504.1

Question 1

PICERL

Answer 1

Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned

Question 2

Preparation

Answer 2

All the things an organization does before an incident. Including policy, procedure, introducing internal monitoring, security best practices, etc.

Question 3

Identification

Answer 3

When the incident is identified. Maybe through an IDS, customer report

Question 4

Containment

Answer 4

There are several ways to contain an incident. short and long term containment with evidence collection.

Question 5

Eradication

Answer 5

Undoing the damage the attackers did. Killing attacker processes, changing passwords, removing malicious data, launching fraud investigations etc

Question 6

Recovery

Answer 6

Steps taken to get business systems back up and running.

Question 7

Lessons Learned

Answer 7

When the final report is written, and the vulnerabilities the threat actors exploited are fixed.

Question 8

Cyber Chef

Answer 8

Tool for transforming encoded data to its natural state for analysis.

Question 9

wmic

Answer 9

used to search for processes. search for running processes that have base 64 encoded command line options, especially powershell.

Question 10

netstat

Answer 10

use to search for listening and active tcp and udp ports.

Question 11

ASEPs

Answer 11

registry and file locations that can be used to start software without a user taking a specific action to activate it.

Question 12

Process explorer

Answer 12

gives detailed information for running processes

Question 13

Autoruns

Answer 13

gives list of autostart extensibility points

Question 14

process monitor

Answer 14

Shows file system,registry, network, and process information in real time

Question 15

TCPView

Answer 15

maps listening and active tcp and udp activity to the associated applications

Question 16

Sysmon

Answer 16

collects detailed event information for system monitoring and analysis

Question 17

procdump

Answer 17

cli tool to capture memory for a running process for analysis

Question 18

tcpdump

Answer 18

command line tool to capture and display network traffic

Question 19

Volatility

Answer 19

python framework and tool for analyzing images of memory

Question 20

winpmem

Answer 20

tool used to capture RAM from a windows system, which can the be analyzed.

Question 21

RegShot

Answer 21

takes and compares a snapshot of the registry and the file system then provides a summary of changes between first and second snapshots after running malware

Question 22

Scoping

Answer 22

Determine where threat actors are for proper containment. Scan networks for known IOCs

Question 23

Velociraptor

Answer 23

Server software for data collection and analysis to help with scoping. Query’s file system, registry, runs remote commands, interrogate client artifacts

Question 24

Berkeley Packet Filters

Answer 24

Specialized language to filter network packets

Question 25

certutil

Answer 25

calculate the MD5 hash of a file on windows