DFIR Basics
What does EDR stand for?
Endpoint Detection and Response
Switches route packets based on what?
MAC addresses
Which tool type may be used for analyzing a file to determine if it is malicious without executing it?
Hexadecimal Editor
What does the MFT acronym mean in digital forensics?
Master File Table
How is the structure of the ATT&CK framework organized?
How is the structure of the ATT&CK framework organized?
What does nmap -sT do?
Full TCP scan.
What is a file signature?
Specific bytes at the start of a file to define its type
What functionality does the -sS switch in Nmap provide?
SYN scan
Which of the following is an example of a code obfuscation technique?
String encoding like Base64
What are inodes for?
Store metadata like permissions and pointers
What does the D3FEND framework do?
Maps defenses to attack techniques
What timing option reduces detection probability?
-T0
What does "carving a file" mean?
Extracting file contents without a file system.
How many usable host addresses are there in a subnet with a mask of 255.255.255.248 or /29?
6
Why is Base64 encoding performed?
To transmit binary data over text-only channel
Why analyze registry hives in memory forensics?
They store configuration and user settings
How does the "capability" element in the Diamond Model function?
Denotes tools used to execute attacks
What Wireshark feature analyzes Layer 7 flow?
Follow TCP stream
What does SIGINT involve in DFIR?
Intercepted signals and communications.
What does tcp.flags.syn==1 && tcp.flags.ack==0 in Wireshark isolate for viewing?
Initial SYN packets.
What describes a Portable Executable file?
Common Windows format (4D5A/MZ)
What is notable about the NTFS file system that no other file system has?
Alternate Data Streams.
What is an APT in a packet capture?
Random DNS domain
What does "half-open connection" mean in the context of SYN floods?
Incomplete TCP handshake
What does the concept of persistence mean in DFIR?
Malware persists in memory across reboots
Routers route packets based on what?
IP addresses
How does packer-based obfuscation work in malware?
Compresses and encrypts code, unpacking at runtime.
What is winpmem?
Tool for capturing memory on Windows
What is the Finish phase in F3EAD?
Restores normal operations post-incident
What isolates HTTP traffic in Wireshark?
tcp port 80
What is the "Pyramid of Pain" in the context of Incident Response?
IoC-based model showing adversary disruption difficulty.
What does the -A switch in Nmap provide?
OS and version detection
What challenges does obfuscation create for dynamic analysis of malware?
Hides behavior during execution
What does the Volatility 3 command ‘vol -f dump.raw psscan’ do?
Finds hidden or terminated processes
What is the Exploit phase in F3EAD?
Using intelligence to meet objectives
What HTTP response code means permanent relocation?
301