CCNA Incident Detection And Response Questions

Amcache.hve records metadata about executables that have run on the system, including file paths and first execution times. It is particularly useful for tracking the initial appearance of a suspicious binary. Therefore, it provides direct evidence of the executable's path and creation time.

Windows Registry keys satisfy the fileless constraint because malicious scripts persist as encoded values rather than files on disk, evading signature-based scanning. Attackers store payloads in keys such as Run or user hives, then execute them via trusted binaries like PowerShell or mshta, leaving minimal forensic artefacts.

`-EncodedCommand` accepts a Base64-encoded UTF-16LE string, letting PowerShell execute code without quoting or special characters. It directly matches the stem's Base64 constraint, so its presence in a process command line is a strong indicator of obfuscated, encoded execution during investigation.

Access logs record every HTTP request with timestamp, source IP, URI and response code, so the POST that wrote the web shell appears alongside the attacker's earlier reconnaissance and upload attempts. This traces the upload's origin, which file-integrity or malware scanning alone cannot establish.

Event ID 4624 records successful logon events and includes Logon Type, Account Name, and Source Network Address fields. For this scenario, filtering 4624 for svc_backup with Logon Type 2 confirms an interactive logon and shows the originating workstation, directly validating whether the backup service account was misused outside its scheduled job context.

Isolation keeps the machine powered so RAM contents, running processes, network connections and encryption keys remain intact. Powering off destroys volatile memory, losing evidence such as injected code and active sessions. Isolation preserves this volatile evidence while blocking attacker access and further lateral movement.

Sysmon assigns a globally unique ProcessGuid to each process and records the ParentProcessGuid in Event ID 1 (Process Creation). These GUIDs are stable and unique, allowing the analyst to reliably reconstruct the process tree even if PIDs are reused. This is the recommended method to establish lineage and spot malicious parent-child relationships.

Domain controller Security logs capture authentication events such as 4624 and 4625, including the user account, logon type, and source workstation. Correlating these with file access events helps confirm whether the user authenticated to the file server and from where, strengthening the insider threat timeline.

A legitimate action flagged as malicious accurately defines a false positive: benign activity that a SIEM correlation rule incorrectly matches, triggering an unnecessary alert. This satisfies the scenario's requirement by distinguishing false positives from false negatives (missed threats) and true positives (genuine detections), so analysts can tune rules to reduce alert fatigue.

windows.malfind scans process memory for pages marked executable and writable that lack a corresponding file on disk, the classic signature of injected code. This directly satisfies the stem's requirement to detect code injection within a suspicious process, unlike plugins that only list processes or network sockets.

Scope measures how many systems, accounts or data sets the incident touches, directly driving severity because broader compromise means greater business impact. It is one of the three factors, alongside data sensitivity and operational impact, used to rate the incident.

A Domain Generation Algorithm (DGA) is used by malware to generate a large number of pseudo-random domain names that it can attempt to contact. The malware queries many domains, most of which are not registered, resulting in NXDOMAIN responses. The frequent, random subdomains under a single domain indicate a DGA attempting to locate its command-and-control server.

Beaconing produces regular callbacks, so measuring the intervals between connections and looking for low variance or a dominant periodicity exposes the pattern. Frequency analysis of connection time intervals isolates that rhythm within high-volume PCAP or NetFlow data.

Revoking active sessions and refresh tokens immediately invalidates the attacker's existing authenticated access, satisfying eradication by cutting off persistence. Password reset alone leaves stolen tokens valid until expiry, so session revocation is required to fully evict the intruder.

Security logs record account management events such as user account creation, including the actor, target account and timestamp, when the relevant audit policy is enabled. This gives the most granular detail on local account creation, unlike System, Application or Setup logs.

The Received header fields are added by each mail server as the message passes through. The bottom-most Received header (the first one added) typically contains the IP address of the originating server. This is the most reliable way to trace the true source of the email, though it can be forged if the sender controls the first server.

The lsof command with -i :4444 lists open files associated with the process listening on port 4444, including the executable path. It directly maps the port to the process and shows the binary. This helps identify malicious software. Therefore, lsof is the correct next step to associate the port with an executable.

FTK Imager creates a bit-stream forensic image of the SATA drive and generates MD5 or SHA-1 hashes of both source and image, verifying integrity. That hash comparison proves the copy is an exact, unaltered reproduction, which is the evidential requirement.

Domain controllers log authentication events, including successful and failed logons, in the Windows Security event log. By analyzing these logs, the analyst can identify which systems the service account authenticated to, especially if logon events include the source workstation name or IP address. This provides a comprehensive view of lateral movement across the domain, making it the most effective source.

Brute force attacks generate many failed authentications before one succeeds, exactly matching the failed-then-successful pattern the SIEM correlation rule detects. The technique relies on repeated credential guesses against a single account, so the volume of failures preceding the successful login is the defining signal Microsoft Entra ID sign-in logs would surface.

Periodic connections to an external IP with small data transfers are characteristic of malware beaconing to a command-and-control server. This allows the attacker to maintain persistence and issue commands. The consistent interval and low data volume are typical of such communication, distinguishing it from normal user activity.

PutBucketPolicy is the CloudTrail event name recorded when an S3 bucket policy is created or replaced. Searching for it isolates the unauthorised modification, since that API call is the exact action that alters a bucket policy.