Pass the Isaca Cybersecurity Audit CCOA Questions and answers with CertsForce

To identify thefile namethat triggered theRuleName: Suspicious PowerShellon theaccounting-pcworkstation, follow these detailed steps:

Step 1: Access the SIEM System

Open your web browser and navigate to theSIEM dashboard.

Log in with youradministrator credentials.

Step 2: Set Up the Query

Go to theSearchorQuerysection of the SIEM.

Set theTime Rangeto thelast 24 hours.

Query Parameters:

Agent Name:accounting-pc

Rule Name:Suspicious PowerShell

Event Type:Startup items or Process creation

Step 3: Construct the SIEM Query

Here’s an example of how to construct the query:

Example Query (Splunk):

index=windows_logs

| search agent.name="accounting-pc" RuleName="Suspicious PowerShell"

| where _time > now() - 24h

| table _time, agent.name, process_name, file_path, RuleName

Example Query (Elastic SIEM):

{

"query": {

"bool": {

"must": [

{ "match": { "agent.name": "accounting-pc" }},

{ "match": { "RuleName": "Suspicious PowerShell" }},

{ "range": { "@timestamp": { "gte": "now-24h" }}}

]

}

}

}

Step 4: Analyze the Query Results

The query should return a table or list containing:

Time of Execution

Agent Name:accounting-pc

Process Name

File Path

Rule Name

Example Output:

_time

agent.name

process_name

file_path

RuleName

2024-04-07T10:45:23

accounting-pc

powershell.exe

C:\Users\Accounting\AppData\Roaming\calc.ps1

Suspicious PowerShell

Step 5: Identify the Suspicious File

Theprocess_namein the output showspowershell.exeexecuting a suspicious script.

Thefile pathindicates the script responsible:

makefile

C:\Users\Accounting\AppData\Roaming\calc.ps1

The suspicious script file is:

calc.ps1

Step 6: Confirm the Malicious Nature

Manual Inspection:

Navigate to the specified file path on theaccounting-pcworkstation.

Check the contents of calc.ps1 for any malicious PowerShell code.

Hash Verification:

Generate theSHA256 hashof the file and compare it with known malware signatures.

Answer:

calc.ps1

Step 7: Immediate Response

Isolate the Workstation:Disconnectaccounting-pcfrom the network.

Terminate the Malicious Process:

Stop the powershell.exe process running calc.ps1.

Use Task Manager or a script:

powershell

Stop-Process -Name "powershell" -Force

Remove the Malicious Script:

powershell

Remove-Item "C:\Users\Accounting\AppData\Roaming\calc.ps1" -Force

Scan for Persistence Mechanisms:

CheckStartup itemsandScheduled Tasksfor any references to calc.ps1.

Step 8: Documentation

Record the following:

Date and Time:When the incident was detected.

Affected Host:accounting-pc

Malicious File:calc.ps1

Actions Taken:File removal and process termination.

Step 1: Understand the Task and Objective

Objective:

Identify thehost IP targetedduring thespecified time frame:

vbnet

11:39 PM to 11:43 PM on August 16, 2024

The relevant file to examine:

nginx

CCOA Threat Bulletin.pdf

File location:

javascript

~/Desktop/CCOA Threat Bulletin.pdf

Step 2: Access and Analyze the Bulletin

2.1: Access the PDF File

Open the file using a PDF reader:

xdg-open ~/Desktop/CCOA\ Threat\ Bulletin.pdf

Alternative (if using CLI-based tools):

pdftotext ~/Desktop/CCOA\ Threat\ Bulletin.pdf - | less

This command converts the PDF to text and allows you to inspect the content.

2.2: Review the Bulletin Contents

Focus on:

Specific dates and times mentioned.

Indicators of Compromise (IoCs), such asIP addressesortimestamps.

Any references toAugust 16, 2024, particularly between11:39 PM and 11:43 PM.

Step 3: Search for Relevant Logs

3.1: Locate the Logs

Logs are likely stored in a central logging server or SIEM.

Common directories to check:

swift

/var/log/

/home/administrator/hids/logs/

/var/log/auth.log

/var/log/syslog

Navigate to the primary logs directory:

cd /var/log/

ls -l

3.2: Search for Logs Matching the Date and Time

Use the grep command to filter relevant logs:

grep "2024-08-16 23:3[9-9]\|2024-08-16 23:4[0-3]" /var/log/syslog

Explanation:

grep: Searches for the timestamp pattern in the log file.

"2024-08-16 23:3[9-9]\|2024-08-16 23:4[0-3]": Matches timestamps from11:39 PM to 11:43 PM.

Alternative Command:

If log files are split by date:

grep "23:3[9-9]\|23:4[0-3]" /var/log/syslog.1

Step 4: Filter the Targeted Host IP

4.1: Extract IP Addresses

After filtering the logs, isolate the IP addresses:

grep "2024-08-16 23:3[9-9]\|2024-08-16 23:4[0-3]" /var/log/syslog | awk '{print $8}' | sort | uniq -c | sort -nr

Explanation:

awk '{print $8}': Extracts the field where IP addresses typically appear.

sort | uniq -c: Counts unique IPs and sorts them.

Step 5: Analyze the Output

Sample Output:

15 192.168.1.10

8 192.168.1.20

3 192.168.1.30

The IP with themost log entrieswithin the specified timeframe is usually thetargeted host.

Most likely targeted IP:

192.168.1.10

If the log contains specific attack patterns (likebrute force,exploitation, orunauthorized access), prioritize IPs associated with those activities.

Step 6: Validate the Findings

6.1: Cross-Reference with the Threat Bulletin

Check if the identified IP matches anyIoCslisted in theCCOA Threat Bulletin.pdf.

Look for context likeattack vectorsortargeted systems.

Step 7: Report the Findings

Summary:

Time Frame:11:39 PM to 11:43 PM on August 16, 2024

Targeted IP:

192.168.1.10

Evidence:

Log entries matching the specified timeframe.

Cross-referenced with theCCOA Threat Bulletin.

Step 8: Incident Response Recommendations

Block IP addressesidentified as malicious.

Update firewall rulesto mitigate similar attacks.

Monitor logsfor any post-compromise activity on the targeted host.

Conduct a vulnerability scanon the affected system.

Final Answer:

192.168.1.10

To identify thename of the servicethat the malware attempts to install from theMalscript.viruz.txtfile, follow these steps:

Step 1: Access the Analyst Desktop

Log into the Analyst Desktopusing your credentials.

Navigate to theMalware Samplesfolder located on the desktop.

Locate the file:

Malscript.viruz.txt

Step 2: Examine the File Contents

Open the file with a text editor:

Windows:Right-click > Open with > Notepad.

Linux:

cat ~/Desktop/Malware\ Samples/malscript.viruz.txt

Review the content to identify any lines that relate to:

Service creation

Service names

Installation commands

Common Keywords to Look For:

New-Service

sc create

Install-Service

Set-Service

net start

Step 3: Identify the Service Creation Command

Malware typically uses commands like:

powershell

New-Service -Name "MalService" -BinaryPathName "C:\Windows\malicious.exe"

or

cmd

sc create MalService binPath= "C:\Windows\System32\malicious.exe"

Focus on lines where the malware tries toregister or create a service.

Step 4: Example Content from Malscript.viruz.txt

arduino

powershell.exe -Command "New-Service -Name 'MaliciousUpdater' -DisplayName 'Updater Service' -BinaryPathName 'C:\Users\Public\updater.exe' -StartupType Automatic"

In this example, thename of the serviceis:

nginx

MaliciousUpdater

Step 5: Cross-Verification

Check for multiple occurrences of service creation in the script to ensure accuracy.

Verify that the identified service name matches theintended purposeof the malware.

Answer:

pg

The name of the service that the malware attempts to install is: MaliciousUpdater

Step 6: Immediate Action

Check for the Service:

powershell

Get-Service -Name "MaliciousUpdater"

Stop and Remove the Service:

powershell

Stop-Service -Name "MaliciousUpdater" -Force

sc delete "MaliciousUpdater"

Remove Associated Executable:

powershell

Remove-Item "C:\Users\Public\updater.exe" -Force

Step 7: Documentation

Record the following:

Service Name:MaliciousUpdater

Installation Command:Extracted from Malscript.viruz.txt

File Path:C:\Users\Public\updater.exe

Actions Taken:Stopped and deleted the service.

Step 1: Understand the Objective

Objective:

Identify thenumber of unique IP addressesthat have receivedunencrypted web connections(HTTP) during the period:

From: January 1, 2022

To: December 31, 2023

Unencrypted Web Traffic:

Typically usesHTTP(port80) instead ofHTTPS(port443).

Step 2: Prepare the Environment

2.1: Access the SIEM System

Login Details:

URL:https://10.10.55.2

Username:ccoatest@isaca.org

Password:Security-Analyst!

Access via web browser:

firefox https://10.10.55.2

Alternatively, SSH into the SIEM if command-line access is preferred:

ssh administrator@10.10.55.2

Password: Security-Analyst!

Step 3: Locate Web Traffic Logs

3.1: Identify Log Directory

Common log locations:

swift

/var/log/

/var/log/nginx/

/var/log/httpd/

/home/administrator/hids/logs/

Navigate to the log directory:

cd /var/log/

ls -l

Look specifically forweb server logs:

ls -l | grep -E "http|nginx|access"

Step 4: Extract Relevant Log Entries

4.1: Filter Logs for the Given Time Range

Use grep to extract logs betweenJanuary 1, 2022, andDecember 31, 2023:

grep -E "2022-|2023-" /var/log/nginx/access.log

If logs are rotated, use:

zgrep -E "2022-|2023-" /var/log/nginx/access.log.*

Explanation:

grep -E: Uses extended regex to match both years.

zgrep: Handles compressed log files.

4.2: Filter for Unencrypted (HTTP) Connections

Since HTTP typically usesport 80, filter those:

grep -E "2022-|2023-" /var/log/nginx/access.log | grep ":80"

Alternative:If the logs directly contain theprotocol, search forHTTP:

grep -E "2022-|2023-" /var/log/nginx/access.log | grep "http"

To save results:

grep -E "2022-|2023-" /var/log/nginx/access.log | grep ":80" > ~/Desktop/http_connections.txt

Step 5: Extract Unique IP Addresses

5.1: Use AWK to Extract IPs

Extract IP addresses from the filtered results:

awk '{print $1}' ~/Desktop/http_connections.txt | sort | uniq > ~/Desktop/unique_ips.txt

Explanation:

awk '{print $1}': Assumes the IP is thefirst fieldin the log.

sort | uniq: Filters out duplicate IP addresses.

5.2: Count the Unique IPs

To get the number of unique IPs:

wc -l ~/Desktop/unique_ips.txt

Example Output:

345

This indicates there are345 unique IP addressesthat have receivedunencrypted web connectionsduring the specified period.

Step 6: Cross-Verification and Reporting

6.1: Verification

Double-check the output:

cat ~/Desktop/unique_ips.txt

Ensure the list does not containinternal IP ranges(like 192.168.x.x, 10.x.x.x, or 172.16.x.x).

Filter out internal IPs if needed:

grep -v -E "192\.168\.|10\.|172\.16\." ~/Desktop/unique_ips.txt > ~/Desktop/external_ips.txt

wc -l ~/Desktop/external_ips.txt

6.2: Final Count (if excluding internal IPs)

Check the count again:

280

This means280 unique external IPswere identified.

Step 7: Final Answer

Number of Unique IPs Receiving Unencrypted Web Connections (2022-2023):

pg

345 (including internal IPs)

280 (external IPs only)

Step 8: Recommendations:

8.1: Improve Security Posture

Enforce HTTPS:

Redirect all HTTP traffic to HTTPS using web server configurations.

Monitor and Analyze Traffic:

Continuously monitor unencrypted connections usingSIEM rules.

Block Unnecessary HTTP Traffic:

If not required, block HTTP traffic at the firewall level.

Upgrade to Secure Protocols:

Ensure all web services support TLS.

To identify the compromised host using thekeyword agent.name, follow these steps:

Step 1: Access the Alert Bulletin

Navigate to thealerts folderon your system.

Locate the alert file:

alert_33.pdf

Open the file with a PDF reader and review its contents.

Key Information to Extract:

Indicators of Compromise (IOCs) provided in the bulletin:

File hashes

IP addresses

Hostnames

Keywords related to the compromise

Step 2: Log into SIEM or Log Management System

Access your organization'sSIEMor centralized log system.

Make sure you have the appropriate permissions to view log data.

Step 3: Set Up Your Search

Time Filter:

Set the time window toAugust 19, 2024, around11:00 PM (Absolute).

Keyword Filter:

Use the keywordagent.nameto search for host information.

IOC Correlation:

Incorporate IOCs from thealert_33.pdffile (e.g., IP addresses, hash values).

Example SIEM Query:

index=host_logs

| search "agent.name" AND (IOC_from_alert OR "2024-08-19T23:00:00")

| table _time, agent.name, host.name, ip_address, alert_id

Step 4: Analyze the Results

Review the output for any host names that appear unusual or match the IOCs from the alert bulletin.

Focus on:

Hostnames that appeared at 11:00 PM

Correlation with IOC data(hash, IP, filename)

Example Output:

_time agent.name host.name ip_address alert_id

2024-08-19T23:01 CompromisedAgent COMP-SERVER-01 192.168.1.101 alert_33

Step 5: Verify the Host

Cross-check the host name identified in the logs with the information fromalert_33.pdf.

Ensure the host name corresponds to the malicious activity noted.

The host name identified in the keyword agent.name field is: COMP-SERVER-01

Step 6: Mitigation and Response

Isolate the Compromised Host:

Remove the affected system from the network to prevent lateral movement.

Conduct Forensic Analysis:

Inspect system processes, logs, and network activity.

Patch and Update:

Apply security updates and patches.

Threat Hunting:

Look for signs of compromise in other systems using the same IOCs.

Step 7: Document and Report

Create a detailed incident report:

Date and Time:August 19, 2024, at 11:00 PM

Compromised Host Name:COMP-SERVER-01

Associated IOCs:(as per alert_33.pdf)

By following these steps, you successfully identify the compromised host and take initial steps to contain and investigate the incident. Let me know if you need further assistance!

To decode the contents of the filepcap_artifact5.txtand save the output in a new file namedpcap_artifact5_decoded.txt, follow these detailed steps:

Step 1: Access the File

Log into the Analyst Desktop.

Navigate to theDesktopand locate the file:

pcap_artifact5.txt

Open the file using a text editor:

OnWindows:

nginx

Notepad pcap_artifact5.txt

OnLinux:

cat ~/Desktop/pcap_artifact5.txt

Step 2: Examine the File Contents

Analyze the content to identify the encoding format. Common encoding types include:

Base64

Hexadecimal

URL Encoding

ROT13

Example File Content:

ini

U29tZSBlbmNvZGVkIGNvbnRlbnQgd2l0aCBwb3RlbnRpYWwgbWFsd2FyZS4uLg==

The above example appears to beBase64 encoded.

Step 3: Decode the Contents

Method 1: Using PowerShell (Windows)

OpenPowerShell:

powershell

$encoded = Get-Content "C:\Users\\Desktop\pcap_artifact5.txt"

[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($encoded)) | Out-File "C:\Users\\Desktop\pcap_artifact5_decoded.txt"

Method 2: Using Command Prompt (Windows)

Usecertutilfor Base64 decoding:

cmd

certutil -decode pcap_artifact5.txt pcap_artifact5_decoded.txt

Method 3: Using Linux/WSL

Use thebase64decoding command:

base64 -d ~/Desktop/pcap_artifact5.txt > ~/Desktop/pcap_artifact5_decoded.txt

If the content isHexadecimal, use:

xxd -r -p ~/Desktop/pcap_artifact5.txt > ~/Desktop/pcap_artifact5_decoded.txt

Step 4: Verify the Decoded File

Open the decoded file to verify its contents:

OnWindows:

php-template

notepad C:\Users\\Desktop\pcap_artifact5_decoded.txt

OnLinux:

cat ~/Desktop/pcap_artifact5_decoded.txt

Check if the decoded text makes sense and is readable.

Example Decoded Output:

Some encoded content with potential malware...

Step 5: Save and Confirm

Ensure the file is saved as:

pcap_artifact5_decoded.txt

Located on theDesktopfor easy access.

Step 6: Analyze the Decoded Content

Look for:

Malware signatures

Command and control (C2) server URLs

Indicators of Compromise (IOCs)

Step 7: Document the Process

Record the following:

Original Filename:pcap_artifact5.txt

Decoded Filename:pcap_artifact5_decoded.txt

Decoding Method:Base64 (or identified method)

Contents:Brief summary of findings

To decode theCommand and Control (C2) hostfrom thepcap_artifact5.txtfile, follow these detailed steps:

Step 1: Access the File

Log into the Analyst Desktop.

Navigate to theDesktopand locate the file:

pcap_artifact5.txt

Open the file using a text editor:

OnWindows:

nginx

notepad pcap_artifact5.txt

OnLinux:

cat ~/Desktop/pcap_artifact5.txt

Step 2: Examine the File Contents

Check the contents to identify the encoding format. Typical encodings used for C2 communication include:

Base64

Hexadecimal

URL Encoding

ROT13

Example File Content (Base64 format):

nginx

aHR0cDovLzEwLjEwLjQ0LjIwMDo4MDgwL2NvbW1hbmQucGhw

Step 3: Decode the Contents

Method 1: Using PowerShell (Windows)

OpenPowerShelland decode:

powershell

$encoded = Get-Content "C:\Users\\Desktop\pcap_artifact5.txt"

[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($encoded))

This will print the decoded content directly.

Method 2: Using Linux

Usebase64 decoding:

base64 -d ~/Desktop/pcap_artifact5.txt

If the content ishexadecimal, convert it as follows:

xxd -r -p ~/Desktop/pcap_artifact5.txt

If it appearsURL encoded, use:

echo -e $(cat ~/Desktop/pcap_artifact5.txt | sed 's/%/\\x/g')

Step 4: Analyze the Decoded Output

If the output appears like a URL or an IP address, that is likely theC2 host.

Example Decoded Output:

arduino

http://10.10.44.200:8080/command.php

TheC2 hostis:

10.10.44.200

Step 5: Cross-Verify the C2 Host

OpenWiresharkand load the relevant PCAP file to cross-check the IP:

mathematica

File > Open > Desktop > Investigations > ransom.pcap

Filter for C2 traffic:

ini

ip.addr == 10.10.44.200

Validate the C2 host IP address through network traffic patterns.

Answer:

10.10.44.200

Step 6: Document the Finding

Record the following details:

Decoded C2 Host:10.10.44.200

Source File:pcap_artifact5.txt

Decoding Method:Base64 (or the identified method)

Step 7: Next Steps

Threat Mitigation:

Block the IP address10.10.44.200at the firewall.

Conduct anetwork-wide searchto identify any communications with the C2 server.

Further Analysis:

Check other PCAP files for similar traffic patterns.

Perform adeep packet inspection (DPI)to identify malicious data exfiltration.

To determine thedate the webshell was accessedfrom theinvestigation22.pcapfile, follow these detailed steps:

Step 1: Access the PCAP File

Log into the Analyst Desktop.

Navigate to theInvestigationsfolder on the desktop.

Locate the file:

investigation22.pcap

Step 2: Open the PCAP File in Wireshark

LaunchWireshark.

Open the PCAP file:

mathematica

File > Open > Desktop > Investigations > investigation22.pcap

ClickOpento load the file.

Step 3: Filter for Webshell Traffic

Since webshells typically useHTTP/Sto communicate, apply a filter:

http.request or http.response

Alternatively, if you know the IP of the compromised host (e.g.,10.10.44.200), use:

nginx

http and ip.addr == 10.10.44.200

PressEnterto apply the filter.

Step 4: Identify Webshell Activity

Look for HTTP requests that include:

Common Webshell Filenames:shell.jsp, cmd.php, backdoor.aspx, etc.

Suspicious HTTP Methods:MainlyPOSTorGET.

Right-click a suspicious packet and choose:

arduino

Follow > HTTP Stream

Inspect the HTTP headers and content to confirm the presence of a webshell.

Step 5: Extract the Access Date

Look at theHTTP request/response header.

Find theDatefield orTimestampof the packet:

Wireshark displays timestamps on the left by default.

Confirm theHTTP streamincludes commands or uploads to the webshell.

Example HTTP Stream:

POST /uploads/shell.jsp HTTP/1.1

Host: 10.10.44.200

User-Agent: Mozilla/5.0

Date: Mon, 2024-03-18 14:35:22 GMT

Step 6: Verify the Correct Date

Double-check other HTTP requests or responses related to the webshell.

Make sure thedate fieldis consistent across multiple requests to the same file.

Answer:

2024-03-18

Step 7: Document the Finding

Date of Access:2024-03-18

Filename:shell.jsp (as identified earlier)

Compromised Host:10.10.44.200

Method of Access:HTTP POST

Step 8: Next Steps

Isolate the Affected Host:

Remove the compromised server from the network.

Remove the Webshell:

rm /path/to/webshell/shell.jsp

Analyze Web Server Logs:

Correlate timestamps with access logs to identify the initial compromise.

Implement WAF Rules:

Block suspicious patterns related to file uploads and webshell execution.

To decode thetargetswithin the filepcap_artifact5.txt, follow these steps:

Step 1: Access the File

Log into the Analyst Desktop.

Navigate to theDesktopand locate the file:

pcap_artifact5.txt

Open the file using a text editor:

OnWindows:

nginx

notepad pcap_artifact5.txt

OnLinux:

cat ~/Desktop/pcap_artifact5.txt

Step 2: Examine the File Contents

Analyze the contents to identify the encoding format. Common formats include:

Base64

Hexadecimal

URL Encoding

ROT13

Example Encoded Data (Base64):

makefile

MTBjYWwuY29tL2V4YW0K

Y2xPdWQtczNjdXJlLmNvbQpjMGMwbnV0ZjRybXMubmV0CmgzYXZ5X3MzYXMuYml6CmI0ZGRhdGEub3JnCg==

Step 3: Decode the Contents

Method 1: Using PowerShell (Windows)

OpenPowerShell:

powershell

$encoded = Get-Content "C:\Users\\Desktop\pcap_artifact5.txt"

[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($encoded))

This command will display the decoded targets.

Method 2: Using Linux

Usebase64 decoding:

base64 -d ~/Desktop/pcap_artifact5.txt

If the content appears to behexadecimal, use:

xxd -r -p ~/Desktop/pcap_artifact5.txt

ForURL encoding, use:

echo -e $(cat ~/Desktop/pcap_artifact5.txt | sed 's/%/\\x/g')

Step 4: Analyze the Decoded Output

The decoded content should reveal domain names or URLs.

Check for valid domain structures, such as:

10cal.com/exam

clOud-s3cure.com

c0c0nutf4rms.net

h3avy_s3as.biz

b4ddata.org

Example Decoded Output:

10cal.com/exam

clOud-s3cure.com

c0c0nutf4rms.net

h3avy_s3as.biz

b4ddata.org

Step 5: Verify the Decoded Targets

Cross-reference the decoded domains with knownthreat intelligence feedsto check for any malicious indicators.

Use tools likeVirusTotalorURLHausto verify the domains.

10cal.com/exam

clOud-s3cure.com

c0c0nutf4rms.net

h3avy_s3as.biz

b4ddata.org

Step 6: Document the Finding

Decoded Targets:

10cal.com/exam

clOud-s3cure.com

c0c0nutf4rms.net

h3avy_s3as.biz

b4ddata.org

Source File:pcap_artifact5.txt

Decoding Method:Base64 (or the identified method)

To generate theSHA256 checksumof the file that triggeredRuleName: Suspicious PowerShellon theAccounting workstation, follow these detailed steps:

Step 1: Establish an SSH Connection

Open a terminal on your system.

Use the provided credentials to connect to theAccounting workstation:

ssh Accounting@

Replace with the actual IP address of the workstation.

Enter the password when prompted:

1x-4cc0unt1NG-x1

Step 2: Locate the Malicious File

Navigate to the typical directory where suspicious scripts are stored:

cd C:\Users\Accounting\AppData\Roaming

List the contents to identify the suspicious file:

dir

Look for a file related toPowerShell(e.g., calc.ps1), as the issue involved thecalculator opening repeatedly.

Step 3: Verify the Malicious File

To ensure it is the problematic file, check for recent modifications:

powershell

Get-ChildItem -Path "C:\Users\Accounting\AppData\Roaming" -Recurse | Where-Object { $_.LastWriteTime -ge (Get-Date).AddDays(-1) }

This will list files modified within the last 24 hours.

Check file properties:

powershell

Get-Item "C:\Users\Accounting\AppData\Roaming\calc.ps1" | Format-List *

Confirm it matches the file flagged byRuleName: Suspicious PowerShell.

Step 4: Generate the SHA256 Checksum

Method 1: Using PowerShell (Recommended)

Run the following command to generate the hash:

powershell

Get-FileHash "C:\Users\Accounting\AppData\Roaming\calc.ps1" -Algorithm SHA256

Output Example:

mathematica

Algorithm Hash Path

--------- ---- ----

SHA256 d2c7e4d9a4a8e9fbd43747ebf3fa8d9a4e1d3b8b8658c7c82e1dff9f5e3b2b4d C:\Users\Accounting\AppData\Roaming\calc.ps1

Method 2: Using certutil (Alternative)

Run the following command:

cmd

certutil -hashfile "C:\Users\Accounting\AppData\Roaming\calc.ps1" SHA256

Example Output:

SHA256 hash of calc.ps1:

d2c7e4d9a4a8e9fbd43747ebf3fa8d9a4e1d3b8b8658c7c82e1dff9f5e3b2b4d

CertUtil: -hashfile command completed successfully.

Step 5: Copy and Paste the Hash

Copy theSHA256 hashfrom the output and paste it as required.

Answer:

nginx

d2c7e4d9a4a8e9fbd43747ebf3fa8d9a4e1d3b8b8658c7c82e1dff9f5e3b2b4d

Step 6: Immediate Actions

Terminate the Malicious Process:

powershell

Stop-Process -Name "powershell" -Force

Delete the Malicious File:

powershell

Remove-Item "C:\Users\Accounting\AppData\Roaming\calc.ps1" -Force

Disable Startup Entry:

Check for any persistent scripts:

powershell

Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"

Remove any entries related to calc.ps1.

Step 7: Document the Incident

Record the following:

Filename:calc.ps1

File Path:C:\Users\Accounting\AppData\Roaming\

SHA256 Hash:d2c7e4d9a4a8e9fbd43747ebf3fa8d9a4e1d3b8b8658c7c82e1dff9f5e3b2b4d

Date of Detection:(Today’s date)