Which technique is commonly used to obfuscate PowerShell scripts to evade static signature-based detection?

Running the script in a sandbox

Using only comments to explain the script

Base64 encoding the entire script and executing with -EncodedCommand

Renaming the script file to a .txt extension

You need to automate the collection of system information from a compromised Linux host and exfiltrate it to your server. The data must be encrypted in transit. Which scripting approach is most appropriate?

Write a Bash script that gathers data, compresses it with tar, encrypts it with OpenSSL using a pre-shared key, and sends it via `curl` to your HTTPS server.

Write a Python script that reads system files and sends them as plaintext over HTTP.

Write a PowerShell script that uses `Invoke-WebRequest` to POST the data to a plain HTTP endpoint.

Use `scp` to copy the data to your server without encryption.

You need to automate the enumeration of user accounts on a Windows system and then check their password policies. You want to do this with a single script that runs on the target. Which approach is most appropriate?

Write a PowerShell script that uses `Get-LocalUser` to list users and `net accounts` to retrieve password policy, outputting both to a file.

Write a Bash script that uses `cat /etc/passwd` to list users.

Write a Python script that uses the `subprocess` module to call `net user` and parse the output.

Use a Python script that directly reads the SAM database.

Your Python script that automates a network service brute-force is failing intermittently because the service sometimes returns a transient error. You need to make the script more reliable. Which approach is most appropriate?

Implement retry logic with exponential backoff and a maximum retry count, logging each attempt.

Increase the timeout to 60 seconds for each request.

Use a single-threaded loop and ignore errors.

Rewrite the script in a compiled language like C++.

What is the primary purpose of obfuscating a malicious script?

To evade signature-based detection and static analysis

To reduce the script's file size

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 4Objective 2

Practical Scripting for Offensive Operations GXPN Practice Questions (Page 5)

Part of the Offensive Scripting and Cryptography domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 21–25

21foundation · easy
Which technique is commonly used to obfuscate PowerShell scripts to evade static signature-based detection?
Select an answer first
22application · medium
You need to automate the collection of system information from a compromised Linux host and exfiltrate it to your server. The data must be encrypted in transit. Which scripting approach is most appropriate?
Select an answer first
23application · medium
You need to automate the enumeration of user accounts on a Windows system and then check their password policies. You want to do this with a single script that runs on the target. Which approach is most appropriate?
Select an answer first
24expert · hard
Your Python script that automates a network service brute-force is failing intermittently because the service sometimes returns a transient error. You need to make the script more reliable. Which approach is most appropriate?
Select an answer first
25foundation · easy
What is the primary purpose of obfuscating a malicious script?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.