6.7 Differentiate Testing, DevOps or General User Activity from Adversary Behavior CCFH Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A Falcon Hunter is reviewing an alert that shows a user account 'jsmith' executing 'regsvr32.exe' with a URL to an external domain. The user is a developer who frequently uses 'regsvr32.exe' to register DLLs for local development. The alert fires during business hours from the user's workstation. Which additional context would MOST help the hunter determine if this is benign developer activity or adversary behavior?

   • AChecking if the user has administrative privileges on the workstation.
   • BConfirming that the user is a developer and has used 'regsvr32.exe' before.
   • CVerifying that the workstation is patched and up to date.
   • DChecking if the external domain is known to be malicious or if it has a history of being used by the developer.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A Falcon Hunter is reviewing an alert that shows a user account 'svc_deploy' executing 'wmic.exe' to create a new process on a remote server. The service account is used by a deployment automation tool. The alert fires during a known deployment window. Which additional piece of evidence would MOST strongly indicate adversary behavior?

   • AThe remote server is a known application server that is part of the deployment target list.
   • BThe 'wmic.exe' process is running with the same privileges as the deployment tool.
   • CThe 'wmic.exe' process is executing from the system32 directory.
   • DThe remote process created is 'cmd.exe' with arguments that download and execute a script from a paste site.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of establishing a baseline of normal activity in a hunting environment?

   • ATo replace the need for threat intelligence feeds
   • BTo automatically block all non-standard user activity
   • CTo identify all known malware signatures in the environment
   • DTo provide a reference point for detecting deviations that may indicate malicious behavior
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A Falcon Hunter is reviewing telemetry and sees a series of PowerShell commands executing on a build server. The commands create local user accounts, modify registry keys for auto-start, and then attempt to connect to an external IP address. The build server is known to run CI/CD pipelines that deploy to production. Which finding should the hunter prioritize as potential adversary behavior?

   • AThe connection to an external IP address, because build servers should never have outbound internet access.
   • BThe PowerShell commands themselves, since PowerShell is rarely used in legitimate build processes.
   • CThe fact that the commands run on a build server, as adversaries rarely target build infrastructure.
   • DThe PowerShell commands creating local user accounts and modifying auto-start registry keys.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which activity is most appropriate to include when establishing a baseline for a DevOps team?

   • AScheduled deployment pipeline runs
   • BUnexpected privilege escalation attempts
   • CRansomware encryption events
   • DLateral movement to sensitive servers
   Reveal Solution Discussion Select an answer first