6.1 Analyze and Recognize Suspicious Overt Malicious Behaviors CCFH Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A Falcon Hunter is investigating a series of events on a workstation. The events show that a process named 'wscript.exe' ran a script that created a new file in the startup folder, and then the script deleted itself. Which attack pattern does this sequence most closely align with?

   • ADefense evasion
   • BCollection
   • CExecution
   • DPersistence
   Reveal Solution Discussion Select an answer first
2. 12expert · medium

   A Falcon Hunter is reviewing telemetry for a server that hosts a web application. The telemetry shows that a process named 'php.exe' is running with a command line that includes ' -r "eval(base64_decode($_POST['cmd']));" '. The process is making outbound connections to an IP address that is not in any threat intelligence feeds. Which behavior is the most overt sign of malicious activity?

   • AThe process is making outbound connections to an unknown IP address.
   • BThe process is running on a server.
   • CThe command line includes 'eval(base64_decode(...))'.
   • DThe process is named 'php.exe'.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   An analyst observes a process that is not recognized by any known malware signature, but it is performing unusual actions such as enumerating user accounts and attempting to access the SAM file. How should the analyst interpret this behavior?

   • AIt is benign because the process is not executing any code from a remote location
   • BIt is malicious only if the process is unsigned
   • CIt is suspicious and warrants further investigation because the actions align with credential access techniques
   • DIt is definitely benign because it does not match a known signature
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Falcon Hunter is triaging multiple alerts. Which alert should be prioritized for immediate investigation?

   • AA scheduled task was created that runs a script from a network share every hour.
   • BA user downloaded a file from a file-sharing site that was later deleted.
   • CA known ransomware hash was detected on a file server and the file was executed.
   • DA process attempted to modify the Windows Defender settings but failed due to insufficient privileges.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A Falcon Hunter is investigating a series of events on a domain controller. The events show that a user account was created, added to the Domain Admins group, and then used to log in to a server. Which attack pattern does this sequence most closely align with?

   • AAccount creation and privilege escalation followed by lateral movement
   • BPersistence
   • CPrivilege escalation
   • DLateral movement
   Reveal Solution Discussion Select an answer first