Which of the following best describes token manipulation as a privilege escalation technique?

Injecting code into a running service to execute with its privileges

Altering the access token of a process to impersonate a higher-privileged user

Replacing a legitimate executable with a malicious one

Exploiting a race condition in a file system driver

A security analyst is investigating a Windows workstation that repeatedly re-infects after the malware executable is deleted and the process killed. The analyst finds a scheduled task that runs the executable at logon, and a registry Run key pointing to the same path. After removing both, the machine stays clean for a few days but then the malware reappears after a user logs in. Which persistence mechanism most likely survived the analyst's cleanup?

A WMI event subscription that re-creates the scheduled task and Run key on a timer

A Windows service configured with a recovery action that restarts the executable

A DLL search-order hijack in a commonly used application

A user-mode rootkit that hides the malware's files and registry entries

GIAC Reverse Engineering Malware

Domain 3Objective 1

Common Malware Patterns GREM Practice Questions (Page 7)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 31–35

31foundation · easy
Which of the following is a lateral movement technique that uses stolen password hashes to authenticate to remote systems?
Select an answer first
32application · medium
A malware analyst is analyzing a sample that creates a Windows service named 'LegitSvc' that points to a binary in the user's AppData directory. The service is configured to start automatically. The analyst also notices that the service binary is packed. Which persistence mechanism is the sample using?
Select an answer first
33foundation · easy
Which of the following best describes token manipulation as a privilege escalation technique?
Select an answer first
34application · medium
A forensic analyst is examining a system where malware persists by creating a Windows service that runs at boot. The service binary is located in a world-writable directory. Which persistence mechanism is this?
Select an answer first
35application · medium
A security analyst is investigating a Windows workstation that repeatedly re-infects after the malware executable is deleted and the process killed. The analyst finds a scheduled task that runs the executable at logon, and a registry Run key pointing to the same path. After removing both, the machine stays clean for a few days but then the malware reappears after a user logs in. Which persistence mechanism most likely survived the analyst's cleanup?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Common Malware Patterns GREM Practice Questions (Page 7)

Questions 31–35

Which of the following is a lateral movement technique that uses stolen password hashes to authenticate to remote systems?

Which of the following best describes token manipulation as a privilege escalation technique?

A forensic analyst is examining a system where malware persists by creating a Windows service that runs at boot. The service binary is located in a world-writable directory. Which persistence mechanism is this?

Keep studying — Malware Patterns and Obfuscation