Thread by @BlackMatter23

Detection Quiz!💡
Look at the process creation events depicted below:
1. Can you recognise the technique?
2. Map it to the @MITREattack
3. Which tool was most likely used?
4. Detection ideas?

#ThreatHunting

Columns: Time, Parent, ParentIntegrityLevel, Child, ChildIntegrityLevel

Please, provide your answers in form of 1..2..3..4..

@Cyb3rSn0rlax, @nas_bench

@jamieantisocial could you write your thoughts here, please?

@Ch33r10 what do you think?😉

The 1st question is a key to answer for the rest☝️

3. Find the 1st answer. Then combine things together and use google😉

1. I'd say this is the hardest detectable technique among these "class" of techniques.

4. Bonus question: Unfortunately we can't use Sysmon for detection here, it misses one important field.
Name this field and ask @markrussinovich to add it😉

Ladies and gentlemen - where are your answers?)

I've received great answers from @Antonlovesdnb👏

Received awesome answers from @Cyb3rSn0rlax, great work man👏

Please, don't google a lot, use my Quizzes to train your analyst/detection mindset.

1. Look at the Integrity levels - what's happening here?

Are you conducting SOC analysts interview? - you can use my quizzes, but be sure your candidate haven't seen them in twitter😉 And not allow them to use google - look how your candidates are thinking and reasoning.

I've already received the correct answers for the most questions. Who can provide *all* correct answers?

@singe will you try?) You were great on the last Quiz

Please, don't google a lot. Look at the events, read the docs, analyse events, use MITRE.

Open Windows Internals🙈😆