DFIR Module 11 Threat Hunting

Question 1

In Battlestar Galactica, CDR Adama greets Starbuck with the question, "What do you hear?," what is Starbuck’s response?

Accepted Answer

"Nothing but the rain"

Question 2

Indicators of Compromise (IoC) can include (choose all correct)?

Accepted Answer

Domains, IPs, Hashes, Client Processes

Question 3

Which of the following system processes should only occur once (choose all correct)?

Accepted Answer

Wininit.exe, Lsass.exe

Question 4

In Battlestar Galactica, what is used as a ceremonial affirmation at the end of a speech?

Accepted Answer

"So say we all"

Question 5

The Threat Hunting Cycle is continuous and never stops?

Accepted Answer

True

Question 6

Malware un-maps legitimate code of a target process from memory, then overwrites the memory w/malicious code is called?

Accepted Answer

Process Hollowing

Question 7

Threat Hunting involves?

Accepted Answer

Actions taken to discover breaches and the presenceof persistent threats

Question 8

Which of the following are 3rd party Threat Intelligence Platforms

Accepted Answer

Threat Connect, AlienVault OTX, Crowdstrike

Question 9

What are some common persistence techniques (choose all correct)?

Accepted Answer

Scheduled Tasks, AppCert DLL, Registry Keys, Service

Question 10

Zeek Network Security Monitor performs which of the following (choose all correct)?

Accepted Answer

Analyze network traffic for suspicious activity, Analyze captured network traffic and parse for suspicious activity

Question 11

Which of the following are places where Windows could store memory files (choose all correct)?

Accepted Answer

Pagefile, memory.dmp

Question 12

What are CVEs?

Accepted Answer

List of identifiers forpublicly known cybersecurity vulnerabilities

Question 13

Persistence techniques can ensure that a hacker retains access to a systemeven after it restarts?

Accepted Answer

True

Question 14

What are some examples of "suspicious behavior" indicating the presence of malware (choose all correct)?

Accepted Answer

Accessed file types, Persistence, Service Inspection

Questions 14