Threat And Attack Types

An attacker is using a technique that involves 'living off the land' by utilizing legitimate system tools. Which data model is most effective to monitor these tools?

An analyst in Splunk Enterprise Security is investigating a suspected Kerberoasting attack. They notice multiple Event Code 4769 events where the ticket encryption type is 0x17 and the service name is not a known service account. Which Splunk search would best identify the affected user accounts and the targeted service principal names (SPNs)?

An analyst in Splunk Enterprise Security is investigating a potential DNS tunneling attack. They need to identify hosts that are sending an unusually high number of DNS queries to a single external domain within a short time window. Which search provides the most direct evidence of this behavior?

A Splunk ES analyst receives a notable event indicating that a user account has been locked out due to multiple failed login attempts. The analyst wants to determine if this is a brute force attack or a user error. Which data model should the analyst examine to review the authentication activity for that user?

An analyst wants to investigate a suspicious email attachment. Which Splunk ES notable event field is most effective for pivoting to the 'File' domain investigation dashboard?

A Splunk ES analyst notices a spike in `Endpoint` data model events where `process_name` is `powershell.exe` with a command line containing `-EncodedCommand` and `DownloadString`, spawning from `winword.exe` on several finance workstations. Which MITRE ATT&CK technique does this activity most directly map to?

An analyst is investigating a suspected DNS tunneling attack. They need to identify hosts that are generating an unusually high number of DNS queries with long, random-looking subdomains. Which Splunk search is most effective for this detection?

You are investigating a user who has triggered multiple high-risk alerts. Where in Splunk ES can you view the historical risk score progression for this specific user?

Which THREE of the following data sources are most valuable for detecting an insider threat?

An attacker uses a weaponized document that exploits a vulnerability to execute code without writing a file to disk. Which detection approach in Splunk ES is best suited to identify this fileless attack?

A user account is exhibiting signs of being compromised. Where can you find the user's recent login history in Splunk ES?

A SOC analyst receives an alert that a user's credentials were used from two geographically distant locations within five minutes. Which Splunk ES capability is designed to surface this type of anomaly by comparing current activity to a learned baseline?

You need to verify if an external IP address is a known malicious TOR exit node. Which Splunk ES feature should you use?

What is the primary function of the 'Incident Review' dashboard in Splunk ES?

An analyst is investigating a suspected DNS tunneling attack. Which Splunk ES data model and field should be used to identify hosts making an unusually high number of unique DNS queries with long subdomain strings?

You notice a system process attempting to connect to a suspicious external domain. Which CIM data model would contain this network connection information?

Which Splunk ES component would you use to define a new correlation rule based on a custom blacklist of domains?

An attacker is using a technique to hide in plain sight by renaming a common system process. Which data model is most suitable for comparing process names against known good paths?

A Splunk ES analyst receives a notable event for 'Excessive Failed Logins' on a Windows server. The analyst wants to determine if this is a brute-force attack or a misconfigured service account. Which field in the notable event would best help differentiate between these two scenarios?

Where do you go in Splunk ES to adjust the sensitivity (risk score) of a specific correlation search?

You are investigating a potential insider threat involving unauthorized data exfiltration. Which Splunk ES feature allows you to correlate multiple events occurring over a long duration to a single entity?

An analyst is investigating a potential ransomware outbreak. They observe a high volume of file encryption activity and want to identify the initial infection vector. Which TWO of the following Splunk ES data models would be most useful to correlate endpoint and network activity to trace the source? (Choose two.)

Which THREE of the following are common indicators that a host has been infected with malware?

A Splunk ES analyst receives a notable event for a possible phishing attack. The email contains a malicious link that, when clicked, downloads a payload. Which Splunk ES data model and field would best help the analyst quickly identify all users who clicked the link and the associated URLs?

You want to visualize the geographic origin of incoming connection attempts to identify potentially malicious traffic. Which dashboard is most appropriate?

An analyst is investigating a potential DLL sideloading attack on a Windows host. Which Splunk ES data model and field can be used to detect the loading of a malicious DLL from an unusual path?

Which TWO of the following are common types of social engineering?

An attacker is using PowerShell to obfuscate their activities. Which data model is most appropriate for searching for encoded PowerShell commands?

An analyst notices that several Windows workstations are repeatedly resolving domain names such as 'update.microsoft.com.security-check.net' and 'login.office365.com.auth-verify.org'. These lookups occur shortly before outbound HTTPS connections to the resolved IPs. Which type of attack technique is most consistent with this observation?

Which TWO of the following are ways to verify if a file hash is truly malicious within Splunk ES?

Which Splunk ES dashboard allows an analyst to see a summary of all active notable events currently requiring investigation?

Which TWO of the following are examples of reconnaissance techniques used by attackers?

Which TWO of the following are valid methods to mitigate an insider threat within Splunk ES?

An analyst notices a Splunk ES notable event indicating a possible DNS exfiltration. In the Network_Traffic data model, which field contains the domain name being queried by an internal host?

You are investigating a potential web-based attack. Which data model contains information regarding HTTP user-agents and request methods?

An analyst is reviewing Splunk Enterprise Security correlation search results and notices a notable event for a host named WEB-01 indicating a possible web shell. The analyst wants to quickly identify the exact command and URI used in the initial exploit. Which Splunk ES data model should the analyst examine to find the HTTP request method and URI associated with this event?

A security analyst receives an alert about a possible DNS tunneling attack. They need to examine DNS query logs to identify unusually long domain names that might indicate data exfiltration. Which Splunk ES data model should they use?

During an investigation, an analyst observes multiple `Endpoint` events where `lsass.exe` is accessed with `PROCESS_VM_READ` by a non-standard binary named `diagtrack.exe` running from `C:\Users\Public\`. Which Splunk ES data model and field combination best supports detecting this credential-dumping behavior?

A SOC analyst observes an unusual spike in failed login attempts followed by a successful login from a new IP address. Which Splunk Enterprise Security dashboard should the analyst check to confirm if this is a potential brute-force attack?

A malware infection is suspected on a host. You notice traffic on port 445. Which Splunk ES correlation search should be prioritized to investigate lateral movement?

An analyst observes a series of events where a process creates a child process with a command line that includes encoded PowerShell commands. The parent process is a Microsoft Office application. Which attack technique is most likely being used?

A Splunk ES analyst is investigating a potential Kerberoasting attack. The analyst wants to identify the key indicators of this activity. Which TWO of the following are primary indicators of a Kerberoasting attack that the analyst should look for in Splunk ES? (Choose two.)

A Splunk ES analyst is investigating a potential ransomware incident. Which TWO of the following are valid indicators of ransomware activity that should be prioritized for detection? (Choose two.)

An analyst is investigating a potential ransomware incident. They notice a high volume of file modifications with the .locky extension across multiple shared drives. Which Splunk ES data model is most appropriate to search for these file system changes?

A user reports that their files have been encrypted and a ransom note is displayed on their screen. Which type of malware is most likely responsible?

A Splunk ES analyst is investigating a series of notable events indicating possible pass-the-hash attacks. The events show successful authentications using NTLM from unusual source workstations to multiple servers. Which data model should the analyst query to correlate the authentication events and identify the compromised user accounts?

A Splunk ES analyst is investigating a series of notable events related to a possible DNS tunneling attack. The analyst wants to identify domains that are being queried with unusually high frequency or with long subdomain strings, which are common indicators of DNS tunneling. Which Splunk ES data model should the analyst use to efficiently search for these DNS query patterns?

During an investigation of a suspected malware outbreak, an analyst needs to identify all internal hosts that have communicated with a known malicious IP address. Which Splunk ES data model should be used to search for this network communication?

An attacker has gained access to a workstation and is attempting to move laterally within the network. Which TWO of the following techniques are commonly used for lateral movement that you should monitor in Splunk ES? (Choose two.)

An analyst is investigating a potential pass-the-hash attack in Splunk ES. Which TWO of the following are indicators that should be reviewed in Windows Security event logs? (Choose two.)

An analyst is reviewing a notable event for a potential malware infection on a Windows endpoint. The event includes a file hash. To determine if the file is known malicious, the analyst wants to check its reputation using Splunk ES's threat intelligence framework. Which action should the analyst take?

Which THREE of the following are benefits of using Risk-Based Alerting (RBA) in Splunk ES?

An analyst is investigating a potential pass-the-hash attack. They want to search for successful authentications that used NTLM authentication where the source workstation differs from the destination workstation. Which Splunk ES data model and field combination is most appropriate?

An attacker has cleared the Windows Security Event log to hide their tracks. Which data model can detect this action?

Which dashboard provides a summary of all assets categorized by their criticality within the organization?

An analyst is investigating a potential command-and-control (C2) beaconing incident. They observe periodic outbound connections from an internal host to an external IP address at regular intervals with small data transfers. Which two Splunk ES features or techniques would best help confirm and analyze this beaconing activity? (Choose two.)

An analyst is investigating a suspected credential dumping attack on a Windows host. They want to identify evidence of this activity in Splunk ES. Which TWO of the following are valid indicators of credential dumping that can be found in Splunk ES data? (Choose two.)

Which TWO of the following are key components of the Splunk ES Threat Intelligence framework?

An analyst identifies a command-and-control (C2) beaconing pattern. Which search command would be best used to identify the frequency of connections to a specific domain?

An analyst notices a Windows workstation repeatedly resolving long, random-looking subdomains under a single parent domain, followed by outbound DNS TXT queries. Which Splunk ES detection method is most appropriate to identify this as DNS tunneling?

Which TWO of the following are primary indicators of a phishing attack that you should look for in email logs?

You need to ensure that your Splunk ES environment is properly ingesting threat intelligence data. Where can you confirm that threat sources are active?

You are auditing logs and find that a user has modified an audit policy using 'auditpol.exe'. Which Splunk CIM data model should contain this information?