See Dee See

Which statement concerning "PsExec.exe -s -i cmd.exe" is true ?

• PsExec.exe will spawn an Administrator cmd.exe

• PsExec will spawn an Administrator cmd.exe via the PsExeSvc.exe process running as a service

• PsExec will spawn a SYSTEM cmd.exe via the PsExeSvc.exe process running as a service

• PsExec.exe will spawn a SYSTEM cmd.exe

Which MITRE ATT&CK technique best suits the following powershell cmdline:

"Add-Type -AssemblyName System.IdentityModel New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList 'MSSQLSvc/CorpSqlServer.corp.com:1433' "

• System Service Discovery

• Masquerading

• Steal or Forge Kerberos Tickets

• Forced Authentication

Which common Privilege Escalation technique does the following cmdline concern:

"find / -perm -u=s -type f 2>/dev/null"

• Unquoted Service File Paths

• Weak Service Permissions

• SUID Executables

• Find command Vulnerability

Which attacker scenario best fits the following cmdline:

"cmd.exe /Q /c tasklist /v /fo csv | findstr /i "lsass" 1> \\127.0.0.1\C$\Windows\Temp\KNwpzU 2>&1"

• Credential Dumping with Impacket's Wmiexec.py

• Credential Dumping with Mimikatz

• Privilege Escalation with Impacket's Wmiexec.py

• Credential Dumping with Impacket's Psexec.py

What is the purpose of the following cmdline:

echo " " | nc -vv -n -w1 72.52.206.134 80

• Launch an attack on a server sending 80 separate packets in a short period of time

• Identify if a server is running a service using port 80 and is reachable

• Use Netcat to remotely administer the server

• Use Netcat to start an RDP session on the server

DLL Side-Loading concerns a legitimate process loading a .dll that is located at ...

• The same path as the executable

• The system directory

• The directories that are listed in the PATH environment variable

• The Windows directory

A HIDS reported a vulnerability on a system based on a known attack. After researching the alert from the HIDS, you identify the recommended solution and begin applying it. What type of HIDS is in use?

• Network-based

• Signature-based

• Heuristic-based

• Anomaly-based

Which technique does the following cmdline correspond to: query user

• RDP Hijacking

• Kerberoasting

• NTLM Hash Dump

• DNS Poisoning