Reference no: EM133520977

Question 1. Please do some research towards the "BITS Job" persistence technique. Please answer the following questions

1. Define what does BITS Job stands for and how does it work?
2. Please name at least five different Threat Actors who have used "BITS Job" as persistent Technique.
3. To detect "BITS Job" what are the different data source available?
4. Please list the mitigations for "BITS Job" Persistent attack technique.

Question 2. Team with access to EDR, SIEM, can you detect the following activity in the environment?

1. DNS Query towards tor browser traffic.
2. Network Connection activity towards hostile countries like Iran, China.
3. Possible Data Exfiltration using DNS Tunneling

Question 3. Threat actors commonly dump the LSASS process with the help of utilities such as Procdump and Task Manager. Please share the sigma rules to detect the below techniques:

1. Suspicious Use of Procdump on LSASS
2. LSASS credentials dump via Task Manager (file)
3. LSASS Memory Dump
4. Accessing of LSASS by Mimikatz: