Cybersecurity Analyst
Incident response and malware questions
185 questions on Incident response and malware for cybersecurity analysts, easiest first.
Easy 51
- What does SHA-256 do?easy
- Which malware spreads by itself?easy
- Backups that survive ransomwareeasy
- Safe use of VirusTotaleasy
- Why chain of custody matterseasy
- The parts of a YARA ruleeasy
- What uint16(0) == 0x5A4D checkseasy
- vssadmin delete shadowseasy
- Security event or security incidenteasy
- What makes malware a trojaneasy
- Double extortion ransomwareeasy
- What a rootkit is foreasy
- What an infostealer takeseasy
- What fileless malware meanseasy
- Role of a C2 servereasy
- Containment versus eradicationeasy
- Why IR teams use playbookseasy
- CERT-In reporting windoweasy
- Purpose of a write blockereasy
- Why detonate a file in a sandboxeasy
- Goal of the lessons-learned meetingeasy
- Setting incident severityeasy
- Signs of a cryptominereasy
- Phishing versus spear phishingeasy
- What a backdoor iseasy
- Why hash blocking misses some malwareeasy
- What a RAT lets an attacker doeasy
- Antivirus already quarantined iteasy
- What a tabletop exercise iseasy
- What a CSIRT doeseasy
- Infected by just visiting a siteeasy
- Code that waits for a conditioneasy
- Static or dynamic analysiseasy
- Vulnerability, exploit and payloadeasy
- Time zone for an incident timelineeasy
- Keeping response noteseasy
- User reports a phishing emaileasy
- Why Office blocks some macroseasy
- What a SEV1 usually meanseasy
- Why update a status pageeasy
- When the on-call engineer does not answereasy
- What a runbook containseasy
- What MTTD measureseasy
- One channel per incidenteasy
- The scribe in an incidenteasy
- Making postmortem actions happeneasy
- An employee lost a laptopeasy
- API key pasted in a group chateasy
- The five whyseasy
- User spots a phishing emaileasy
- Ransomware deleted the backups tooeasy
Medium 69
- NIST incident response lifecyclemedium
- Why analysts defang URLsmedium
- Containing a hijacked Microsoft 365 accountmedium
- What this YARA rule matchesmedium
- What EDR host isolation doesmedium
- What evidence to collect firstmedium
- Decoding -EncodedCommandmedium
- File integrity alert on a web servermedium
- Why use fuzzy hashesmedium
- What wide and nocase do in YARAmedium
- Counting matches in YARAmedium
- Why add a filesize limitmedium
- bcdedit turning off recoverymedium
- Top of the Pyramid of Painmedium
- Short-term and long-term containmentmedium
- Hidden process in a memory dumpmedium
- What malfind looks formedium
- A classic registry persistence spotmedium
- Persistence through WMImedium
- What Prefetch files tell youmedium
- Recognising process hollowingmedium
- Imports that suggest injectionmedium
- Shadow copies being deletedmedium
- Hidden rule after a mailbox compromisemedium
- Verifying a forensic imagemedium
- Where Linux attackers persistmedium
- Spotting a beacon in proxy logsmedium
- Before considering a ransom paymentmedium
- A DLL next to a signed programmedium
- Scoping after the first infected hostmedium
- A section with entropy 7.9medium
- Picking a restore pointmedium
- Proving a user opened a filemedium
- Finding the real sending servermedium
- Reading SPF, DKIM and DMARC resultsmedium
- Where a file was downloaded frommedium
- Finding similar malware samplesmedium
- Proving which files were encryptedmedium
- How much data a program sentmedium
- A sync tool on a file servermedium
- Checking SSH logins on Ubuntumedium
- An empty bash historymedium
- Ordering the Cyber Kill Chainmedium
- Collecting triage data from 200 hostsmedium
- One user clicked, 300 received itmedium
- Malicious app with mail accessmedium
- Many MFA pushes at midnightmedium
- Average rate of a data theftmedium
- AnyDesk installed on a servermedium
- Mapping an action to ATT&CKmedium
- Why sign an IR retainer earlymedium
- Notepad talking to the internetmedium
- What the Recycle Bin keepsmedium
- Unsure whether to declare an incidentmedium
- Availability after a 43-minute outagemedium
- Where to look first in an outagemedium
- Why postmortems list several causesmedium
- Deleted secret still in the imagemedium
- Miner inside a Kubernetes podmedium
- Unknown containers on a build hostmedium
- Critical flaw, patch not readymedium
- Secrets stolen through a pull requestmedium
- Website under a large DDoSmedium
- Handover in a 14-hour incidentmedium
- How often to post updatesmedium
- Stuck for 40 minutes on a SEV2medium
- After the mitigation worksmedium
- User typed her password into a phishmedium
- Attacker still in after a resetmedium
Hard 65
- Reading static analysis resultshard
- Artefacts of PsExec lateral movementhard
- First move on an encrypting hosthard
- Evicting a Golden Ticket attackerhard
- Password reset did not stop the attackerhard
- An impossible timelinehard
- Exfiltration before encryptionhard
- Web server spawning a shellhard
- Detecting timestompinghard
- GDPR breach notification deadlinehard
- When to accept a noisy rulehard
- Catching encryption in progresshard
- A process whose binary was deletedhard
- A YARA rule that slows every scanhard
- A YARA rule that matches half the fleethard
- Matching a single-byte XOR stringhard
- Access that outlives a password resethard
- New MFA method right after a risky loginhard
- An svchost with the wrong parenthard
- An LSASS dump with a built-in DLLhard
- Timing the evictionhard
- What else the stolen key didhard
- Sample does nothing in the sandboxhard
- Computing dwell and containment timehard
- Who should hire the forensic firmhard
- Suspected insider before confrontationhard
- Malware in a signed vendor updatehard
- Ransomware on the hypervisorhard
- Attacker may be reading your emailhard
- Ransom note but no way backhard
- Clean the server or rebuild ithard
- Attribution from a single cluehard
- Forensics on a cloud VMhard
- Malware binary deleted while runninghard
- Attacker back after the rebuildhard
- Odd named pipes on many hostshard
- Malware with thousands of domainshard
- Zero detections on a hash lookuphard
- Cyber insurance during an incidenthard
- Logs about to roll overhard
- Malware near a factory control systemhard
- Proving a memory capture is soundhard
- Finding patient zerohard
- Testing the attacker's decryptor claimhard
- Early public statement on a breachhard
- Rebuilding trust in Active Directoryhard
- The attacker sees your isolationhard
- Same imphash, different fileshard
- Rotating a leaked password without an outagehard
- Failing over does not undo corruptionhard
- Production deleted with a CI tokenhard
- Do not just delete the bad podhard
- Two people giving ordershard
- Sharing a security postmortemhard
- Attacker returns after password reset and MFAhard
- Cut the internet for the whole company?hard
- A leaked GitHub token with repo accesshard
- Contain now or watch firsthard
- Rule found after account takeoverhard
- One report, many inboxeshard
- Login from a new country, no MFA prompthard
- Purging a borderline emailhard
- Passwords saved in the browserhard
- Why the first report time mattershard
- What to collect firsthard