nerdexam
CrowdStrike

CCCS-203B · Question #31

You are a security analyst reviewing logs in the CrowdStrike Falcon platform. You notice unusual activity involving the repeated execution of a legitimate application, powershell.exe, with a base64-en

The correct answer is B. A malicious actor executing a PowerShell script for credential dumping.. Option A: While administrators might use PowerShell for automation, it's uncommon to encode commands in base64 unless there's a specific need to obfuscate. This could indicate suspicious activity. Additional context, like logs or administrator intent, is required to confirm this

Threat Detection and Response

Question

You are a security analyst reviewing logs in the CrowdStrike Falcon platform. You notice unusual activity involving the repeated execution of a legitimate application, powershell.exe, with a base64-encoded string passed as a parameter. Which of the following is the most likely explanation for this behavior, and what should be your next step?

Options

  • AAn administrator running legitimate scripts to automate system tasks.
  • BA malicious actor executing a PowerShell script for credential dumping.
  • CRoutine software update activities performed by the IT department.
  • DA system error causing the repeated execution of PowerShell.

How the community answered

(29 responses)
  • A
    3% (1)
  • B
    62% (18)
  • C
    10% (3)
  • D
    24% (7)

Explanation

Option A: While administrators might use PowerShell for automation, it's uncommon to encode commands in base64 unless there's a specific need to obfuscate. This could indicate suspicious activity. Additional context, like logs or administrator intent, is required to confirm this as Option B: This behavior is highly indicative of malicious activity. PowerShell, especially when invoked with encoded commands, is a common vector used by attackers for credential dumping or executing malicious scripts. Reviewing the command and decoding the base64 string is essential to determine the exact purpose of the script. You should isolate the system and conduct further analysis to confirm and mitigate the threat. Option C: Software updates rarely require PowerShell scripts with encoded commands. Confirming this scenario would require verifying the activity against scheduled update logs or communication from the IT team. Option D: System errors can lead to unexpected behavior, but they are unlikely to involve encoded commands passed to powershell.exe. Such activity should be treated as suspicious until proven otherwise.

Topics

#PowerShell obfuscation#credential dumping#behavioral analysis#threat hunting

Community Discussion

No community discussion yet for this question.

Full CCCS-203B Practice