GCIH: GIAC Certified Incident HandlerDemo

By GIAC · Question Mode

QuestionQ214

Detecting Evasive and Post-Exploitation Techniques

An analyst suspects an attacker used the built-in MSBuild tool to compile msfvenom code. What evidence could the analyst seek to validate this theory?

  • A Program execution from hidden directories
  • B Altered copies of MSBuild on the filesystem
  • C Encrypted TCP connections
  • D Downloading of a shellcode wrapper
Explanation

MSBuild can compile and execute inline C# or Visual Basic code from XML project files. A shellcode wrapper that embeds or loads an msfvenom payload is an expected supporting artifact when MSBuild is abused to compile and execute that payload. The legitimate built-in MSBuild executable does not need to be altered for this technique.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!