Incident Response & Threat Detection Flashcards

A defender reviews NetFlow data and notices a single internal host sending 2 GB of data to an external IP at 2 AM. Which detection category does this represent?

Answer: Anomaly-based / behavioral detection

Detecting the unusual volume and timing against a behavioral baseline—without a specific signature—is the definition of anomaly-based detection.

During incident triage, you identify that an attacker used Mimikatz to dump credentials. Which Windows event ID BEST helps detect this activity?

Answer: Event ID 4688 – Process Creation (with command-line logging)

Event ID 4688 with command-line auditing enabled records process creation details, allowing detection of Mimikatz execution by process name or arguments.

An incident responder needs to preserve the order of evidence collection on a live system. Which sequence follows the Order of Volatility correctly?

Answer: RAM → Running processes → Network state → Disk image

RFC 3227 establishes the order of volatility: RAM and running processes are most ephemeral, followed by network state, then disk which persists after power-off.

Which technique allows an attacker to execute malicious code within the address space of a legitimate process to evade endpoint detection?

Answer: Process injection (e.g., DLL injection, process hollowing)

Process injection techniques embed malicious code into legitimate processes, making detection harder because the activity appears to originate from a trusted executable.

A post-incident review finds that the IR team lacked authority to isolate systems without manager approval, delaying containment by 6 hours. What document should be updated to address this?

Answer: The Incident Response Policy granting pre-authorized containment authority

Pre-authorized containment authority in the IR policy allows responders to act immediately within defined parameters without waiting for ad-hoc managerial approval.

A threat hunter uses the hypothesis 'Attackers living off the land are using certutil.exe for payload delivery.' Which data source BEST validates this hypothesis?

Answer: Process execution logs showing certutil.exe with -urlcache or -decode flags

Certutil is a native Windows binary commonly abused to download or decode payloads; process execution logs capturing its command-line arguments directly confirm or refute the hypothesis.

What is the purpose of a 'purple team' exercise in the context of threat detection improvement?

Answer: To have red and blue teams collaborate so detections are tuned against real attack techniques

Purple teaming combines offensive (red) and defensive (blue) functions in a collaborative loop, immediately tuning detections based on what the red team demonstrates evades them.