Attack Analysis and Forensic Thinking Questions

Breaking down an attack to understand its components: initial compromise method, persistence mechanism, lateral movement, data exfiltration. Understanding attacker motivations and typical attack patterns. Recognizing indicators of compromise (IoCs) in logs, network traffic, or system behavior. Thinking like an investigator: what evidence would you look for? What logs would be relevant? What artifacts would prove or disprove your hypothesis?

MediumTechnical

57 practiced

Create a SIEM detection rule (pseudo-SQL or pseudocode) to identify potential DNS tunneling using DNS query logs with fields: timestamp, client_ip, query_name, query_type, response_size, ttl. Include scoring rules (entropy, label length, number of unique subdomains per second), thresholds, and comments on tuning to reduce false positives caused by legitimate services (CDNs, analytics).

Sample Answer

**Approach (brief)** Use correlation windowing per client_ip to compute three signals (entropy of query_name labels, average label length, unique subdomains/sec) and a composite score. Alert when score exceeds threshold.

**Pseudo-SQL detection rule**

sql

-- window: 60s sliding per client_ip
WITH window AS (
  SELECT client_ip,
         collect_list(query_name) AS queries,
         count(*) AS total_q,
         avg(response_size) AS avg_resp,
         min(timestamp) AS start_ts,
         max(timestamp) AS end_ts
  FROM dns_logs
  WHERE timestamp >= now() - interval '5 minutes'
  GROUP BY client_ip, floor(extract_epoch(timestamp)/60)
)
SELECT client_ip,
       total_q,
       avg_resp,
       -- compute per-query label entropy (pseudo-function)
       avg(map(queries, q -> label_entropy(q))) AS mean_entropy,
       avg(map(queries, q -> max_label_length(q))) AS mean_label_len,
       cardinality(distinct(map(queries, q -> subdomain_without_tld(q)))) / (end_ts - start_ts) AS subdomains_per_sec,
       -- scoring weights
       (0.5 * normalize(mean_entropy, 0, 6) +
        0.3 * normalize(mean_label_len, 0, 60) +
        0.2 * normalize(subdomains_per_sec, 0, 5)
       ) AS score
FROM window
HAVING score > 0.7 OR (mean_entropy > 4.5 AND subdomains_per_sec > 1.0);

**Thresholds & rationale**- mean_entropy > 4.5 bits per label — indicates high randomness- mean_label_len > 30 chars — long encoded labels- subdomains_per_sec > 1.0 — rapid unique lookups- composite score > 0.7 triggers investigation

**Tuning to reduce false positives**- Exclude known benign domains: CDN, telemetry, analytics (maintain allowlist)- Require persistence: alert only if condition holds in 2 of 3 consecutive windows- Correlate with unusual response_size, TTL anomalies, or destination IP reputation- Whitelist internal services (split-horizon DNS) and SaaS providers after baseline monitoring- Monitor feedback and adjust normalize ranges per environment baselines

**Investigation steps**- Resolve client_ip owner, check process logs, capture full DNS packet, check upstream resolver for patterns, and block/contain if confirmed.

EasyTechnical

76 practiced

Write a Python 3 script (standard library only) that reads a CSV file of firewall logs with columns: timestamp, src_ip, dest_ip, dest_port, action. The script should stream the file (not load it entirely into memory), handle header rows and malformed lines gracefully, and print the top 5 external source IPs by number of 'DENY' actions. Include a short explanation of your approach and complexity.

Sample Answer

**Approach (brief)** I treat "external" as non-private IPv4/IPv6 (exclude RFC1918 and reserved ranges using ipaddress). I stream the CSV with the csv module, skip or detect a header, tolerate malformed lines, count 'DENY' per external src_ip using a Counter-like dict, and finally print the top 5.

**Script**

python

#!/usr/bin/env python3
import csv, sys, ipaddress
from collections import Counter

def is_external(ip_str):
    try:
        ip = ipaddress.ip_address(ip_str)
        return not (ip.is_private or ip.is_reserved or ip.is_loopback or ip.is_multicast)
    except ValueError:
        return False

def top_denies(path, top_n=5):
    counts = Counter()
    with open(path, newline='') as f:
        reader = csv.reader(f)
        for row in reader:
            # graceful handling: skip empty/malformed rows
            if not row or len(row) < 5:
                continue
            # detect header by names in first row
            if row[0].lower() == 'timestamp' and row[1].lower() == 'src_ip':
                continue
            timestamp, src_ip, dest_ip, dest_port, action = row[:5]
            if action.strip().upper() == 'DENY' and is_external(src_ip.strip()):
                counts[src_ip.strip()] += 1
    for ip, cnt in counts.most_common(top_n):
        print(f"{ip}\t{cnt}")

if __name__ == '__main__':
    if len(sys.argv) != 2:
        print("Usage: script.py firewall_logs.csv", file=sys.stderr); sys.exit(1)
    top_denies(sys.argv[1])

**Why and complexity** - Streams file line-by-line to keep memory low. - Uses ipaddress for accurate external detection. - Time: O(n) where n = lines. Space: O(k) where k = unique external DENY src IPs (usually much smaller than n).

MediumTechnical

61 practiced

Write a Python 3.8+ program (standard library only) that streams a large CSV containing firewall logs with columns: timestamp (ISO8601), src_ip, dest_ip, dest_port, bytes_sent, bytes_received. The program must compute the top 10 internal source IPs by total bytes_sent to external destinations over a rolling 24-hour window, assuming the CSV is time-sorted. Provide the algorithm description, discuss memory complexity, and include code that handles malformed rows and normalized timestamps.

Sample Answer

**Approach (brief)**- Stream CSV line-by-line (csv.reader) to avoid loading file.- For each valid row: parse timestamp (normalize to UTC), skip internal→internal traffic (assume RFC1918 internal ranges), treat dest outside as external.- Maintain per-src_ip deque of (timestamp, bytes_sent) and a running total bytes_sent per src_ip for the last 24 hours.- On ingest, push new event, then expire events older than timestamp - 24h from that src_ip, updating totals. Compute top-10 from totals dict when needed.

**Memory / Complexity**- Time: O(M log K) across M rows where K is unique active IPs (top-10 extraction can be O(K log 10)).- Memory: O(E_window) where E_window is number of events within 24 hours (worst-case all events), plus O(K) for totals. For typical networks K and E_window are much smaller than total log size.

**Code (Python 3.8+, standard library only)**

python

import csv, sys, ipaddress
from collections import deque, defaultdict
from datetime import datetime, timezone, timedelta
import heapq

WINDOW = timedelta(hours=24)

def parse_iso(ts):
    # normalize ISO8601 to UTC datetime
    try:
        if ts.endswith('Z'):
            dt = datetime.fromisoformat(ts[:-1]).replace(tzinfo=timezone.utc)
        else:
            dt = datetime.fromisoformat(ts)
            if dt.tzinfo is None:
                dt = dt.replace(tzinfo=timezone.utc)
            else:
                dt = dt.astimezone(timezone.utc)
        return dt
    except Exception:
        raise

def is_internal(ip_str):
    try:
        ip = ipaddress.ip_address(ip_str)
        return ip.is_private
    except Exception:
        return False

def stream_top10(csvfile):
    reader = csv.DictReader(csvfile)
    per_ip = defaultdict(deque)       # src_ip -> deque of (ts, bytes)
    totals = defaultdict(int)        # src_ip -> total bytes in window

    for ln, row in enumerate(reader, start=2):
        try:
            ts = parse_iso(row['timestamp'])
            src = row['src_ip'].strip()
            dst = row['dest_ip'].strip()
            b_sent = int(row.get('bytes_sent', 0))
        except Exception as e:
            print(f"Skipping malformed row {ln}: {e}", file=sys.stderr)
            continue

        # only count internal source to external destination
        if not is_internal(src) or is_internal(dst):
            continue

        dq = per_ip[src]
        dq.append((ts, b_sent))
        totals[src] += b_sent

        # expire old events for this src
        cutoff = ts - WINDOW
        while dq and dq[0][0] < cutoff:
            old_ts, old_bytes = dq.popleft()
            totals[src] -= old_bytes
        if totals[src] <= 0:
            # cleanup to control memory
            del totals[src]
            del per_ip[src]

        # optionally: print top-10 every N lines or on demand. Here print for each step:
        top10 = heapq.nlargest(10, totals.items(), key=lambda x: x[1])
        print(f"{ts.isoformat()} Top10:")
        for ip, total in top10:
            print(f"  {ip}: {total}")
        # flush if streaming to another system
        sys.stdout.flush()

if __name__ == '__main__':
    stream_top10(sys.stdin)

Notes:- Uses RFC1918/private IP detection to classify internal addresses; adjust if organization uses different ranges.- Malformed rows are skipped with stderr message.- For higher throughput, emit top-10 periodically rather than per-row, and consider sharding or approximate heavy-hitter algorithms (Count-Min, Space-Saving) if memory is constrained.

HardTechnical

62 practiced

You inherit an incident where attackers established long-term persistence using living-off-the-land binaries (LOLbins) and logging coverage is incomplete. Draft a prioritized eradication and validation plan that balances rapid containment with evidence preservation. Include hunting queries to find persistence mechanisms, steps to remove persistence at scale, validation checks across endpoints, and architectural hardening to prevent re-establishment.

Sample Answer

**Situation & goal**I inherit an active incident: attackers used LOLbins for long-term persistence and logging is incomplete. My prioritized plan balances immediate containment, evidence preservation, and full eradication.

**Prioritized eradication & validation plan**1. Triage / Containment (minutes–hours)- Isolate high-confidence infected hosts (network segmentation or host quarantine) but keep images/snapshots for forensics.- Turn on enhanced logging (Sysmon, PowerShell logging, Process Command Line) centrally before remediation where possible.2. Hunting (hours)- Broad hunting queries to find persistence artifacts (examples below).3. Targeted removal (hours–days)- Revoke suspicious credentials, disable suspected accounts, remove scheduled tasks/registry Run keys, replace binaries where tampered.- Use signed, centralized remediation (EDR live response / GPO / Intune) to remove at scale.4. Validation (days)- Re-scan endpoints, validate absence of artifacts, review network telemetry, and replay suspicious behavior against endpoint baselines.5. Hardening & prevention (weeks)- Block or constrain LOLbins, enforce AppLocker/WDAC, restrict admin rights, enable least privilege, improve telemetry, and implement allowlists.

**Hunting queries (examples)**

- Sysmon / KQL (Azure Sentinel / Defender for Endpoint)

kql

DeviceProcessEvents
| where FileName in ("bitsadmin.exe","certutil.exe","regsvr32.exe","rundll32.exe","wmic.exe","powershell.exe")
| where ProcessCommandLine contains_any ("/s","/url","/download","/encodedCommand","certutil -decode","Invoke-WebRequest","IEX")
| where Timestamp > ago(14d)

- Splunk SPL

splunk

index=main (proc_name="powershell.exe" OR proc_name="regsvr32.exe" OR proc_name="rundll32.exe")
| search (cmdline="*EncodedCommand*" OR cmdline="*-e *" OR cmdline="*IEX*")
| stats count by host, user, cmdline, _time

- Registry and Scheduled Tasks (Windows Event Logs)

kql

DeviceRegistryEvents
| where RegistryKey startswith @"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run"
or RegistryKey contains "RunOnce"

**Removal steps at scale**- Create curated playbooks: identify artifact types (Scheduled Tasks, Services, Run keys, WMI Event Consumers, DLL search order hijacks, Startup folder, persistence via scripts).- Use EDR bulk actions: - Dump and archive artifact for forensic imaging. - Disable scheduled task / service via EDR. - Remove offending registry keys and files; quarantine. - Rotate credentials and secrets (LSA secrets, service accounts).- Where EDR unavailable, push signed PowerShell scripts via SCCM/Intune with strict logging enabled.

**Validation checks**- Endpoint: verify absence of artifacts; run yara/sigs; confirm process hashes match known-good; ensure telemetry (sysmon events) show no re-creation.- Network: confirm no callbacks to C2 domains; DNS logs show no suspicious resolves.- Identity: monitor for anomalous logins; verify no new privileged accounts.- Timebox and re-scan at 24h, 72h, and 14 days.

**Architectural hardening**- Deploy Sysmon with centralized collection and 30–90 day retention; enable Audit Process Creation, CommandLine.- Enforce application control (AppLocker/WDAC) for critical hosts; allowlist approved LOLbins only with constrained arguments.- Enforce constrained endpoints for admin activity (jump hosts).- Block risky scripting at network egress and use web proxy with SSL inspection for binaries downloads.- Implement Just-In-Time and Just-Enough-Administration for elevated operations.- Regular purple-team exercises to validate detection of LOLbin techniques.

**Trade-offs & rationale**- Immediate isolation reduces spread but risks losing volatile evidence — take memory dumps and images first.- Aggressive blocking prevents re-infection but may disrupt business; use phased rollout and exceptions handled via change control.

This plan prioritizes evidence preservation, rapid containment, scalable eradication using EDR/GPO, and durable architecture changes to prevent re-establishment.

EasyTechnical

60 practiced

List five practical techniques to reduce false positives when tuning SIEM alerts for suspected data exfiltration (for example: large outbound transfers). For each technique explain how it reduces false positives and identify one potential trade-off or risk introduced by that technique.

Unlock Full Question Bank

Get access to hundreds of Attack Analysis and Forensic Thinking interview questions and detailed answers.

Join thousands of developers preparing for their dream job.