Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

DFIR > Chapter 7 Memory analysis > Flashcards

Chapter 7 Memory analysis Flashcards

1
Q

What memory format captures are a common format for memory dumps. These files
can be created by various live memory acquisition tools (DumpIt,
WinPMEM, Redline, and others).

A

RAW

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

In Memory Acquisiton: What is generated when a system crashes or when a user tells the OS to produce a crash.

A

Crash Dump

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

In Memory Acquisition: In windows systems, particularly laptops, store this file in hiberfil.sys on the root of the OS partition.

A

Hibernation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

In Memory Acquisition: What has become the standard for analyzing memory dumps:

A

Expert Witness Disk Image Format (EWF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

This is the format used by WinPMEM, a component of Rekall, but can
also be used with Volatility. It is an open standard that was designed
around the ZIP file format. It can combine multiple, related streams of
data from memory, files, and disk simultaneously. It handles memory gaps
and unreadable areas of memory and has metadata support.

A

AFF4: Advanced Forensic Framework Disk Image, AFF Version 4.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are two memory analysis frameworks often used by
memory forensics investigators. These frameworks allow the investigator to
use a ready-made module that simplifies memory image analysis by
interpreting the memory image structure and extracting useful data.

A

ReKall and Volatility

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the best-known memory analysis tool that supports digital investigation on Windows, Linux and Mac Memory images?

A

Volatility

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a framework developed by Google and an alternative to Volatility.?

A

Rekall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a general Framework that organizes a memory-based investigation and helps the investigatory find the first lead or sign of malware in the memory image.

A

The Six-Step Investigation Process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the steps of the Six-Step Investigation Process?

A
  1. Process, 2. DLL and Handles, 3. Network 4. Code Injection 5. RootKits 6. Dump
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What Step investigates a rogue process?

A

Step 1 Processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What step checks DLL (Dynamic-Link Library) used by various executables?

A

Step 2 DLL and Handles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What step in the six-step investigation process Checks Network Activity and artifacts?

A

Step 3 Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What step in the six-step investigation process Checks for malware traces in memory?

A

Step 4 Code injection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What step in the six-step investigation process Checks for signs of RootKits?

A

Step 5 RootKits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What step in the six-step investigation process Dump Suspicious processes for in-depth analysis?

A

Step 6 Dump The last step in the process, the dump, extracts files, processes, and other
objects from the memory image for further investigation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is crucial in Determining the right profile to use to correctly analyze a memory image?

A

Memory identification and the verification of image integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What network artifacts on a memory image can be helpful to find suspicious network connections?

A

Ports, Destination IP, Origin Process, Socket Information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What scans for identifiable TCP Connections in older Versions of Windows

A

ConnScan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What Scans for all Open Sockets?

A

Sockets
(A socket is one endpoint of a two-way communication link between two programs running on the network. A socket is bound to a port number so that the TCP layer can identify the application that data is destined to be sent to.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What can be used to scan for connections and sockets in newer Windows Versions?

A

Netscan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What Volatility plugin displays local open port for any protocol, including TCP and UDP?

A

Sockets Plugin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What Volatility Plugin utilities are complementary and should be used together when conducting a network analysis?

A

ConnScan and Sockets.

Because not all ports detected by ConnScan will be displayed by Sockets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Because some artifacts, such as URL, Function calls, and files names, can be loaded as plain text in memory, then can be extacted by applications such as?

A

Strings and Bulk Extractor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is network-related information not identified in Memory?

A

URL’s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

For Memory Interaction, What framework provides two ways to interact with a memory image with plugins and Volshell.

A

The Volatility framework.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are two ways the Volatility Framework provides to interact with a memory image?

A

Plugins and Volshell

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What Volatility utility is the most common method of analyzing a memory image, which includes a set of ready-to-use plugins and commands?

A

Plugins

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which Volatility utility is an advanced debug shell that interacts with memory.

A

Volshell

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is the most import objects in memory images from an investigator’s perspective, as they provide a wealth of information about files that were executed on the system in a given timeframe.

A

Processes and process analysis is the first step in an investigation of malicious activity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is one of the most common attack techniques?

A

Code Injection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What Volatility plugin detects possible code injections by finding a memory section marked as executable that is not backed up with a file on disk?

A

MalFind

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is an executable loaded in memory that can be extracted and inspected?

A

A Process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What scans for an command line history buffer?

A

Cmdscan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What scans for available console information, Not only does it print the commands an attacker typed, but it collects the entire screen buffer, including both input and output?

A

Consoles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is intelligence gathering that usually starts with public sources called?

A

Open-Source Intelligence (OSINT)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are the step of Advanced Persistant Threat(APT) Flow?

A
  1. OSINT (Recon), 2. External Takeover, 3. Privilege Escalation, 4. Lateral Movement Internal Takeover 5. Hiding Mechanism and Information Theft
38
Q

What is the term refers to any action taken to delay a computer investigation?

A

Anti-Forensics

39
Q 
What  involves hiding harmful code by embedding it in commonly used files or data. Bits of data in regular 
computer files (such as image files, text files, and sound files) are replaced with bits of malicious coded information?
A

Steganography

40
Q

What is called when a malicious party impersonates another device or user on a network to launch attacks against network hosts, steal data, spread malware, or bypass access controls?

A

Spoofing

41
Q

What is considered an obfuscation technique that is a means of distributing an executable in a “compressed” state?

A

Packing

42
Q

What is a tool that modifies the formatting of code by data so it will be harder to detect the file’s header and content.?

A

A Packer tool

43
Q

SOC ROLES:

A junior staff member who receives alerts and determines if they should be escalated to incidents?

A

Tier 1 Analyst

44
Q

SOC ROLES:

A staff member that is notified about incidents discovered by Tier 1. Is qualified to perform basic acts of mitigation, such as disconnecting the infected machine from the network.

A

Tier 2 Analyst:

45
Q

SOC ROLES:

A highly-experienced staff member or consultant with enough IT and Cybersecurity experience and knowledge to conduct DFIR activities and lead other personnel in the containment and eradication of malicious elements.

A

Tier 3 Analyst

46
Q

SOC Roles:

Manages the daily operation of the center, and reports to the senior security leader (CISO).

A

SOC Manager

47
Q

SOC ROLES:

Responsible for the overall security program, which ranges from cyber risk management to vulnerability management, to any other security-related function associated with incident response.

A

Chief Information Security Officer (CISO)

48
Q

Additional Roles in Case of a Breach:

Plays an important role in ensuring that organizational risks are adequately addressed.

A

Chief Executive Officer (CEO)

49
Q

Additional Roles in Case of a Breach

During high profile breaches these personnel offer the proper messaging for the media.

A

Public Relations

50
Q

Additional Roles in Case of a Breach:

They manage routers, switches and other network infrastructure, may also be engaged to gather information or assist DFIR analysts in the gathering of forensic evidence.

A

Network Team

51
Q

Additional Roles in Case of a Breach:

This team may also be able to provide insight if there are anomalies in the amount and type of traffic traversing the organization’s networks.

A

Network Operations Center (NOC)

52
Q

Additional Roles in Case of a Breach:

They are often the first to receive signs of trouble from employees, and may be able to provide additional support to help record the frequency and scope of the incident.

A

Help Desk

53
Q

After team members are defined, it is important to monitor the tasks of each team and the roles responsible for their completion. What is used to identify tasks, teams, and roles?

A

RACI Chart (Responsible, Accountable, Consulted and Informed)

54
Q

What is a non-regulatory governmental agency, associated with the U.S. Department of Commerce, which focus is to develop technology, metrics, and standards?

A

NIST (National Institute of Standards and Technology)

55
Q

What is a private U.S. for-profit Company that offers research and education in the field of information security and Derives its methodologies from NIST standards?

A

SANS Institute

56
Q

What are the phases of incident response methodologies established by SANS institute?

A

Phase 1. Preparation, Phase 2. Identification, Phase 3. Containment, Phase 4. Eradication, Phase 5. Recovery, Phase 6. Lessons Learned.

57
Q

SANS Incident Response Methodology:

Which phase of SANS Incident Response is a plan developed on how to handle a cyber attack? Including investing in an incident logging system so members can log what actions were taken during an incident in real-time, specifics on backups and replications of data established, and security controls are configured to filter or blacklist know indicator of compromise (IOC).

A

Preparation Phase

58
Q

SANS Incident Response Methodology:

Which phase of SANS Incident Response recognizes the network has been comprised by malware or cyber attack and declares an incident to execute incident response plan?

A

Identification

59
Q

SANS Incident Response Methodology:

Which phase of SANS Incident Response does the IR Team attempt to contain the incident and reduce any damage resulting from the attack. This includes isolating infected workstations and segmenting network traffic from infected workstations to reduce the impact on the organization

A

Containment

60
Q

SANS Incident Response Methodology:

Which phase of SANS Incident Response is to eliminate the infection and executing the DR plan by restoring affected systems?

A

Eradication Phase (The team also begins focusing on where the attack originated from, to remediate any vulnerabilities that enable the incident to occur.

61
Q

SANS Incident Response Methodology:

Which phase of SANS Incident Response are Post-incident activities to analyze the attack, review logged information, and produce a report with a timeline of the incident?

A

Lessons Learned Phase

62
Q

What is a set tools DFIR analysts put together in preparation for an incident.

A

Jump Kit

63
Q

What refers to the strategy of restoring normal business operation after a disaster occurs including earthquakes, fires, floods, cyberattacks, and others?

A

Disaster Recovery Plan

64
Q

A backup site that is up and running continuously, and ready for immediate switchover.?

A

Hot Site

65
Q

A site that hosts servers and other resources for backup purposes, but is not as ready for a switchover as a hot site.

A

warm site

66
Q

A low-cost site that does not always have the necessary equipment to enable resumption of normal operation?

A

Cold Site

67
Q

Refer to a set of activities meant to ensure that organizational leaders are informed about risks, and are aware of the necessity to comply with regulations, policies, procedures, and
standards.

A

Governance, risk, and Compliance (GRC)

68
Q

Official top-level management directives that must be complied with by all people and systems within the scope of the policy.

A

Policies

69
Q

Documents derived from policies but are more specific about high-level requirements that must be followed for a process or system to operate.

A

Standard

70
Q

Documents derived from policies and standards that detail mandatory step-by-step directions for personnel and systems?

A

procedures

71
Q

Points that suggest how to follow mandatory policies, standards, and procedures, and help clarify what to do in specific circumstances?

A

Guidelines

72
Q

What is the European Union privacy law that places strong restrictions on the protection and use of personal data?

A

Global Data protection Regulation (EU) 2016/679

73
Q

What is Named after two USA Senators who sponsored the passage of the law, with the purpose of protecting investors and the public against financial fraud?

A

Sarbanes-Oxley (SOX)

74
Q

What agencies issue laws to protect private and sensitive health-related data?

A

Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health Act (HITECH)

75
Q

In a organization who usually establishes response policy, budget, and staffing

A

Management

76
Q

In a organization who/what usually ensures security controls and policy enforcement?

A

Information Assurance

77
Q

In a organization who usually are Information Technology Experts.

A

IT Support

78
Q

In a organization who usually handles insider threat situations, such as employees who violate business policies.

A

Human Resources

79
Q

In a organization who usually works closely and in parallel with IRT

A

Business Continuity Plan (BCP)/(DR) Disaster Recovery

80
Q

Conducts organization-wide drills regarding facilities?

A

Physical Security

81
Q

When handling incidents what do cyber security analyst use to guide them through the process of determining the validity of a security-related alert.

A

A Playbook (SOC playbook)

82
Q

What is used as an efficient method to handle incidents and ensure that a SOC team focuses on the most relevant event, within the shortest periods of time?

A

SOC Playbooks

83
Q

What is a solution or tool that enables organizations to collect data about security threats from multiple sources and respond to events with minimal human interaction?

A

Security Orchestration, Automation, and Response (SOAR)

84
Q

What systems include automated playbooks that collect alert data, ingest it, and respond based on the alert type and other collected criteria?

A

Security Orchestration, Automation and Response (SOAR)

85
Q

How Long should logs be retained to build a baseline of normal behavior, and enable historical activity analysis?

A

Logs should be maintained for three months to build a baseline.

86
Q

Containment Strategies:

When you Block or allow a specific object (IP,Domain,etc.)

A

Block List/Allow List Filtering

87
Q

Containment Strategies:

When you Isolate infected networks from clean machines

A

Segmentation

88
Q

Containment Strategies:

What uses patterns of known indicators related to past attacks, to prevent attack propagation?

A

IOC (Indicators of Compromise)

89
Q

Containment Strategies:

DDoS traffic from a malicious network should be dropped and prevented from reaching it destination?

A

Black Holing Shunt

90
Q

Containment Strategies:

Email filter controls should be updated with signatures/IoCs of phishing emails.

A

Email Filtering

91
Q

Containment Strategies:

Disconnect an infected system from the network?

A

Host Isolation

DFIR (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions