CREST Incident Response & Forensic Analysis 5

Question 1

An attacker used Mimikatz's 'sekurlsa::logonpasswords' module on a target host. What Windows feature, when enabled, significantly reduces the effectiveness of this technique?

Accepted Answer

Credential Guard using Virtualization-Based Security (VBS)

Answer

Windows Credential Guard uses VBS to isolate LSASS credentials in a protected hypervisor environment, preventing tools like Mimikatz from extracting plaintext passwords or hashes.

Question 2

In network forensics, which protocol field in a TCP handshake can be analyzed to fingerprint the operating system of a remote host without sending any active probes?

Accepted Answer

TCP Initial Sequence Number and Window Size (passive OS fingerprinting)

Answer

Passive OS fingerprinting analyzes TCP fields like initial window size, TTL, and ISN patterns in the SYN packet to identify the OS without sending additional traffic.

Question 3

A SOC analyst identifies that PowerShell scripts are being obfuscated using 'Invoke-Obfuscation'. Which Windows logging capability, when enabled, best reveals the deobfuscated script content?

Accepted Answer

PowerShell script block logging (Event ID 4104)

Answer

Script block logging (Event ID 4104) captures the actual deobfuscated PowerShell code as it is compiled and executed by the PowerShell engine, bypassing obfuscation at source.

Question 4

During IR, the team finds that an attacker exfiltrated data by encoding it in ICMP echo request payloads. What type of network control would most effectively prevent this technique?

Accepted Answer

Deep Packet Inspection (DPI) to detect anomalous ICMP payload sizes and content

Answer

DPI can inspect ICMP payload content and flag abnormally large or structured payloads that indicate ICMP tunneling/exfiltration, where blanket blocking may disrupt legitimate diagnostics.

Question 5

Which MITRE ATT&CK technique involves an adversary injecting code into a legitimate running process to evade process-based defenses and execute under a trusted context?

Accepted Answer

T1055 – Process Injection

Answer

T1055 (Process Injection) covers techniques like DLL injection, process hollowing, and reflective loading that execute attacker code within the memory space of a legitimate process.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST Incident Response & Forensic Analysis 5