Podcast
Questions and Answers
Which security systems does the attacker expect to encounter? (Choose three.)
Which security systems does the attacker expect to encounter? (Choose three.)
- Intrusion Prevention Systems (IPS) that analyze traffic in real time
- Network Access Control (NAC) solutions that restrict unauthorized devices (correct)
- Legacy antivirus systems that rely on signature-based detection (correct)
- AI-based threat detection and protection platform. (correct)
- Web Application Firewalls (WAF) that filter and monitor HTTP traffic
Which of the following are categories of Endpoint bypass techniques? (Choose three.)
Which of the following are categories of Endpoint bypass techniques? (Choose three.)
- Encrypting network traffic to prevent detection by firewalls
- Leveraging permitted tools to run malware (correct)
- Modifying the malware to evade signature analysis (correct)
- Encoding the malware to make it look legitimate (correct)
- Disabling security updates to weaken endpoint defenses
- Using multi-factor authentication to bypass security policies
What is the MITRE ATT&CK code for Defense Evasion?
What is the MITRE ATT&CK code for Defense Evasion?
- TA006
- TA003
- TA004
- TA005 (correct)
How can an attacker use OSINT in the context of endpoint security?
How can an attacker use OSINT in the context of endpoint security?
How can an attacker modify malware to bypass endpoint security?
How can an attacker modify malware to bypass endpoint security?
What does it imply if malicious code successfully evades endpoint security locally?
What does it imply if malicious code successfully evades endpoint security locally?
DefenderCheck is written by __________ and available at __________.
DefenderCheck is written by __________ and available at __________.
What does DefenderCheck do for the attacker?
What does DefenderCheck do for the attacker?
What is the primary function of DefenderCheck?
What is the primary function of DefenderCheck?
What happens when DefenderCheck detects a malicious file?
What happens when DefenderCheck detects a malicious file?
How does DefenderCheck narrow down the malicious part of the file?
How does DefenderCheck narrow down the malicious part of the file?
When DefenderCheck Splits the file into two pieces and scans each independently, what does it mean?
When DefenderCheck Splits the file into two pieces and scans each independently, what does it mean?
What happens to the chunk of the file that does not trigger an alert in DefenderCheck?
What happens to the chunk of the file that does not trigger an alert in DefenderCheck?
How does DefenderCheck approach scanning Mimikatz?
How does DefenderCheck approach scanning Mimikatz?
What is revealed by the hex dump of the Mimikatz executable?
What is revealed by the hex dump of the Mimikatz executable?
After identifying a chunk of the Mimikatz executable that no longer triggers an alert, what is the next step for the attacker?
After identifying a chunk of the Mimikatz executable that no longer triggers an alert, what is the next step for the attacker?
What is the goal when modifying the identified chunk of the Mimikatz executable?
What is the goal when modifying the identified chunk of the Mimikatz executable?
What will the attacker continue to do after modifying the executable in order to evade Windows Defender?
What will the attacker continue to do after modifying the executable in order to evade Windows Defender?
What does an attacker do when they create a program around their malicious code and use an intermediate wrapping library?
What does an attacker do when they create a program around their malicious code and use an intermediate wrapping library?
Which of the following programming languages are commonly used for code wrapping and obfuscation? Choose the right choice
Which of the following programming languages are commonly used for code wrapping and obfuscation? Choose the right choice
How do code wrapping and obfuscation affect signature-based analysis systems?
How do code wrapping and obfuscation affect signature-based analysis systems?
How do code wrapping and obfuscation affect behavioral anomaly analysis systems?
How do code wrapping and obfuscation affect behavioral anomaly analysis systems?
What does the IronPython library allow a developer to do?
What does the IronPython library allow a developer to do?
To run a python script developers use python interpreter T or F
To run a python script developers use python interpreter T or F
What does IronPython allow regarding the execution of Python code in a C# program?
What does IronPython allow regarding the execution of Python code in a C# program?
How does embedding an obfuscated Metasploit payload into a C# program help the attacker evade detection?
How does embedding an obfuscated Metasploit payload into a C# program help the attacker evade detection?
Why would an attacker use Microsoft Visual Studio to build a new executable after embedding the obfuscated payload?
Why would an attacker use Microsoft Visual Studio to build a new executable after embedding the obfuscated payload?
Leveraging permitted tools (Application Allow List) is know as the whitelist T or F
Leveraging permitted tools (Application Allow List) is know as the whitelist T or F
What is the purpose of an Application Allow List (Whitelist)?
What is the purpose of an Application Allow List (Whitelist)?
How does an Application Allow List identify approved applications?
How does an Application Allow List identify approved applications?
How do vendors update the detection capabilities of Application Allow Lists?
How do vendors update the detection capabilities of Application Allow Lists?
What is the main benefit of using an Application Allow List?
What is the main benefit of using an Application Allow List?
Which built-in feature is available on Windows 10 Enterprise Edition and recent versions of Windows Server?
Which built-in feature is available on Windows 10 Enterprise Edition and recent versions of Windows Server?
What is the typical first step when configuring AppLocker for whitelisting?
What is the typical first step when configuring AppLocker for whitelisting?
What does AppLocker on Windows do before enabling blocking mode?
What does AppLocker on Windows do before enabling blocking mode?
Which of the following are third-party tools available for endpoint protection?
Which of the following are third-party tools available for endpoint protection?
What is the purpose of Living Off the Land (LOL) in cyberattacks?
What is the purpose of Living Off the Land (LOL) in cyberattacks?
What do attackers do when they encounter an application allow list on a system?
What do attackers do when they encounter an application allow list on a system?
What does the application allow list do in relation to the LOL technique?
What does the application allow list do in relation to the LOL technique?
Why might an attacker prefer the Living Off the Land technique?
Why might an attacker prefer the Living Off the Land technique?
What does the LOLBAS project maintain?
What does the LOLBAS project maintain?
How do attackers bypass application allow lists beyond Living Off the Land (LOL) techniques?
How do attackers bypass application allow lists beyond Living Off the Land (LOL) techniques?
What service does AppLocker use to check execution of applications?
What service does AppLocker use to check execution of applications?
Why is it possible to bypass AppLocker despite its restrictions?
Why is it possible to bypass AppLocker despite its restrictions?
When does AppLocker check if an application is allowed to execute? (Choose 3)
When does AppLocker check if an application is allowed to execute? (Choose 3)
How do attackers often bypass application allow lists?
How do attackers often bypass application allow lists?
What are key features of an effective Endpoint Detection and Response (EDR) platform? (Choose 4)
What are key features of an effective Endpoint Detection and Response (EDR) platform? (Choose 4)
What is an effective defense against endpoint bypass?
What is an effective defense against endpoint bypass?
What is the purpose of threat hunting in an EDR system?
What is the purpose of threat hunting in an EDR system?
What security technique is used for Logging and monitoring?
What security technique is used for Logging and monitoring?
What might indicate suspicious activity in a UEBA system?
What might indicate suspicious activity in a UEBA system?
What might indicate suspicious activity in a UEBA system?
What might indicate suspicious activity in a UEBA system?
Threat hunting to identify the execution failures while attackers work on bypass T or F
Threat hunting to identify the execution failures while attackers work on bypass T or F
What do Advanced Evasion Techniques (AETs) typically aim to bypass?
What do Advanced Evasion Techniques (AETs) typically aim to bypass?
What do Advanced Evasion Techniques (AETs) typically aim to bypass in order to gain unauthorized access or deliver malicious payloads ?
What do Advanced Evasion Techniques (AETs) typically aim to bypass in order to gain unauthorized access or deliver malicious payloads ?
How do AETs make malicious traffic or payloads difficult to detect?
How do AETs make malicious traffic or payloads difficult to detect?
Which of the following techniques are commonly used in network attacks? (Choose 4)
Which of the following techniques are commonly used in network attacks? (Choose 4)
What is the main goal of the process hollowing technique?
What is the main goal of the process hollowing technique?
What is process hollowing in malware attacks?
What is process hollowing in malware attacks?
What is a real-life example of malware that uses the process hollowing technique?
What is a real-life example of malware that uses the process hollowing technique?
Which of the following tools are used to execute process hollowing?
Which of the following tools are used to execute process hollowing?
What is the main purpose of API unhooking?
What is the main purpose of API unhooking?
What are hooks in the context of Windows development?
What are hooks in the context of Windows development?
These hooks don’t point to the procedures associated with it. T or F
These hooks don’t point to the procedures associated with it. T or F
Which APT group used the malware tool UNAPIMON for API unhooking?
Which APT group used the malware tool UNAPIMON for API unhooking?
How does API unhooking help malware evade detection by EDR systems?
How does API unhooking help malware evade detection by EDR systems?
Which tool is an example of API unhooking in malware?
Which tool is an example of API unhooking in malware?
AMSI bypass (Antimalware Scan Interface Bypass) is an interface created by Microsoft, between a user and another user. T or F
AMSI bypass (Antimalware Scan Interface Bypass) is an interface created by Microsoft, between a user and another user. T or F
What are the main purposes of the Windows’ Antimalware Scan Interface (AMSI)? (Choose 3)
What are the main purposes of the Windows’ Antimalware Scan Interface (AMSI)? (Choose 3)
How do attackers typically bypass AMSI?
How do attackers typically bypass AMSI?
What is the real-life example of malware that utilized AMSI bypass?
What is the real-life example of malware that utilized AMSI bypass?
What kind of activities did the Agent Tesla malware perform without being detected by antivirus software?
What kind of activities did the Agent Tesla malware perform without being detected by antivirus software?
Which tool is an example of a method used to bypass AMSI?
Which tool is an example of a method used to bypass AMSI?
Agent Tesla disabled AMSI to execute its malicious activities avoid being intercepted by antivirus software. T or F
Agent Tesla disabled AMSI to execute its malicious activities avoid being intercepted by antivirus software. T or F
What is the purpose of Sysmon (System Monitor) in defending against process injection and API unhooking?
What is the purpose of Sysmon (System Monitor) in defending against process injection and API unhooking?
What can be used for defending against Process Injection and API Unhooking?
What can be used for defending against Process Injection and API Unhooking?
Which API calls should be specifically monitored to detect process injection and API unhooking activities? (Choose 3)
Which API calls should be specifically monitored to detect process injection and API unhooking activities? (Choose 3)
Which API calls should be specifically monitored to detect process injection and API unhooking activities?
Which API calls should be specifically monitored to detect process injection and API unhooking activities?
Which tool is an example of a defense mechanism for defending against process injection and API unhooking?
Which tool is an example of a defense mechanism for defending against process injection and API unhooking?
How can you enable Script Block Logging in PowerShell?
How can you enable Script Block Logging in PowerShell?
Which Windows Event IDs should be monitored for AMSI bypass attempts?
Which Windows Event IDs should be monitored for AMSI bypass attempts?
Which of the following tools can be used to detect AMSI bypass attempts? (Choose 2, same tool)
Which of the following tools can be used to detect AMSI bypass attempts? (Choose 2, same tool)
Which actions should be taken to enhance defense against AMSI bypass and malicious PowerShell scripts? (Choose 2)
Which actions should be taken to enhance defense against AMSI bypass and malicious PowerShell scripts? (Choose 2)
Which of the following built-in LOLBAS tools should be restricted to prevent misuse in attacks? (Choose 3)
Which of the following built-in LOLBAS tools should be restricted to prevent misuse in attacks? (Choose 3)
Why should we implement Applocker/SRP rules in a system?
Why should we implement Applocker/SRP rules in a system?
Which tool can be used for auditing LOLBAS (Living Off the Land Binary and Script) on a system?
Which tool can be used for auditing LOLBAS (Living Off the Land Binary and Script) on a system?
Which of the following actions should be taken to defend against the misuse of built-in LOLBAS tools? (Choose 2)
Which of the following actions should be taken to defend against the misuse of built-in LOLBAS tools? (Choose 2)
What is an important practice to Regularly update the allow list?
What is an important practice to Regularly update the allow list?
What is an effective method to detect suspicious use of allowed applications?
What is an effective method to detect suspicious use of allowed applications?
What is the main goal of reducing the attack surface on a system?
What is the main goal of reducing the attack surface on a system?
Which of the following actions can help in reducing the attack surface of a system?
Which of the following actions can help in reducing the attack surface of a system?
Flashcards
Capital of France (example flashcard)
Capital of France (example flashcard)
Paris
Study Notes
PAGE 116.
PAGE 118.
PAGE 119.
PAGE 132.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
