System & Endpoint Security Flashcards

Which Linux command displays currently active network connections and the processes that own them, useful for detecting backdoors?

Answer: ss -antp

The `ss -antp` command shows all TCP sockets with process information, and is the modern replacement for netstat on Linux systems.

An attacker uses LOLBins (Living-off-the-Land Binaries) to execute malicious code. Which Windows binary is most commonly abused for this?

Answer: certutil.exe

Certutil.exe is a trusted Windows binary frequently abused to download files and decode base64-encoded payloads, bypassing basic security controls.

Which type of rootkit operates at the kernel level by modifying the System Service Descriptor Table (SSDT) to hide malicious activity?

Answer: SSDT-hooking kernel rootkit

SSDT-hooking rootkits redirect system calls by patching kernel function pointers, allowing them to intercept and filter API results.

A defender wants to detect DLL hijacking attempts. Which monitoring approach is most effective?

Answer: Watch for DLL loads from non-standard paths (e.g., application directory vs System32)

DLL hijacking places a malicious DLL in a directory that is searched before the legitimate path; monitoring DLL load paths exposes this technique.

Which Windows security feature prevents untrusted code from executing by using cryptographic signatures to validate software before load?

Answer: Code Integrity / Windows Code Signing

Windows Code Integrity checks cryptographic signatures on executables and drivers, blocking unsigned or improperly signed code from running.

An analyst investigates a Windows host and finds scheduled tasks running under SYSTEM context with encoded PowerShell commands. What persistence technique is this?

Answer: Scheduled task abuse for persistence

Attackers create scheduled tasks under SYSTEM context with obfuscated commands to maintain persistence across reboots while blending with legitimate admin tasks.

Which tool is used to analyze Windows memory dumps offline to find injected code, hidden processes, and active network connections?

Answer: Volatility

Volatility is a framework for offline memory forensics that extracts processes, network connections, and artifacts from raw memory dumps.