System & Endpoint Security Flashcards

Which technique involves injecting malicious code into a legitimate suspended process after hollowing out its original memory content?

Answer: Process hollowing (RunPE)

Process hollowing unmaps a legitimate process's executable code and replaces it with malicious code, making the malware appear as a trusted process.

An analyst finds that Sysmon Event ID 3 is generating thousands of alerts per hour from a single endpoint. What does this indicate?

Answer: High-volume outbound network connections from a process

Sysmon Event ID 3 logs network connections; mass generation indicates high-volume outbound activity consistent with scanning, data exfiltration, or C2 beaconing.

Which Windows feature can prevent exploit code from executing payload in data memory regions by marking them as non-executable?

Answer: Data Execution Prevention (DEP/NX bit)

DEP uses the CPU's NX (No-Execute) bit to mark memory regions like the stack and heap as non-executable, stopping shellcode injected into data areas.

A security team discovers an attacker modified /etc/passwd to add a UID 0 user. What is the significance of UID 0?

Answer: The account has full root privileges regardless of username

On Linux/Unix systems, UID 0 is the root user identifier; any account with UID 0 has unrestricted system access regardless of the account name.

Which EDR telemetry source provides the richest context for detecting fileless malware that executes entirely in PowerShell memory?

Answer: Script block logging and PowerShell module logging (Event ID 4104)

PowerShell Script Block Logging (Event ID 4104) captures the full deobfuscated content of executed scripts, exposing fileless attacks that never touch disk.

An attacker achieves code execution via a buffer overflow but DEP is enabled. Which follow-on technique allows them to bypass DEP using existing executable code?

Answer: Return-Oriented Programming (ROP)

ROP chains together small executable code snippets (gadgets) already present in memory to perform arbitrary operations without injecting new shellcode.

When hardening a Linux endpoint, which configuration change most directly reduces the attack surface by preventing SUID binaries from being executed on a mounted filesystem?

Answer: Mounting the filesystem with the nosuid option

The nosuid mount option prevents SUID/SGID bits from taking effect on that filesystem, stopping privilege escalation via vulnerable SUID binaries.