CREST Incident Response & Forensic Analysis 4

Question 1

Which Windows Registry hive is most useful for identifying recently accessed files, last-used applications, and typed URLs during a forensic investigation?

Accepted Answer

NTUSER.DAT (HKCU)

Answer

NTUSER.DAT (loaded as HKCU) contains per-user artifacts like RecentDocs, RunMRU, TypedURLs, and UserAssist that reveal user activity history.

Question 2

During IR, a responder discovers that an attacker scheduled a task using 'schtasks /create /sc onlogon /tn backdoor /tr malware.exe'. What persistence mechanism is being used?

Accepted Answer

Scheduled Task persistence triggered at logon

Answer

The /sc onlogon trigger means the scheduled task runs malware.exe every time any user logs on, providing persistent execution tied to logon events.

Question 3

A CREST examiner asks about the 'order of volatility' in forensic evidence collection. Which source must be collected FIRST?

Accepted Answer

CPU registers and cache

Answer

CPU registers and cache are the most volatile data — they are lost the moment processing changes — so they must be captured first in any live forensics scenario.

Question 4

An analyst uses 'strings' on a malware sample and finds references to 'cmd.exe /c whoami > C:\Windows\Temp\out.txt'. What tactic does this suggest?

Accepted Answer

Discovery and staging of reconnaissance output

Answer

Running whoami and redirecting output to a temp file indicates the attacker is performing host discovery/enumeration and staging results locally, consistent with the Discovery tactic in MITRE ATT&CK.

Question 5

When analyzing a Windows event log for Pass-the-Hash lateral movement, which Event ID combined with Logon Type 3 and NtLmSsp authentication package is most indicative?

Accepted Answer

Event ID 4624 with LogonType 3 and NTLM auth

Answer

Event ID 4624 (Successful Logon) with Logon Type 3 (Network) and the NTLM authentication package is the classic signature of Pass-the-Hash lateral movement.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST Incident Response & Forensic Analysis 4