TeamA: Set1
M: What is this Logon Type code that we commonly encounter on our cases when checking Security Event Logs, especially related with SMB and RDP connections?
Logon Type 3 - Network Logon
G: From a lateral movement perspective, which of the following are the most interesting shares? (Choose all that applies)
a. Admin%, C%, and IPC%
b. $A, B$, and $LPC
c. Mount$, RPC$, and Sysvol$
d. Admin$, C$, and IPC$
d. Admin$, C$, and IPC$
K: Which of the following forensic tools can collect amcache.hve?
TMFK
TMIRT
CyLR
FTK Imager
TMIRT, CyLR and FTK Imager
F: What PowerShell command is used to give the remote system an encrypted interactive shell like SSH?
Enter-PSSession
J: While analyzing the amcache logs of Windows 10 machine. You are able to find a suspicious file. Based from this evidence can we already tell that the suspicious file executed on the machine and why?
NO, Execution time is removed on Windows 10 machines from Amcache.
F: What do we check for when examining a target system suspected of being the target of a PowerShell attack?
wsmprovhost.exe
K: In order to see Event ID 4688, you must enable Audit Process Creation auditing on Policy. What is the Policy Location to enable this?
Policy location: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Configuration > Detailed Tracking
Policy Name: Audit Process Creation
G: What is a threat hunter looking for when searching for the sequence of Windows Security Event Log event IDs 4624 and 4672 across the enterprise? (Choose all that applies)
a. Account Password Change
b. Logon with administrator-level privileges
c. Brute-force password guessing
d. New Account Creation
b. Logon with administrator-level privileges
K: What is the default date/time format when displaying timestamps in AmCacheParser?
yyyy-MM-dd HH:mm:ss
G: A system is suspected to have been compromised, and there are reports that it has crashed multiple times recently. Assuming that process tracking has not been enabled (default setting), which log pairing should be investigated for evidence of malware execution in the form of warning and error events?
System and Application
M: It is considered as one of the "strongest" lateral movement options and one of the "hardest" to investigate. Its most common command tool used for lateral movement is "process call create"
WMI - Windows Management Instrumentation
F: When the file ____ appears in a user's profile, RDP has likely been used on the system. Which file is it?
Default.rdp
J: It is the only windows process that can write Windows Security Event logs.
LSASS
The security log is only writable by the Local Security Authority Subsystem Service (LSASS) and there are no Windows API functions that can interact with events.
F: What specific registry key hive path can we look for when checking for remotely mapped shares?
NTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2.
K: You are currently analyzing a suspected source machine that connected on the AD server via RDP. What event logs you can check to validate this aside from Security Event Logs?
Microsoft-Windows-TerminalServices-RDPClient%4Operational.evtx
G: What method could provide SHA1 hashes of malware that ran on a Windows system, especially if the malware is poorly written?
a. PowerShell persistence auditing
b. WMI command-line auditing
c. Windows Error Reporting
d. Process tracking event logs
c. Windows Error Reporting
M: If you are planning a stealthy attack, you might want to skip using this. As this leaves a large amount of residue on the source and destination systems. Source systems have the standard application execution and “runas” explicit credential artifacts.
Scheduled Task
G: Although WMIC and PowerShell are commonly used across networks, what WMI command commonly used for lateral movement should analysts set alerts for and investigate?
process call create
J: A suspicious file was executed on the machine and used the compatibility wizard, the suspicious file is already shimmed for compatibility execution but upon checking the Appcompatcache hive, the suspicious file entry was missing. Why is the entry for the suspicious file missing on the Appcompatcache hive?
For Shimcache/Appcompatcache entry to be stored in the Registry, the machine still needs to be rebooted for the shimmed programs on the memory written in the registry hive
G: It seems like the LSASS process is failing on a Windows machine. Which event logs is severely affected by this?
Security Logs