CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ89

VerifiedDetection Analysis

What action will the following obfuscated command perform?

cmd /c "set x=^n^e^t & set y=@er & set yy=z & set z=r & set r=remove & set f=Domain+ff & set ff=Admin & g=gumball@ & echo %x%%y:@=us%/%z:r=add%%ff%%g:@=r% | cmd"
Explanation

The intended net user invocation uses /add to create the Admin account locally; a domain operation would require /domain, and adding a user to a group would require a net group or net localgroup command. Microsoft documents /add as the option that adds a new user account, while /domain changes the target from the local computer to the domain.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!