Incident Response & Threat Detection Flashcards

An attacker uses 'net use \\target\IPC$ /u:domain\admin password' to authenticate to a remote host. Which MITRE ATT&CK technique does this represent?

Answer: T1021.002 – SMB/Windows Admin Shares

Using net use with IPC$ to authenticate over SMB maps directly to T1021.002 (Remote Services: SMB/Windows Admin Shares) under Lateral Movement.

Which tool is MOST appropriate for capturing a full memory image from a live Windows system during incident response?

Answer: WinPmem or Magnet RAM Capture

WinPmem and Magnet RAM Capture are acquisition tools that dump live physical memory to a file; Volatility analyzes the dump afterward.

A SOC analyst notices DNS queries to randomly generated domains like 'a3f8k2.evil.com' at regular intervals. What C2 technique does this indicate?

Answer: Domain generation algorithm (DGA)

Domain Generation Algorithms produce a large number of pseudo-random domain names, making it difficult to block C2 by blacklisting specific domains.

When performing root cause analysis after an incident, the '5 Whys' technique is used to:

Answer: Drill down through causal layers to identify the underlying systemic failure

The 5 Whys method iteratively asks 'why' to peel back symptom layers and identify the root cause enabling a permanent fix rather than a symptomatic patch.

An analyst finds an executable with a creation timestamp of 2020 but a modified timestamp of yesterday. This discrepancy MOST likely indicates:

Answer: Timestomping—deliberate manipulation of file metadata to evade detection

Timestomping is an anti-forensics technique where attackers alter MACE timestamps on malicious files to blend in with legitimate system files.

Which type of threat intelligence is MOST actionable for immediate defensive tuning of firewall and SIEM rules?

Answer: Operational intelligence about specific adversary infrastructure (IPs, domains, hashes)

Operational indicators like malicious IPs, domains, and file hashes can be directly ingested into security controls for immediate blocking and detection.

A playbook requires escalation when 'confirmed data exfiltration exceeds 1 GB.' What type of escalation trigger is this?

Answer: Severity threshold trigger

Escalating based on a measurable impact threshold—data volume in this case—is a severity threshold trigger that ensures proportional response.