Tools

Question 1

Reverse Shell

Answer 1

Target machine connects back to the attacker, granting an interactive shell. (Attacker is listening for connection)

Question 2

Bind Shell

Answer 2

The attacker connects to a listening service on the target machine, gaining an interactive shell. (Target is listening for connection)

Question 3

Splunk Forwarder

Answer 3

Lightweight agent installed on the endpoint intended to be monitored, and its main task is to collect the data and send it to the Splunk instance.

Question 4

Splunk Indexer

Answer 4

Plays the main role in processing the data it receives from forwarders. It takes the data, normalizes it into field-value pairs, determines the datatype of the data, and stores them as events.

Question 5

Incident Handling Life Cycle

Answer 5

1. Preparation
2. Detection and Analysis
3. Containment, Eradication, and Recovery
4. Post-Incident Activities (Lessons Learned)

Question 6

Cyber Kill Chain

Answer 6

Reconnaissance
Weaponization
Delivery
Exploitation
Installation
Command & Control
Actions on Objectives