CALDERA

Prompts and answers

• What is the name of the agent that has the capability to communicate via HTTP, GitHub GIST, or DNS tunnelling?
  Sandcat
• What functionality determines the order of abilities' execution?
  planner
• What is the name of the plugin that allows the simulation of human activity?
  Human
• What is the default IP value shown during the configuration of an agent?
  0.0.0.0
• How many abilities are included in the Enumeration profile?
  5
• What is the command executed by the tasklist Process Enumeration ability?
  tasklist /m >> $env:APPDATA\vmtool.log;cat $env:APPDATA\vmtool.log
• Based on the executed operation, what is the name of the ability that did not provide an output?
  SysInternals PSTool Process Discovery
• What is the name of the file downloaded by the first ability?
  PhishingAttachment.xlsm
• What is the name of the new process spawned by the second ability?
  notepad.exe
• How many accounts were identified by the fourth ability?
  4
• What is the name of the directory archived by the fifth ability?
  Downloads
• How many HTTP requests were made by the sixth ability?
  23
• What is the value of the ParentImage from the first log generated by any ability?
  C:\Users\Public\chrome.exe
• What is the name of the ability that generated a Sysmon Event ID 13?
  Winlogon HKLM Shell Key Persistence - PowerShell
• During the execution of the first ability, what is the title of the Sigma rule that flagged the usage of Invoke-WebRequest?
  PowerShell Web Download
• During the execution of the fifth ability, what is the value of the Match Strings field in Zip A Folder With PowerShell For Staging In Temp detection?
  'Compress-Archive ' in CommandLine, ' -Path ' in CommandLine, ' -DestinationPath ' in CommandLine, $env:TEMP\ in CommandLine
• During the execution of the sixth ability, what is the title of the Sigma rule that flagged the usage of the string 'join \'\'; $split'?
  Hacktool - CrackMapExec PowerShell Obfuscation
• How many instances of the Find unauthorized processes ability have failed during its first batch of execution?
  3
• Upon checking the Find unauthorized processes ability results, what is the name of the fact that returned a value aside from remote.port.unauthorized?
  host.pid.unauthorized
• What is the group value of the new firewall rule created by Enable Outbound TCP/UDP firewall rule ability?
  Caldira
• Aside from Enable Outbound TCP/UDP firewall rule, what is the name of another response ability that was executed after detecting the suspicious process?
  Kill rogue process
• What is the name of the PowerShell cmdlet executed by the ability referred to in Q4?
  Stop-Process
• Aside from the ps1 file, what is the name of the file created by the execution of "Download Macro-Enabled Phishing Attachment"? (Provide the TargetFilename value.)
  C:\Users\Administrator\AppData\Local\Temp\2\PhishingAttachment.xlsm
• What is the MatchString value of the Sigma rule that flagged the execution of Create a Process using obfuscated Win32_Process?
  \WmiPrvSE.exe in ParentImage
• What is the name of the service created by Execute a Command as a Service?
  ARTService
• Aside from the ps1 file, what is the name of the file created by the execution of "Powershell Cmdlet Scheduled Task"? (Provide the TargetFilename value)
  C:\Windows\System32\Tasks\AtomicTask
• Aside from the PowerShell detections, what is the name of the Sigma rule that flagged the execution of Create a new user in a command prompt?
  New User Created Via Net.EXE
• What is the name of the Sigma rule that flagged the execution of Clear Logs?
  Suspicious Eventlog Clear or Configuration Change
• What command is used by FIle and Directory Discovery (PowerShell) during its execution?
  ls -recurse; get-childitem -recurse; gci -recurse
• How many times did the Find files ability execute?
  3