XSIAM-Analyst practice question 8 of 10

SCENARIO: A security analyst has been assigned a ticket from the help desk stating that users are experiencing errors when attempting to open files…

SCENARIO: A security analyst has been assigned a ticket from the help desk stating that users are experiencing errors when attempting to open files on a specific network share. These errors state that the file format cannot be opened. IT has verified that the file server is online and functioning, but that all files have unusual extensions attached to them. The security analyst reviews alerts within Cortex XSIAM and identifies malicious activity related to a possible ransomware attack on the file server. This incident is then escalated to the incident response team for further investigation. Upon reviewing the incident, the responders confirm that ransomware was successfully executed on the file server. Other details of the attack are noted below: • An unpatched vulnerability on an externally facing web server was exploited for initial access • The attackers successfully used Mimikatz to dump sensitive credentials that were used for privilege escalation • PowerShell was used on a Windows server for additional discovery, as well as lateral movement to other systems • The attackers executed SystemBC RAT on multiple systems to maintain remote access • Ransomware payload was downloaded on the file server via an external site "file io" QUESTION STATEMENT: Which hunt collection category in Cortex XSIAM should the incident responders use to identify all systems where the attackers established persistence during the attack?

Answer options

A: Remote Access Correct answer

B: Network Data

C: Process Execution

D: Command History

Correct Answer:

A. Remote Access

Explanation

The scenario explicitly states that the attackers executed the "SystemBC RAT on multiple systems to maintain remote access." A Remote Access Trojan (RAT) is a primary tool for establishing persistence. The "Remote Access" hunt collection category in Cortex XSIAM is specifically designed to contain queries that identify activity from such tools, including RATs, unauthorized RDP, or VNC sessions. Therefore, using this category is the most direct and efficient method for incident responders to find all systems where the attackers established this form of persistence.

Why Incorrect

B. Network Data: This category is too general. While it would contain command-and-control traffic from the RAT, it is less specific for identifying the persistence mechanism on the endpoint itself.
C. Process Execution: Although the RAT runs as a process, this category is less targeted. The "Remote Access" category is a more specific classification for this type of malicious software and its purpose.
D. Command History: This would be useful for identifying how the RAT was initially launched (e.g., via PowerShell) but is not the primary category for locating all systems where it is actively providing persistence. ---

References

1. Palo Alto Networks, Cortex® XSIAM™ Administrator's Guide: In the "Threat Hunting" section, the guide explains the use of pre-built and custom queries. These queries are organized into categories that often align with stages of an attack or specific tactics, such as "Remote Access Tools," to streamline investigations into particular types of malicious activity. The use of a RAT for persistence falls directly into this category.

2. Palo Alto Networks, Cortex® XSIAM™ Query Builder and Hunting Guide: This documentation details the structure of the hunting interface, showing how queries are grouped by category. The "Remote Access" category is provided to help analysts quickly find evidence of tools used for remote control and persistence, as described in the scenario.

3. MITRE ATT&CK® Framework, Technique T1219: Remote Access Software: The MITRE ATT&CK framework, which heavily influences XSIAM's threat-hunting capabilities, classifies the use of tools like SystemBC RAT under this technique. It is associated with the tactics of Persistence (TA0003) and Command and Control (TA0011). This validates that hunting for "Remote Access" activity is the correct approach to finding this persistence method. (Source: https://attack.mitre.org/techniques/T1219/)

Keep practicing

Take the free XSIAM-Analyst practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test