC000006A is the standard Windows error for an incorrect password provided during the authentication process.

If the server fetches the key from a location specified by the 'kid' header, an attacker can point it to a malicious server hosting a key they control, or to a local file. This allows the attacker to sign tokens with a key the server will trust, bypassing authentication.

Process injection is the act of inserting code into the address space of a separate, live process. This allows the attacker to execute their code with the permissions of the host process, effectively masking the malicious activity from security tools that scan files on the disk.

Large Language Models excel at parsing messy, inconsistent service banner strings and raw network scan outputs into neatly organized JSON inventories. This capability drastically reduces the manual analysis overhead typically required during the initial reconnaissance and asset discovery phases.

A unique salt ensures that two users with the same password have different hash outputs. This effectively neutralizes precomputed rainbow table attacks because the attacker would need to generate a new table for every unique salt value, which is computationally impossible for large user databases.