CS0-003 · Question #365
A SIEM alert is triggered based on execution of a suspicious one-liner on two workstations in the organization's environment. An analyst views the details of these events below: Which of the…
The correct answer is C. Attacker is executing PowerShell script "AccessToken.ps1". Based on the description of a 'suspicious one-liner' and the likely context of a SIEM alert, the attacker's intent is to execute a specific PowerShell script named 'AccessToken.ps1'.
Question
A SIEM alert is triggered based on execution of a suspicious one-liner on two workstations in the organization's environment. An analyst views the details of these events below:
Which of the following statements best describes the intent of the attacker, based on this one- liner?
Options
- AAttacker is escalating privileges via JavaScript.
- BAttacker is utilizing custom malware to download an additional script.
- CAttacker is executing PowerShell script "AccessToken.ps1".
- DAttacker is attempting to install persistence mechanisms on the target machine.
How the community answered
(27 responses)- A15% (4)
- B4% (1)
- C74% (20)
- D7% (2)
Why each option
Based on the description of a 'suspicious one-liner' and the likely context of a SIEM alert, the attacker's intent is to execute a specific PowerShell script named 'AccessToken.ps1'.
The option specifies JavaScript, but "AccessToken.ps1" is a PowerShell script, indicating a different scripting language and method.
While the one-liner *could* be used to download additional scripts, the primary action described by "AccessToken.ps1" is the execution of that specific script, not necessarily downloading *custom malware* as the direct intent, unless the one-liner's full content showed a download command.
The question states "execution of a suspicious one-liner" and the options point to specific actions. Option C directly names a PowerShell script, "AccessToken.ps1," which, if present in the one-liner, is the most direct and specific description of an execution event, often used for credential theft or privilege escalation if designed for it.
Installing persistence mechanisms is a common attacker goal, but merely executing "AccessToken.ps1" does not inherently mean persistence is being installed; it could be for reconnaissance, credential theft, or other immediate objectives.
Concept tested: Interpreting command-line execution (PowerShell)
Source: https://learn.microsoft.com/en-us/powershell/scripting/overview?view=powershell-7.4
Topics
Community Discussion
No community discussion yet for this question.