Exam PT0-001 topic 1 question 132 discussion

I would go with B. Out of all the options this one would be the easiest to spot, especially if there is a user creation process in place.

Answer B

cccccccccc

looks good to me

Its got to be B. My company has systems in place so that ANY new domain user account created is alarmed and reviewed. The "Known" password part just means the hacker knows the password. Anyone saying "But sir, Local Account". The answer specifically states new *domain* user. Not a good question, but B is by far the easiest to detect with alerts in place.

Remeber its not saying Domain Admin, instead it says Domain User. Meaning any account with any level of privilege's. Identifying this would be difficult, especially if his shell on a target host hasnt been detected yet, pointing towards a weak blue team. With that said id say the answer is Modifying a "KNOWN" boot time service. As this is probably the only thing they would be aware of.

I can see B, youre jacking with a DC if you're creating a new domain account. Likely the security team will have alerts set up on a DC to watch for new user accounts. Unless the security team has finely tuned tools, they wont capture a local machine having a modification, especially if the pentester is using an admin account. DC logs are harder to erase and easier to see than local machine

My 2cents: Is not A for sure. Is not B because that would be stupid, think about it what is the difference between creating a new domain user with a known password vs. creating a new domain user with an unknown password???? Is not D because that makes you thing about some sort of bruteforce but you are already in, so the most that is valid to me would be C. B. would be valid if it was like "Create a new domain user"

Hello guys! A friend of mine told me that the correct answer was D, and yes, I know, I was TF?! And he told me that you can easily detect them with a simple script, this is one of the software that he has used in the past. https://logrhythm.com/blog/clear-text-passwords-use-case/ "Using a simple Analyze query on NetMon, you can detect clear text passwords sent over HTTP." What are your thoughts?

B. Creation of a new user account is a tried-and-true method for retaining access to a system. In well-managed and monitored environments, adding an account is likely to be caught and result in an alarm, but in many environments creation of a local user account on a system may allow ongoing access to the system, device, or application.

Question: MOST easily ***detected*** Scripting a callback (reverse shell) on reboot would be detectable through network monitoring, most SIEMs when checking for unusual but repeated outbound network connection (splunk / elk etc)

I was tending to option C but I think B is correct. C may be detectable by an AV suite, but maybe not and the use of 'boot time' would probably suggest that they want you to think root kit. Which they want you to think is difficult to detect. Option B can be spotted by good procedures and not rely on technology.

None of these are great answers. If the domain had 10 people, definitively B. In a domain with thousands of users, it would be hard to track this down unless some sort of alert was generated when a new user was created. If you just create a Steve Smith and dump him in an OU with 200 people, no one will know. C seems like the more obvious choice but maybe that was intentional to be misleading. I have no answer, merely conjecture.

Answer A. This is the most easy way because you can prevent it by applying the last patches of the system.