GCIH: GIAC Certified Incident Handler Q237 — Practice Question

QuestionQ237

Detecting Evasive and Post-Exploitation Techniques

Which command indicates post-exploitation persistence?

A type NTDS.dit > FacilitiesSupplyList.docx:NTDS.dit
B meterpreter > execute -f "net localgroup administrators /add newadmin"
C find/ -type d -perm -0222 2>/dev/null
D net use\10.10.1.26\C$ L0ngP@55Wor) /u:administrator

Explanation

Adding an account to the local Administrators group establishes persistent privileged access on the compromised system.

Community Discussion

No comments yet. Be the first to start the discussion!