Endpoint Monitoring

Question 1

HIPS/HIDS

Answer 1

Host based IDS/IPS, monitors the computer

Question 2

EDR

Answer 2

software collects system data and logs for analysis for early detection

Question 3

UEBA

Answer 3

A system that can provide automated identification of suspicious activity
by user accounts and computer hosts. AI or machine learning

Question 4

Disassembler

Answer 4

a computer program that translates machine language into assembly
language.
Machine code (binary)
File Signature (file type)
Assembly code (instruction to implement program)

Question 5

De compiler

Answer 5

a software that translate a binary or low-level machine language code
into higher level code.
High-lvl code (human readable)
strings (signature detection, sequence of encoded characters, malware usually has InternetOpenUrl in URL its an attempt to download from web address)
Program Packer (compressed executable, avoids scanners sometimes)

Question 6

Dropper vs downloader

Answer 6

Malware to install or run payload vs code that retrieve additional tools after infection by dropper

Question 7

Shellcode

Answer 7

Any lightweight code designed to run an exploit on the target, which may
include any type of code format from scripting languages to binary code

Question 8

Behavioral Analysis

Answer 8

Threat hunting and security monitoring must use behavioral-based techniques to
identify infections

Question 9

Sysinternals

Answer 9

A suite of tools designed to assist with troubleshooting issues with
Windows, and many of the tools are suited to investigating security issues. Filters good from abnormal behavior

Question 10

System Idle (PID 0) and System (PID 4)

Answer 10

kernel-level binaries that is the parent of the first user-mode
process (Session Manager SubSystem – smss.exe)

Question 11

csrss.exe

Answer 11

Manages low-level Windows functions and it is normal to see
several of these running (as long as they are launched from
%SystemRoot%\System32 and have no parent)

Question 12

wininit.exe

Answer 12

Manages drivers and services and should only have a single
instance running as a process

Question 13

Services.exe

Answer 13

Hosts nonboot drivers and background services, this process
should only have one instance of services.exe running as a child of
wininit.exe, with other service processes showing a child of
services.exe or svchost.exe

Question 14

lsass.exe

Answer 14

authentication of services for system

Question 15

winlogon.exe

Answer 15

Manages access to the user desktop and should have only one
instance for each user session with the Desktop Window Manager
(dwm.exe) as a child process in modern versions of Windows

Question 16

userinit.exe

Answer 16

Sets up the shell (typically explorer.exe) and then quits, so you
should only see this process briefly after log-on

Question 17

explorer.exe

Answer 17

This is the typical user shell, launched with the user’s account
privileges rather than SYSTEM’s, and is likely to be the parent for
all processes started by the logged-on user

Question 18

EDR

Answer 18

Endpoint detection and response (EDR) requires tuning to reduce false positives
VirusTotal (inspects items over all data sources)
MAEC (signature detection same as STIX and TAXII sharing)
Yara (matches strings to data sources)

Question 19

Execution Control

Answer 19

The process of determining what additional software may be installed on
a client or server beyond its baseline
SRP (creates allow list file for different system locations)
AppLocker (improve config options of SRP)
WDAC (create a code integrity policy and can be used with AppLocker)