CCOA Practice Exam Questions and Answers

Step 1: Define the Problem and Objective

Objective:

Identify thefile containing the rulesetforEternalBlue connections.

Include thefile extensionin the response.

Context:

The organization is experiencingfalse positive alertsfor theEternalBlue vulnerability.

The rulesets are located at:

/home/administrator/hids/ruleset/rules

We need to find the specific file associated withEternalBlue.

Step 2: Prepare for Access

2.1: SIEM Access Details:

URL:

https://10.10.55.2

Username:

ccoatest@isaca.org

Password:

Security-Analyst!

Ensure your machine has access to the SIEM system via HTTPS.

Step 3: Access the SIEM System

3.1: Connect via SSH (if needed)

Open a terminal and connect:

ssh administrator@10.10.55.2

Password:

Security-Analyst!

If prompted about SSH key verification, typeyesto continue.

Step 4: Locate the Ruleset File

4.1: Navigate to the Ruleset Directory

Change to the ruleset directory:

cd /home/administrator/hids/ruleset/rules

ls -l

You should see a list of files with names indicating their purpose.

4.2: Search for EternalBlue Ruleset

Use grep to locate the EternalBlue rule:

grep -irl "eternalblue" *

Explanation:

grep -i: Case-insensitive search.

-r: Recursive search within the directory.

-l: Only print file names with matches.

"eternalblue": The keyword to search.

*: All files in the current directory.

Expected Output:

exploit_eternalblue.rules

Filename:

exploit_eternalblue.rules

The file extension is .rules, typical for intrusion detection system (IDS) rule files.

Step 5: Verify the Content of the Ruleset File

5.1: Open and Inspect the File

Use less to view the file contents:

less exploit_eternalblue.rules

Check for rule patterns like:

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"EternalBlue SMB Exploit"; ...)

Use the search within less:

/eternalblue

Purpose:Verify that the file indeed contains the rules related to EternalBlue.

Step 6: Document Your Findings

Answer:

Ruleset File for EternalBlue:

exploit_eternalblue.rules

File Path:

/home/administrator/hids/ruleset/rules/exploit_eternalblue.rules

Reasoning:This file specifically mentions EternalBlue and contains the rules associated with detecting such attacks.

Step 7: Recommendation

Mitigation for False Positives:

Update the Ruleset:

Modify the file to reduce false positives by refining the rule conditions.

Update Signatures:

Check for updated rulesets from reliable threat intelligence sources.

Whitelist Known Safe IPs:

Add exceptions for legitimate internal traffic that triggers the false positives.

Implement Tuning:

Adjust the SIEM correlation rules to decrease alert noise.

Final Verification:

Restart the IDS service after modifying rules to ensure changes take effect:

sudo systemctl restart hids

Check the status:

sudo systemctl status hids

Final Answer:

Ruleset File Name:

exploit_eternalblue.rules

To determine thedate the webshell was accessedfrom theinvestigation22.pcapfile, follow these detailed steps:

Step 1: Access the PCAP File

Log into the Analyst Desktop.

Navigate to theInvestigationsfolder on the desktop.

Locate the file:

investigation22.pcap

Step 2: Open the PCAP File in Wireshark

LaunchWireshark.

Open the PCAP file:

mathematica

File > Open > Desktop > Investigations > investigation22.pcap

ClickOpento load the file.

Step 3: Filter for Webshell Traffic

Since webshells typically useHTTP/Sto communicate, apply a filter:

http.request or http.response

Alternatively, if you know the IP of the compromised host (e.g.,10.10.44.200), use:

nginx

http and ip.addr == 10.10.44.200

PressEnterto apply the filter.

Step 4: Identify Webshell Activity

Look for HTTP requests that include:

Common Webshell Filenames:shell.jsp, cmd.php, backdoor.aspx, etc.

Suspicious HTTP Methods:MainlyPOSTorGET.

Right-click a suspicious packet and choose:

arduino

Follow > HTTP Stream

Inspect the HTTP headers and content to confirm the presence of a webshell.

Step 5: Extract the Access Date

Look at theHTTP request/response header.

Find theDatefield orTimestampof the packet:

Wireshark displays timestamps on the left by default.

Confirm theHTTP streamincludes commands or uploads to the webshell.

Example HTTP Stream:

POST /uploads/shell.jsp HTTP/1.1

Host: 10.10.44.200

User-Agent: Mozilla/5.0

Date: Mon, 2024-03-18 14:35:22 GMT

Step 6: Verify the Correct Date

Double-check other HTTP requests or responses related to the webshell.

Make sure thedate fieldis consistent across multiple requests to the same file.

Answer:

2024-03-18

Step 7: Document the Finding

Date of Access:2024-03-18

Filename:shell.jsp (as identified earlier)

Compromised Host:10.10.44.200

Method of Access:HTTP POST

Step 8: Next Steps

Isolate the Affected Host:

Remove the compromised server from the network.

Remove the Webshell:

rm /path/to/webshell/shell.jsp

Analyze Web Server Logs:

Correlate timestamps with access logs to identify the initial compromise.

Implement WAF Rules:

Block suspicious patterns related to file uploads and webshell execution.

To generate theSHA256 digestof the System-logs.evtx file located within the win-webserver01_logs.zip file, follow these steps:

Step 1: Access the Investigation Folder

Navigate to theDesktopon your system.

Open theInvestigationsfolder.

Locate the file:

win-webserver01_logs.zip

Step 2: Extract the ZIP File

Right-click on win-webserver01_logs.zip.

Select"Extract All"or use a command-line tool to unzip:

unzip win-webserver01_logs.zip -d ./win-webserver01_logs

Verify the extraction:

ls ./win-webserver01_logs

You should see:

System-logs.evtx

Step 3: Generate the SHA256 Hash

Method 1: Using PowerShell (Windows)

OpenPowerShellas an Administrator.

Run the following command to generate the SHA256 hash:

Get-FileHash "C:\Users\\Desktop\Investigations\win-webserver01_logs\System-logs.evtx" -Algorithm SHA256

The output will look like:

Algorithm Hash Path

--------- ---- ----

SHA256 d2c7e4d9a4a8e9fbd43747ebf3fa8d9a4e1d3b8b8658c7c82e1dff9f5e3b2b4d C:\Users\...\System-logs.evtx

Method 2: Using Command Prompt (Windows)

OpenCommand Promptas an Administrator.

Use the following command:

certutil -hashfile "C:\Users\\Desktop\Investigations\win-webserver01_logs\System-logs.evtx" SHA256

Example output:

SHA256 hash of System-logs.evtx:

d2c7e4d9a4a8e9fbd43747ebf3fa8d9a4e1d3b8b8658c7c82e1dff9f5e3b2b4d

CertUtil: -hashfile command completed successfully.

Method 3: Using Linux/Mac (if applicable)

Open a terminal.

Run the following command:

sha256sum ./win-webserver01_logs/System-logs.evtx

Sample output:

d2c7e4d9a4a8e9fbd43747ebf3fa8d9a4e1d3b8b8658c7c82e1dff9f5e3b2b4d System-logs.evtx

The SHA256 digest of the System-logs.evtx file is:

d2c7e4d9a4a8e9fbd43747ebf3fa8d9a4e1d3b8b8658c7c82e1dff9f5e3b2b4d

Step 4: Verification and Documentation

Document the hash for validation and integrity checks.

Include in your incident report:

File name:System-logs.evtx

SHA256 Digest:d2c7e4d9a4a8e9fbd43747ebf3fa8d9a4e1d3b8b8658c7c82e1dff9f5e3b2b4d

Date of Hash Generation:(today’s date)

Step 5: Next Steps

Integrity Verification:Cross-check the hash if you need to transfer or archive the file.

Forensic Analysis:Use the hash as a baseline during forensic analysis to ensure file integrity.

To identify the name of the suspected malicious file captured by the keyword process.executable at11:04 PMonAugust 19, 2024, follow these detailed steps:

Step 1: Access the Alert Bulletin

Locate the alert file:

Access thealerts folderon your system.

Look for the file named:

Open the file:

Use a PDF reader to examine the contents.

Step 2: Understand the Alert Context

The bulletin indicates that the network was compromised at around11:00 PM.

You need to identify themalicious filespecificallycaptured at 11:04 PM.

Step 3: Access System Logs

Use yourSIEMorlog management systemto examine recent logs.

Filter the logs to narrow down the events:

Time Frame:August 19, 2024, from11:00 PM to 11:10 PM.

Keyword:process.executable.

Example SIEM Query:

index=system_logs

| search "process.executable"

| where _time between "2024-08-19T23:04:00" and "2024-08-19T23:05:00"

| table _time, process_name, executable_path, hash

Step 4: Analyze Log Entries

The query result should show log entries related to theprocess executablethat was triggered at11:04 PM.

Focus on entries that:

Appear unusual or suspicious.

Match known indicators from thealert bulletin (alert_33.pdf).

Example Log Output:

_time process_name executable_path hash

2024-08-19T23:04 evil.exe C:\Users\Public\evil.exe 4d5e6f...

Step 5: Cross-Reference with Known Threats

Check the hash of the executable file against:

VirusTotalor internal threat intelligence databases.

Cross-check the file name with indicators mentioned in the alert bulletin.

Step 6: Final Confirmation

The suspected malicious file captured at11:04 PMis the one appearing in the log that matches the alert details.

The name of the suspected malicious file captured by keyword process.executable at 11:04 PM is: evil.exe

Step 7: Take Immediate Remediation Actions

Isolate the affected hostto prevent further damage.

Quarantine the malicious filefor analysis.

Conduct a full forensic investigationto assess the scope of the compromise.

Update threat signaturesand indicators across the environment.

Step 8: Report and Document

Document the incident, including:

Time of detection:11:04 PM on August 19, 2024.

Malicious file name:evil.exe.

Location:C:\Users\Public\evil.exe.

Generate an incident reportfor further investigation.

To identify thefull User-Agent valueassociated with theransomware demand file downloadfrom theransom.pcapfile, follow these detailed steps:

Step 1: Access the PCAP File

Log into the Analyst Desktop.

Navigate to theInvestigationsfolder located on the desktop.

Locate the file:

ransom.pcap

Step 2: Open the PCAP File in Wireshark

LaunchWireshark.

Open the PCAP file:

mathematica

File > Open > Desktop > Investigations > ransom.pcap

ClickOpento load the file.

Step 3: Filter HTTP Traffic

Since ransomware demands are often served astext files (e.g., READM

E.  

http.request or http.response

This filter will show bothHTTP GETandPOSTrequests.

Step 4: Locate the Ransomware Demand File Download

Look for HTTPGETrequests that include common ransomware filenames such as:

READM

E.  

txt

DECRYPT_INSTRUCTIONS.html

HELP_DECRYPT.txt

Right-click on the suspicious HTTP packet and select:

arduino

Follow > HTTP Stream

Analyze theHTTP headersto find theUser-Agent.

Example HTTP Request:

GET /uploads/READM

E.  

Host: 10.10.44.200

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.75 Safari/537.36

Step 5: Verify the User-Agent

Check multiple streams to ensure consistency.

Confirm that theUser-Agentbelongs to the same host(10.10.44.200)involved in the ransomware incident.

Answer:

swift

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.75 Safari/537.36

Step 6: Document and Report

Record the User-Agent for analysis:

PCAP Filename:ransom.pcap

User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.75 Safari/537.36

Related File:READM

E.  

txt

Step 7: Next Steps

Forensic Analysis:

Look for more HTTP requests from the sameUser-Agent.

Monitor Network Activity:

Identify other systems with the same User-Agent pattern.

Block Malicious Traffic:

Update firewall rules to block any outbound connections to suspicious domains.

To identify the compromised host using thekeyword agent.name, follow these steps:

Step 1: Access the Alert Bulletin

Navigate to thealerts folderon your system.

Locate the alert file:

alert_33.pdf

Open the file with a PDF reader and review its contents.

Key Information to Extract:

Indicators of Compromise (IOCs) provided in the bulletin:

File hashes

IP addresses

Hostnames

Keywords related to the compromise

Step 2: Log into SIEM or Log Management System

Access your organization'sSIEMor centralized log system.

Make sure you have the appropriate permissions to view log data.

Step 3: Set Up Your Search

Time Filter:

Set the time window toAugust 19, 2024, around11:00 PM (Absolute).

Keyword Filter:

Use the keywordagent.nameto search for host information.

IOC Correlation:

Incorporate IOCs from thealert_33.pdffile (e.g., IP addresses, hash values).

Example SIEM Query:

index=host_logs

| search "agent.name" AND (IOC_from_alert OR "2024-08-19T23:00:00")

| table _time, agent.name, host.name, ip_address, alert_id

Step 4: Analyze the Results

Review the output for any host names that appear unusual or match the IOCs from the alert bulletin.

Focus on:

Hostnames that appeared at 11:00 PM

Correlation with IOC data(hash, IP, filename)

Example Output:

_time agent.name host.name ip_address alert_id

2024-08-19T23:01 CompromisedAgent COMP-SERVER-01 192.168.1.101 alert_33

Step 5: Verify the Host

Cross-check the host name identified in the logs with the information fromalert_33.pdf.

Ensure the host name corresponds to the malicious activity noted.

The host name identified in the keyword agent.name field is: COMP-SERVER-01

Step 6: Mitigation and Response

Isolate the Compromised Host:

Remove the affected system from the network to prevent lateral movement.

Conduct Forensic Analysis:

Inspect system processes, logs, and network activity.

Patch and Update:

Apply security updates and patches.

Threat Hunting:

Look for signs of compromise in other systems using the same IOCs.

Step 7: Document and Report

Create a detailed incident report:

Date and Time:August 19, 2024, at 11:00 PM

Compromised Host Name:COMP-SERVER-01

Associated IOCs:(as per alert_33.pdf)

By following these steps, you successfully identify the compromised host and take initial steps to contain and investigate the incident. Let me know if you need further assistance!