7.5 Investigate a Process Tree CCFH Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   You are investigating a process tree where 'services.exe' is the parent of 'svchost.exe', which then spawned 'powershell.exe' with the argument '-enc ...'. To understand the full context, you decide to correlate with other events. Which event type would be most valuable to review?

   • AWindows Defender detection events
   • BUser login events
   • CFile creation events in the Windows directory
   • DNetwork connection events from the powershell.exe process
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Why is it important to correlate process tree data with related events during an investigation?

   • ATo determine the operating system version
   • BTo reduce the number of alerts generated by the system
   • CTo understand the full context of the process activity
   • DTo automatically remediate the threat
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   You are investigating a process tree where 'explorer.exe' is the parent of 'powershell.exe', which then spawned 'reg.exe' with the command line 'reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Updater /t REG_SZ /d "powershell.exe -nop -w hidden -enc ..." /f'. The host is a user workstation that has been showing signs of compromise. What is the most likely intent of this process tree?

   • AThe user is troubleshooting a startup issue
   • BThe user is adding a legitimate startup program
   • CAn attacker is establishing persistence by adding a registry run key that executes a malicious script at logon
   • DThe system is performing a routine maintenance task
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   You are analyzing a process tree where 'services.exe' is the parent of 'svchost.exe', which then spawned 'rundll32.exe' with the command line 'rundll32.exe C:\Windows\Temp\payload.dll,Start'. The host is a domain controller that has been flagged for unusual outbound connections. Which correlation would be most useful to determine if this is malicious?

   • ACorrelate with file creation events for payload.dll to see when it was created and by which process
   • BCheck the system's uptime to see if it recently rebooted
   • CCheck if the payload.dll file is signed by Microsoft
   • DVerify that the user 'SYSTEM' is logged on
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   In a process tree, you see that 'svchost.exe' is the parent of 'wscript.exe', which then spawned 'cmd.exe' with the command line 'cmd.exe /c ping 8.8.8.8 -t'. This is unusual because svchost.exe should not spawn wscript.exe. What does this process tree most likely indicate?

   • AAn attacker is using a service to execute a ping command for network reconnaissance
   • BThe system is running a scheduled task that uses wscript.exe
   • CA user accidentally ran a script from the command line
   • DA legitimate system process is running a network diagnostic
   Reveal Solution Discussion Select an answer first