HDO Module 2

Which file extension are commonly used for shared libraries in Unix-like systems?

What is Run Level 0?

What is a baseline?

Will I study the NIST Threat Intelligence Lifecycle?

What is an example of a Behavioral indicator for an IoC?

Powershell is cross platform

What is the first process started by the kernel in Linux?

What is Run Level 6 in Linux environment?

What is Run Level 4 in Linux environment?

Detection, Analysis, and Mitigation is the lifecycle of IoCs

Get-LocalUser is a command for which tool?

What Time Zone are event logs stored in?

Which windows process is responsible for starting, stopping, and managing system services

What are the components of Active Directory?

A windows default process that enforces systems security and login processes

What are the two Asset Reporting Categories?

What is an example of a Host indicator for an IoC?

What are notable databases within Windows OS?

What are two important window artificats?

Firewalls, Routers, Proxys, Sensors, Physical security devices, and Anti-device tampering are Software

User Mode Rootkits operate at OS's application layer

Which are system enumeration tools?

A glossary that classifies vulnerabilities

How do we compare current state to baseline?

Where can IoCs be found/observed?

A target is a host identified for file collection to analyze.

What is Run Level 5 in Linux environment?

Will I study security event IDs?

Which command is used for nmap service version detection?

What is Run Level 3 in Linux environment?

What tool is provides broader range of capabilities, real time monitoring, threat detection, and response actions?

What are steps to create baseline of authorized application

What would be an IoC of data exfiltration?

How can you view windows logs?

What are key components for endpoint collection data for baselines?

What is Run Level 1 in Linux environment?

Which is a windows firewall command that can be configured via command line

What are three components of a registry?

What are comparison methods we can use?

What are two common IoC formats?

What is WMIC?

Which file extension are libaries on windows essential for running windows applications?

Static Analysis is analyzing malware by executing it in a controlled environment

Kernel mode rootkits operate at kernel level and have direct access to core functions of OS

Kraken is an In-Band Capability

Which artifact shows evidence that an executable was run on a system including first and last time of execution

Which of the following are tools for detecting host based intrusions?

Event ID 4720 tells us a user account was created and helps us identify rogue accounts

What type of baselining involves simple interviews to Mission Owners, users, and maintainers?

What is Ring 0 and Ring 3 in OS Protection Ring?

Running instances of programs/applications

What is an example of a Network indicator for an IoC?

What is an example of a linux module

A windows default process that manages windows graphical shell, including start menu, task bar, and file mgmt

What is nmap?

Which of the following are common TTPs?

Where is user account info stored in Linux systems?

What is Category 8 Event Category (Study event categories

In modern Linux distrubitons systemd has largely replaced SysV

What are core categories of IoCs?

Regular Expressions are foundational in cyber defense for their precision in pattern recognition across logs

What are files that create shortcut files when a user accesses files or applications

What is an IoC?

A technique used by attackers to run malicious code within address space of another process by injecting a DLL into it

Which of the following are baseline components?

What are pieces of code that can be loaded into the kernel to extend its functionality without rebooting the system?

I am allowed to nmap any system I want at any time without permission from Mission Partners

A windows default process that hosts windows services, allowing multiple services to run under a single process

What is Run Level 2 in Linux environment?

What is an example of a windows module

Task Critical Asset (TCA) are crticial assets which additional protections/active monitoring ensure mission objs are met