System & Endpoint Security Flashcards

Which mitigation technique randomizes the memory addresses of the stack, heap, and libraries to make exploitation harder?

Answer: Address Space Layout Randomization (ASLR)

ASLR randomizes where code and data are loaded in memory, forcing attackers to brute-force or leak addresses rather than using hardcoded offsets.

A threat actor uses WMI permanent event subscriptions to execute a payload whenever a user logs in. Which category of persistence technique is this?

Answer: WMI event subscription persistence

WMI permanent event subscriptions link an event filter (e.g., logon) to a consumer (e.g., execute script), providing fileless, script-based persistence.

Which Linux file should an analyst inspect first when investigating unauthorized cron-based persistence added for a specific user?

Answer: /var/spool/cron/crontabs/

Per-user cron jobs are stored in /var/spool/cron/crontabs/ and are separate from system-wide crontab entries.

An endpoint security solution detects a process opening a handle to another process's memory with PROCESS_VM_READ rights. Which attack is most likely occurring?

Answer: Credential dumping via direct memory read

PROCESS_VM_READ access combined with ReadProcessMemory is the hallmark of credential dumping tools like Mimikatz reading LSASS memory.

Which Windows event log ID should analysts monitor to detect successful local account creation by attackers?

Answer: Event ID 4720

Windows Security Event ID 4720 is logged when a new user account is created, indicating possible backdoor account creation.

A defender enables application whitelisting to prevent unauthorized code execution. Which bypass technique uses trusted Windows scripts to run arbitrary code?

Answer: T1218 - Signed Script Proxy Execution (e.g., using mshta.exe or wscript.exe)

Attackers abuse trusted Windows script hosts like mshta.exe, wscript.exe, or cscript.exe to proxy execution of malicious scripts while bypassing whitelists.

Which Linux kernel security module provides mandatory access control (MAC) to confine processes to a predefined set of allowed actions?

Answer: SELinux (Security-Enhanced Linux)

SELinux enforces mandatory access control policies that restrict what resources and operations processes can access, even if running as root.