You are a security analyst working for Alpha Security Services. Beta Financial Services, it seems, has encountered more suspicious activity on their network. They have again collected detailed log files from their systems and have sent them to your team for analysis.

Analyze the attached log file, and answer the following questions.

Log$2.$evtxDownload Log$2.$evtx

Question at position $1$

$1$

$1$ point

Question at position $1$

Which windows program is the image $($or parent image$)$ used to run all of the commands?

Question Blank $1$ of $1$

type your answer...

Question at position $2$

$2$

$1$ point

Question at position $2$

Which account is hijacked in the attack?

Question Blank $1$ of $1$

type your answer...

Question at position $3$

$3$

$1$ point

Question at position $3$

What flag was used in the PowerShell command to avoid execution policies in EventID $10662?$

Question Blank $1$ of $1$

type your answer...

Question at position $4$

$4$

$1$ point

Question at position $4$

Which windows executable is used to run the PowerShell command?

Question Blank $1$ of $1$

type your answer...

Question at position $5$

$5$

$1$ point

Question at position $5$

EventID $10662$ contains a lengthy command. In what encoding language is that command written in$?$

Question Blank $1$ of $1$

type your answer...

Question at position $6$

$6$

$1$ point

Question at position $6$

Decode the lengthy command using any tool you can find. What is the suspicious file referenced in the command? $($Decode using the command$-$line or any web tool$)$

Question Blank $1$ of $1$

type your answer...

Question at position $7$

$7$

$1$ point

Question at position $7$

This command utilizes a delay, possibly to avoid detection or to ensure that certain conditions are met before the full program is run. How many seconds is the delay?

Question Blank $1$ of $1$

type your answer...

Question at position $8$

$8$

$1$ point

Question at position $8$

What technique is utilized to make this command more difficult to understand?

What technique is utilized to make this command more difficult to understand?

Confusion

Obfuscation

Garbling

Hiding

Question at position $9$

$9$

$1$ point

Question at position $9$

Which Mitre ATT&CK tactic does this event log most likely demonstrate?

Which Mitre ATT&CK tactic does this event log most likely demonstrate?

Initial Access

Persistence

Lateral Movement

Execution