300-220 CBRTHD: Conducting Threat Hunting and Defending using Cisco Technologies for CybersecurityDemo

An analyst receives a report stating that the infection chain starts with a phishing email containing a malicious download link. When the victim downloads the malicious RAR file, the archive requires a specific password for extraction, revealing a fake PDF executable malware file and an image printing file. After the malware is decrypted and the fake PDF executable is run, the embedded LummaC2 or Rhadamanthys information stealer executes automatically, collects the victim’s credentials and data, and sends them to the C2 server.

Which conclusion should the analyst make about the threat actor?

A security analyst receives an alert that host A, with the IP address 192.168.5.39, has had a new browser extension installed. While investigating SIEM tool logs, the analyst finds that host A made continuous TCP connections to 1.25.241.8 over TCP port 80. The IP address 1.25.241.8 is categorized as a C2 server.

Which action should the analyst take to mitigate similar connections going forward?

Refer to the exhibit.

A company was recently breached and decided to strengthen its security posture going forward. A security assessment was commissioned specifically to test the weaknesses exploited during the breach. A security analyst reviews server logs to identify activity related to that security assessment.

Which entry indicates a delivery method associated with an authorized assessment?

A cybersecurity team discovers an increase in DNS amplification attacks. The team wants to prevent an attack and reviews the current configurations. The company has a load balancer to manage network traffic and a DMZ containing important assets. Source IP verification for DNS requests is configured on the servers.

Which additional action should the team take to mitigate similar attacks?

Refer to the exhibit.

A company's cybersecurity team detects an active attack against the web server hosting the company website. After analyzing web application firewall logs, the team finds several Base64-encoded HTTP requests. The team decodes the payloads and obtains the HTTP requests.

What did the attackers use to exploit the server?

A threat-hunting team is attempting to classify IoT malware families from anomalous activity patterns.

Which IoT malware-family classification method is being described?

A SOC team must prepare for a new phishing campaign that deceives users into clicking a malicious URL to download a file. When that file runs, it creates a Windows process that harvests user credentials. The team must configure the SIEM tool to generate an alert when a suspicious process is detected.

Which two rules must the team create in the SIEM tool?

Refer to the exhibit.

An analyst is evaluating artifacts and logs collected from a recent breach. In the logs, ATP established malware persistence by placing a path to the executable in a specific registry entry.

What distinguishes the ATP’s approach from using HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run instead?

What should be taken into account when employing machine learning for data analysis in a SOC?

Refer to the exhibit.

The SOC lead received the scope for a penetration test performed against the company's assets during the last 4 hours. The documentation does not appear to include an authorized IP address range, and the testing company may perform only a surface-level scan and database probing. While SOC analysts review server logs to determine whether recent activity indicates an authorized penetration test or a possible attack, the team discovers several suspicious entries.

Which two log entries indicate a potentially successful unauthorized attack?

A task has been assigned to strengthen defenses against APT actors in a mid-sized technology company. The adversaries conduct sophisticated, long-running attacks and employ varied tactics to infiltrate and remain within target networks. The company is concentrating on the tactics used by these adversaries to substantially improve its overall security posture. A review of the Pyramid of Pain model has been completed, emphasizing the different levels of threat indicators, from simple hash values to complex TTPs. The goal is to improve detection capabilities.

Which approach should be used to detect APT activity at the Tactics level of the Pyramid of Pain?

Refer to the exhibit.

A company has undergone several rounds of restructuring, and the former security team was let go. A new engineer joins and rediscovers all the tools left behind by the prior team. One tool is a Bash script for monitoring AWS accounts for threats.

What is the script's purpose?

What is one characteristic of a memory-resident attack?

A SOC team receives a cloud indicator-of-compromise alert through Cisco Secure Endpoint. The alert shows that Microsoft Word tried to launch PowerShell by executing a VBA macro on a user workstation. After further investigation, the team determines that the PowerShell launch was blocked because of the company’s group policies.

Which action must the team take next to mitigate the issue?

Refer to the exhibit.

After receiving an alert that a Windows host authenticated over the network to another host using a local administrator account, the security team examines the host. The team finds a process-creation event in that host's Sysmon logs.

Which action did the host carry out?

Refer to the exhibit.

The Security Operations team is reviewing firewall logs and decrypts this HTTP request from one of the finance team members’ endpoints.

Which Cyber Kill Chain stage does this evidence indicate?

Refer to the exhibit.

A security engineer observes that a Windows Batch script contains calls to suspicious APIs. How will the script affect the system when executed?

The SOC team receives an alert for a user sign-in from an unusual country. After reviewing the SIEM logs, the team confirms that the user never signed in from that country. The incident is reported to the IT administrator, who resets the user’s password.

Which threat-hunting phase was used initially?

Refer to the exhibit.

Code analysis is performed using the Semgrep tool. The tool reports that a security issue occurred while connecting to the database.

Which security vulnerability does the tool flag?

The SOC team receives threat intelligence about a new ransomware variant spreading across businesses. After validating existing suspicious-email use cases, the team creates a new use case using known indicators of compromise for that specific ransomware variant. The focus is on detecting the ransomware attack during its execution phase.

What should be monitored?

Refer to the exhibit.

The SOC team observes an increase in company traffic. After investigating the spike, it concludes that the increase results from ongoing scanning activity. Further analysis shows that an adversary used Nmap for OS fingerprinting.

Which type of indicator used by the adversary is highest on the Pyramid of Pain?

Refer to the exhibit.

A SOC team is investigating an endpoint after observing suspicious communications with a malicious IP address. During the investigation, the team reviews the host's running processes.

On which element should the team focus next to continue the investigation?

A security analyst suspects, based on the telemetry observed so far, that the latest attack on a company machine is memory-resident.

Which action must the analyst take next to confirm this suspicion?