6.1 Analyze and Recognize Suspicious Overt Malicious Behaviors CCFH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A Falcon Hunter is reviewing telemetry for a workstation. The telemetry shows that a process named 'rundll32.exe' executed a DLL file from the user's Temp folder, and then the process made a network connection to a domain that was recently registered. Which behavior is the most overt sign of malicious activity?

   • AThe DLL file is located in the user's Temp folder.
   • BThe process made a network connection to a recently registered domain.
   • CThe process is running with user privileges.
   • DThe process name 'rundll32.exe' is a legitimate Windows binary.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which telemetry event is most clearly an overt malicious behavior?

   • AA user accessing a corporate file share during business hours
   • BA process creating a file with a name matching a known malware signature
   • CA user connecting a USB drive to their workstation
   • DA process attempting to write to the Windows registry Run key
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   An analyst observes a sequence of events: an email attachment is opened, a macro runs, a PowerShell command downloads a payload, and the payload establishes a connection to an external IP. Which attack pattern does this sequence most closely align with?

   • AData exfiltration via DNS tunneling
   • BLateral movement via remote desktop protocol
   • CPrivilege escalation via token manipulation
   • DInitial access via phishing followed by command and control
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following behaviors, when observed together, most strongly correlates with the tactic of credential access?

   • AA process reading the SAM file and then attempting to log in to multiple systems using different usernames
   • BA process enumerating network shares and copying files to a remote location
   • CA process creating a new user account and adding it to the local administrators group
   • DA process downloading a file from a remote server and saving it to the startup folder
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is an example of an overt malicious behavior that would be clearly visible in endpoint telemetry?

   • AAn application updating itself automatically to a new version
   • BA scheduled task that runs a legitimate backup script every night
   • CA user logging in from a new device after a password reset
   • DA process named svchost.exe spawning a PowerShell command that downloads and executes a script from a remote IP address
   Reveal Solution Discussion Select an answer first