GCIH · Question #841
Which of the processes, shown in the output below, should be prioritized for examination during live response? Command run: C:\> netstat -naob Output: see screen capture (irrelevant lines of output om
The correct answer is B. calc.exe. During live response, netstat -naob reveals processes with active network connections. The analyst must identify which process has no legitimate reason to communicate over the network.
Question
Which of the processes, shown in the output below, should be prioritized for examination during live response? Command run: C:> netstat -naob Output: see screen capture (irrelevant lines of output omitted for space)
Exhibit
Options
- ARpcSs
- Bcalc.exe
- CW32Time
- Dfirefox.exe
How the community answered
(25 responses)- A8% (2)
- B72% (18)
- C16% (4)
- D4% (1)
Why each option
During live response, netstat -naob reveals processes with active network connections. The analyst must identify which process has no legitimate reason to communicate over the network.
RpcSs is the Windows Remote Procedure Call service and routinely communicates over the network as part of normal Windows IPC and remote service functionality.
calc.exe (Windows Calculator) is a local utility with no legitimate need to establish or listen on network connections. Its presence in netstat output is a strong indicator of process injection, process hollowing, or malware using the calculator process as a host - making it the highest priority for investigation.
W32Time is the Windows Time service and legitimately communicates outbound over UDP 123 to synchronize system time via NTP - network activity is expected.
firefox.exe is a web browser whose core function is network communication, so its presence in netstat output with active connections is entirely expected and not inherently suspicious.
Concept tested: Identifying anomalous processes during live network forensics
Source: https://www.nist.gov/publications/computer-security-incident-handling-guide
Topics
Community Discussion
No community discussion yet for this question.
