4.9 Interpret Common Artifact Elements from an Event to Identify an Alert 200-201 Practice Questions (Page 8)

Questions 36–37

1. 36expert · hard

   An analyst is investigating an alert on a Windows host. The event log shows that a process named 'svchost.exe' created a file in the user's Startup folder and then made a call to WinExec. The file's SHA-256 hash is not in any threat intelligence feed. The analyst also sees a registry key created under HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to the same file. Which conclusion is best supported?

   • AThe process name svchost.exe proves the activity is legitimate.
   • BThe combination of a Startup folder file, a Run key, and WinExec indicates a persistence mechanism, even though the hash is unknown.
   • CThe unknown hash means the file is safe and the alert is a false positive.
   • DThe WinExec call is the only suspicious artifact, and the file and registry key are normal.
   Reveal Solution Discussion Select an answer first
2. 37application · easy

   An alert shows that a process named rundll32.exe loaded a DLL from a temporary directory and the DLL's SHA-256 hash matches a known banking trojan. Which artifact is the strongest indicator of compromise?

   • AThe DLL being loaded from a temporary directory
   • BThe DLL hash matching a known banking trojan
   • CThe combination of rundll32.exe and a DLL file
   • DThe process name rundll32.exe
   Reveal Solution Discussion Select an answer first