CCNA Incident Response and Cyber Investigation Questions

LotL techniques leverage legitimate tools that are signed and trusted by the OS. Antivirus signatures are designed to identify known malicious code; because the binaries themselves are benign, the AV ignores them. Detection must focus on the suspicious flags and command-line arguments, which AV does not typically inspect.

LiME is the industry-standard tool for Linux memory acquisition because it is specifically designed to handle the complexities of kernel memory. It minimizes system impact and can be used to stream the memory image over the network, ensuring that the evidence is captured with high fidelity and integrity.

Physical memory is the most volatile and contains running processes, network connections, and encryption keys. It is lost when the system is powered off. According to the order of volatility, RAM should be captured before any disk or less volatile data to preserve critical evidence that may not exist elsewhere.

Shadow copies provide a point-in-time snapshot of the system. Investigators often use them to compare the current state of the system against a known-clean state or to recover deleted malicious files and modified configuration files that an attacker attempted to hide by overwriting them on the live disk.

The Security log records security-related events, including successful and failed logon attempts (event IDs 4624 and 4625), account management, and privilege use. This is the primary log for auditing authentication activity. By examining it, the responder can identify which accounts were used and whether unauthorized access occurred, directly addressing the investigation goal.

MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It lets the responder map the executable's behavior to specific techniques, understand which threat groups use them, and prioritize detection and response actions. This directly answers the need to contextualize the suspicious binary against known TTPs.

DNS tunneling often involves encoding data in subdomains, resulting in long, random-looking labels. A high volume of queries to a single domain can indicate a covert channel. This pattern is characteristic of tools like iodine or dnscat2, which use DNS to transfer data. The randomness and length are key indicators.

A memory dump preserves the injected code, strings, and network artifacts, allowing the analyst to confirm process hollowing or injection. Examining loaded modules can reveal unsigned or suspicious DLLs. This is the least disruptive first step that gathers crucial evidence before any containment action.

The `netstat -anob` command displays all active network connections, listening ports, and the associated executable names (with the -b switch) and process IDs (with the -o switch). This provides an immediate snapshot of which processes are communicating over the network, directly addressing the need to capture active connections and running processes. It is a core volatile data collection step in incident response.

The authentication log records SSH session events, including the user account and the source and destination of connections. On most Linux distributions, sshd writes session open and close entries with the username and remote address, allowing the responder to correlate the outbound connection to a specific account. This directly answers which user initiated the session.

Centralized logs are essential because they prevent attackers from tampering with local event logs after gaining administrative access. By ensuring storage is immutable, the organization guarantees that forensic investigators have an untampered historical record of attacker activity, which is crucial for building a reliable timeline of the intrusion.

The Post-Incident Activity phase is designed specifically for conducting a formal review of the incident response process. By documenting successes and failures, the organization can implement systemic changes to security controls, training, and response procedures, effectively closing the loop on the incident and enhancing future resilience.

Capturing the state and the binary allows for thorough forensic analysis, such as identifying the malware's capabilities and its command-and-control infrastructure. This information is vital for scoping the incident, checking for other infected systems, and ensuring that the removal process is successful and leaves no residual malicious components behind.

Capturing volatile data is the priority because it is the most ephemeral evidence. By using memory acquisition tools, you can identify what the attacker is doing in real-time, such as open network sockets or injected threads, which are essential for understanding the scope of the current incident.

Memory contains the most perishable evidence, including running processes, network connections, and cryptographic material. Capturing memory first, followed by live network and process state, then the disk, follows the order of volatility. This preserves data that would be lost or altered if the system were imaged or shut down first.

APT actors use multiple persistence points to guarantee they can regain access if their primary tool is discovered. A thorough eradication process involves identifying and removing all these secondary backdoors and persistence mechanisms; otherwise, the attacker will simply leverage their secondary access to re-infect the system.

Web server logs are the primary source for identifying the attacker's source IP, the requests made, and the server's response codes. Error logs often reveal failed exploitation attempts or crashes caused by malicious payloads, providing critical context for how the attacker attempted to compromise the application layer.

Enumerating processes and their memory sections reveals executable regions that may not map to a file on disk. Tools such as Volatility can list process memory maps and identify sections with no backing file, which is characteristic of injected or fileless code. This directly surfaces a process whose code exists only in memory, answering the scenario's need.

IIS worker processes (w3wp.exe) should rarely spawn PowerShell. When they do, it is a high-confidence indicator of a web application compromise, such as a web shell executing commands. This detection is tailored to catch the specific behavior of attackers attempting to pivot from a web exploit to system-level execution.

PID 4 is the System process, which handles network traffic for the Server service, including SMB (TCP 445). This traffic is typical for a server responding to legitimate client requests. An analyst should differentiate between standard operating system network behavior and suspicious outbound connections to unauthorized external IP addresses.

Sysmon event ID 1 logs process creation and includes rich details such as the full command line, parent process ID, user account, and hashes. This directly answers the analyst's need to see the exact PowerShell command line and its parent process, enabling reconstruction of the attack chain. Sysmon is commonly used in incident response for this level of detail.

The Remote Desktop Services operational log records successful and failed RDP connections, including the source and target. Attackers commonly use RDP for lateral movement, so entries showing connections from unusual hosts or at odd times are strong indicators. This artifact directly evidences remote access between systems.

The authorized_keys file contains public keys that are allowed to log in without a password. Attackers often add their own public key to maintain SSH access. Checking this file for unauthorized keys is a critical step in identifying persistence on a compromised Linux system.