CS0-003 · Question #424
An analyst is investigating a phishing incident and has retrieved the following as part of the investigation: cmd.exe /c c:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - WindowStyle…
The correct answer is A. Echo the command payload content into 'base64 -d'. The command in question involves an encoded PowerShell command, which is typically used by attackers to obfuscate malicious scripts. To decode and understand the payload, one would need to decode the base64 encoded string. This is why option A is the correct answer, as 'base64…
Question
An analyst is investigating a phishing incident and has retrieved the following as part of the investigation:
cmd.exe /c c:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - WindowStyle Hidden - ExecutionPolicy Bypass -NoLogo -NoProfile - EncodedCommand <VERY LONG STRING> Which of the following should the analyst use to gather more information about the purpose of this command?
Options
- AEcho the command payload content into 'base64 -d'.
- BExecute the command from a Windows VM.
- CUse a command console with administrator privileges to execute the code.
- DRun the command as an unprivileged user from the analyst workstation.
How the community answered
(24 responses)- A71% (17)
- B4% (1)
- C8% (2)
- D17% (4)
Explanation
The command in question involves an encoded PowerShell command, which is typically used by attackers to obfuscate malicious scripts. To decode and understand the payload, one would need to decode the base64 encoded string. This is why option A is the correct answer, as 'base64 -d' is a command used to decode data encoded with base64. This process will reveal the plaintext of the encoded command, which can then be analyzed to understand the actions that the attacker was attempting to perform.
Topics
Community Discussion
No community discussion yet for this question.