312-50V11 · Question #1011
Attacker Simon targeted the communication network of an organization and disabled the security controls of NetNTLMvl by modifying the values of LMCompatibilityLevel, NTLMMinClientSec, and RestrictSend
The correct answer is A. Internal monologue attack. An internal monologue attack manipulates Windows NTLM registry settings to downgrade authentication security and extracts NTLM hashes from active process tokens without directly touching LSASS. The specific registry keys and token-extraction method described are definitive indica
Question
Attacker Simon targeted the communication network of an organization and disabled the security controls of NetNTLMvl by modifying the values of LMCompatibilityLevel, NTLMMinClientSec, and RestrictSendingNTLMTraffic. He then extracted all the non-network logon tokens from all the active processes to masquerade as a legitimate user to launch further attacks. What is the type of attack performed by Simon?
Options
- AInternal monologue attack
- BCombinator attack
- CRainbow table attack
- DDictionary attack
How the community answered
(30 responses)- A57% (17)
- B7% (2)
- C27% (8)
- D10% (3)
Why each option
An internal monologue attack manipulates Windows NTLM registry settings to downgrade authentication security and extracts NTLM hashes from active process tokens without directly touching LSASS. The specific registry keys and token-extraction method described are definitive indicators of this technique.
The internal monologue attack disables NetNTLMv1 security controls by modifying LMCompatibilityLevel, NTLMMinClientSec, and RestrictSendingNTLMTraffic registry values, then abuses the Windows SSPI (Security Support Provider Interface) to retrieve NTLM response values from non-network logon tokens held in active processes. This allows the attacker to impersonate legitimate users without directly reading LSASS memory, making the technique stealthier than traditional credential dumping methods.
A combinator attack is a password-cracking technique that merges entries from multiple wordlists and has no relation to NTLM registry manipulation or process token extraction.
A rainbow table attack uses precomputed hash-to-plaintext lookup tables to crack captured password hashes offline and does not involve modifying registry keys or masquerading via process tokens.
A dictionary attack tries a predefined list of passwords against an authentication prompt and is unrelated to NTLM security control modification or token-based impersonation.
Concept tested: Internal monologue attack via NTLM registry manipulation
Source: https://attack.mitre.org/techniques/T1003/
Topics
Community Discussion
No community discussion yet for this question.