Threat Hunting and Analysis in an ICS Environment GRID Practice Questions (Page 11)

Questions 51–54

1. 51application · medium

   During a hunt on an engineering workstation used for PLC programming, an analyst finds a process running that is not in the approved software list. The process is named 'svch0st.exe' and is located in the user's temp directory. What is the most appropriate immediate action?

   • AReboot the workstation to clear the suspicious process.
   • BTerminate the process and delete the executable.
   • CCapture a memory dump and preserve the executable for analysis.
   • DAdd the process to an allowlist to prevent future alerts.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   During a hunt on an engineering workstation that manages a chemical process, the team finds a suspicious process running that is not in the approved software list. The process has a valid digital signature from a known vendor. What should the team do next?

   • AImmediately terminate the process and quarantine the workstation
   • BTreat it as a low priority because the signature is valid
   • CAdd the process to the approved software list to avoid future alerts
   • DCapture a memory image and analyze the process's behavior and network connections
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A security team at a natural gas pipeline company subscribes to an ICS-focused threat intelligence feed. The feed provides YARA rules and network signatures for a new family of malware targeting gas pipeline controllers. What is the most effective way to integrate this intelligence into their hunting program?

   • ADeploy the network signatures to the IDS and the YARA rules to endpoint scanning tools.
   • BShare the feed with other utilities but do not use it internally.
   • CStore the IOCs in a spreadsheet for future reference.
   • DRun the YARA rules against all files on engineering workstations and HMIs.
   Reveal Solution Discussion Select an answer first
5. 54expert · hard

   During a hunt at a refinery, an analyst discovers that an engineering workstation has a scheduled task that runs a PowerShell script every hour. The script is not documented and connects to an external IP address. The workstation is used for PLC programming and is on a segmented OT network. The analyst must decide whether to investigate further or report it as a false positive. What is the best course of action?

   • AReport it as a false positive because scheduled tasks are common on engineering workstations.
   • BIgnore it because the workstation is on a segmented network and cannot be reached from the internet.
   • CImmediately disable the scheduled task and block the external IP at the firewall.
   • DTreat it as a potential indicator of compromise and conduct a deep investigation, including memory analysis and script review.
   Reveal Solution Discussion Select an answer first