312-39 · Question #38
A threat hunter analyzing an infected endpoint finds that malicious processes keep reappearing even after termination, making traditional remediation ineffective. The user reports slowdowns…
The correct answer is C. Host-based artifacts. Host-based artifacts are the most direct evidence to confirm persistence and recurring execution on an endpoint. The scenario already describes classic host persistence mechanisms: scheduled tasks and registry autorun modifications. To confirm and mitigate, a threat hunter…
Question
A threat hunter analyzing an infected endpoint finds that malicious processes keep reappearing even after termination, making traditional remediation ineffective. The user reports slowdowns, abnormal pop-ups, and unauthorized application launches. Deeper inspection reveals multiple scheduled tasks executing unknown scripts at intervals, along with suspicious registry modifications enabling automatic execution on startup. The endpoint makes intermittent encrypted outbound connections to an unclassified external server. The organization also observed multiple failed privileged logins from the same subnet. Which signs should the threat hunter look for to confirm and mitigate the threat?
Options
- ANetwork-based artifacts
- BThreat intelligence and adversary context
- CHost-based artifacts
- DIndicators of Attack (IoAs)
How the community answered
(27 responses)- A7% (2)
- B22% (6)
- C59% (16)
- D11% (3)
Explanation
Host-based artifacts are the most direct evidence to confirm persistence and recurring execution on an endpoint. The scenario already describes classic host persistence mechanisms: scheduled tasks and registry autorun modifications. To confirm and mitigate, a threat hunter should focus on endpoint-resident artifacts such as: persistence entries (scheduled tasks, Run/RunOnce keys, services, WMI subscriptions), process ancestry (which parent launches the malicious script), file system changes (dropped scripts, DLLs, staged payloads), and security control tampering. These artifacts enable containment and eradication because they point to what must be removed and what must be prevented from re-creating itself after reboot. Network-based artifacts are important for identifying C2 destinations and potential lateral movement, but they won’t fully explain how the malware survives termination. Threat intelligence context can help attribute and match TTPs, but it’s not required to confirm persistence locally. Indicators of Attack are behavior patterns (like scheduled task creation, registry autoruns, process injection) and are valuable conceptually, but the option that best represents the concrete evidence you need to examine and remediate on the endpoint is “host- based artifacts.” In SOC response, you’d combine host artifact removal with credential resets and scoping for similar persistence across endpoints.
Topics
Community Discussion
No community discussion yet for this question.