6.5 Decode and Understand PowerShell/CMD Activity CCFH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst finds a PowerShell command that includes `-Command` with the string `$s=New-Object System.IO.MemoryStream(,[Convert]::FromBase64String('H4sIAAAAAAA...'));IEX(New-Object System.IO.StreamReader($s)).ReadToEnd()`. What is the most likely purpose of this command?

   • ADecompress and execute a base64-encoded payload from memory
   • BCreate a new scheduled task for persistence
   • CDownload a file from the internet and save it to disk
   • DEnumerate running processes and their command lines
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A Falcon Hunter encounters a PowerShell command that uses `[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String(...))`. What is the primary purpose of this code?

   • ATo decode a base64-encoded string into readable text.
   • BTo execute the string as a PowerShell command.
   • CTo encrypt the command to prevent detection.
   • DTo compress the command string to reduce its size.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which PowerShell cmdlet is commonly used to download a file from a remote URL?

   • ASet-ExecutionPolicy
   • BGet-Content
   • CInvoke-WebRequest
   • DNew-Item
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security analyst is investigating a PowerShell process that ran with the command line `powershell.exe -ExecutionPolicy Bypass -File C:\Users\Public\script.ps1`. The host's effective execution policy is `Restricted`. The script runs successfully. Which statement best explains why the script executed?

   • AThe -ExecutionPolicy Bypass parameter overrides the Restricted policy for this process
   • BThe script was signed by a trusted publisher, so the policy is bypassed
   • CThe Restricted policy only applies to scripts run from the internet
   • DThe script was run from a network share, which is exempt from the policy
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A Falcon event shows a CMD process with the command line `cmd.exe /c "net user hacker P@ssw0rd! /add & net localgroup administrators hacker /add"`. What is the most likely goal of this activity?

   • AChange the password of an existing user account
   • BCreate a new local user account and add it to the administrators group
   • CDisable the built-in administrator account
   • DEnumerate all local users and groups on the system
   Reveal Solution Discussion Select an answer first