8A: Avoid Detection

Question 1

General term for the collected protocols, policies, and hardware that authenticate and authorize access to a network at the device level.

Answer 1

NAC

Question 2

Attack where the threat actor makes an independent connection between two victims and is able to read and possibly modify traffic (AKA mitm attack).

Answer 2

on-path attack

Question 3

Exploit techniques that use standard system tools and packages to perform intrusions.

Answer 3

living-off-the-land (LoTL)

Question 4

4 LoTL tools

Answer 4

1. Powershell
2. WMI
3. VBScript
4. mimikatz

Question 5

Method to clear logs using Meterpreter.

Answer 5

clearev

Question 6

Method to clear logs in Windows CLI.

Answer 6

wevtutil

Question 7

Method to clear logs in Linux.

Answer 7

echo “” > /var/log/syslog

Question 8

A tool in Metasploit that allows you to delete or modify timestamp-related information on files.

Answer 8

TimeStomp

Question 9

A method of covering your tracks by setting the command history to zero before executing the commands in a Bash shell.

Answer 9

export HISTSIZE=0