Which of the elements of the Cyber Kill Chain were represented in the intrusion you performed in this lab? 

Transcribed Image Text:

4. What evidence did you discover that indicates a privilege escalation occurred? (Select all that apply The C:\HR\marked2 folder was created under a user context of jaime The C:\HR\marked2 folder was created under a user context of SYSTEM The C:\HR\marked2 folder was created under a process context of rundll32.exe The C:\HR\marked2 folder was created under a process context of safetool.exe The assignment of a *NULL SID* and the *Toker Elevation Type* of *%%1937* to the rundell32 process The initiation of a reverse shell connection to an external system to port 4445 by rundll32.exe The initiation of a reverse shell connection to ar external system to port 4444 by safetool.exe Score 4. What evidence did you discover that indicates a privilege escalation occurred? (Select all that apply The C:\HR\marked2 folder was created under a user context of jaime The C:\HR\marked2 folder was created under a user context of SYSTEM The C:\HR\marked2 folder was created under a process context of rundll32.exe The C:\HR\marked2 folder was created under a process context of safetool.exe The assignment of a *NULL SID* and the *Toker Elevation Type* of *%%1937* to the rundell32 process The initiation of a reverse shell connection to an external system to port 4445 by rundll32.exe The initiation of a reverse shell connection to ar external system to port 4444 by safetool.exe Score