6.5 Decode and Understand PowerShell/CMD Activity CCFH Practice Questions (Page 5)

Questions 21–23

1. 21expert · hard

   A threat hunter is analyzing a CMD process that shows the command line `cmd.exe /c "for /f "tokens=*" %i in ('dir /b C:\Users\Public\*.bat') do @call %i"`. What is the most likely purpose of this command?

   • ACopy all batch files to a different directory
   • BList all batch files in the Public directory without executing them
   • CDelete all batch files in the Public directory
   • DExecute all batch files in the Public directory in sequence
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team is reviewing a PowerShell script that was executed via a scheduled task. The script is signed with a valid certificate, but the execution policy on the host is `AllSigned`. The script runs successfully. Which statement best explains why the script executed?

   • AThe scheduled task runs the script with a bypass flag
   • BThe execution policy does not apply to scheduled tasks
   • CThe script was run in a 32-bit PowerShell context that ignores the policy
   • DThe script is signed by a trusted publisher, which satisfies the AllSigned policy requirement
   Reveal Solution Discussion Select an answer first
3. 23application · medium

   A threat hunter is investigating a CMD process that shows the command line `cmd.exe /c "echo @echo off > C:\Users\Public\a.bat & echo whoami >> C:\Users\Public\a.bat & echo ipconfig >> C:\Users\Public\a.bat"`. What is the primary purpose of this command?

   • AExecute whoami and ipconfig immediately
   • BChange the working directory to the Public folder
   • CDelete the batch file after execution
   • DCreate a batch file that runs reconnaissance commands when executed
   Reveal Solution Discussion Select an answer first