CVA Operating System & Host-Based Vulnerabilities Flashcards

What does DLL injection involve in the context of Windows host-based attacks?

Answer: Forcing a running process to load a malicious dynamic link library into its address space

DLL injection forces a legitimate running process to load a malicious DLL, allowing the attacker to execute arbitrary code within the context of that trusted process.

Which Windows command-line utility displays all running processes and can be used for host-based triage?

Answer: tasklist

The 'tasklist' command displays all currently running processes on a Windows system, including their PID and memory usage, making it useful for host-based incident triage.

What is the purpose of Windows User Account Control (UAC)?

Answer: To require explicit elevation approval before allowing administrative actions

UAC prompts for confirmation or administrator credentials before allowing actions that require elevated privileges, limiting the impact of malware running in a standard user context.

Which post-exploitation technique involves hiding malicious code by executing it within the memory space of a legitimate process?

Answer: Process hollowing

Process hollowing replaces the code of a legitimate process in memory with malicious code, allowing the attacker to evade detection while running under a trusted process name.

What is the primary goal of File Integrity Monitoring (FIM) on a host?

Answer: Detecting unauthorized changes to critical system files and configurations

FIM tracks cryptographic hashes of critical files and alerts when unexpected modifications occur, helping detect malware, tampering, or unauthorized configuration changes.

What defines a zero-day vulnerability from a host security assessment perspective?

Answer: A previously unknown flaw with no available patch at the time of discovery or exploitation

A zero-day vulnerability is a security flaw unknown to the vendor or public, meaning no patch exists, giving defenders zero days to prepare before it can be exploited.

Which Windows built-in tool allows a vulnerability assessor to query and analyze Windows Event Logs for suspicious host activity?

Answer: Eventvwr.msc (Event Viewer)

Event Viewer (eventvwr.msc) provides access to Windows Event Logs including Security, System, and Application logs, which are critical sources for detecting suspicious host-based activity.