nerdexam
GIAC

GCIH · Question #841

Which of the processes, shown in the output below, should be prioritized for examination during live response? Command run: C:\> netstat -naob Output: see screen capture (irrelevant lines of output om

The correct answer is B. calc.exe. During live response, netstat -naob reveals processes with active network connections. The analyst must identify which process has no legitimate reason to communicate over the network.

Incident Response & Cyber Kill Chain

Question

Which of the processes, shown in the output below, should be prioritized for examination during live response? Command run: C:> netstat -naob Output: see screen capture (irrelevant lines of output omitted for space)

Exhibit

GCIH question #841 exhibit

Options

  • ARpcSs
  • Bcalc.exe
  • CW32Time
  • Dfirefox.exe

How the community answered

(25 responses)
  • A
    8% (2)
  • B
    72% (18)
  • C
    16% (4)
  • D
    4% (1)

Why each option

During live response, netstat -naob reveals processes with active network connections. The analyst must identify which process has no legitimate reason to communicate over the network.

ARpcSs

RpcSs is the Windows Remote Procedure Call service and routinely communicates over the network as part of normal Windows IPC and remote service functionality.

Bcalc.exeCorrect

calc.exe (Windows Calculator) is a local utility with no legitimate need to establish or listen on network connections. Its presence in netstat output is a strong indicator of process injection, process hollowing, or malware using the calculator process as a host - making it the highest priority for investigation.

CW32Time

W32Time is the Windows Time service and legitimately communicates outbound over UDP 123 to synchronize system time via NTP - network activity is expected.

Dfirefox.exe

firefox.exe is a web browser whose core function is network communication, so its presence in netstat output with active connections is entirely expected and not inherently suspicious.

Concept tested: Identifying anomalous processes during live network forensics

Source: https://www.nist.gov/publications/computer-security-incident-handling-guide

Topics

#live response#netstat#suspicious processes#process analysis

Community Discussion

No community discussion yet for this question.

Full GCIH Practice