Cisco 300-215 - Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

The correct next step in analyzing the malicious nature of the email is to evaluate the artifacts in Cisco Secure Malware Analytics (formerly Threat Grid). This tool provides a comprehensive sandbox environment where behavioral indicators like file execution, registry access, and domain connections are logged and scored.

The exhibit shows:

Remote PowerShell execution

Executable download from a flagged domain

SHA256 hash linked to malware

All these artifacts, as labeled in the Secure Malware Analytics output, are key indicators of compromise, and analyzing them further can confirm whether the email was part of a malicious campaign.

Thus, the best action is:

A. Evaluate the artifacts in Cisco Secure Malware Analytics.

The most relevant log for system-level events such as memory exhaustion and shutdown is /var/log/messages.log, which contains kernel and service-level logs including OOM (Out-Of-Memory) events.

As detailed in Linux investigations:

"Logs located in /var/log/messages provide critical system error reporting including shutdowns, memory errors, and service failures".

The goal of an incident response plan (IRP) is to provide structured procedures for responding to cybersecurity incidents in a way that limits damage, contains the threat, and ensures business continuity. As outlined in the NIST SP 800-61 and Cisco CyberOps Associate study guide, containment and minimizing the impact of incidents is the primary goal of an IRP.

—

YARA rules are pattern-matching rules used to identify malware based on specific strings, conditions, and binary patterns. They are most effective in memory or file scans where analysts search for known indicators or unique signatures via string matching.

Correct answer: C. string matching.

When Web Application Firewalls (WAFs) are configured to block specific patterns (like ${), attackers may bypass this using URL encoding (e.g., %24%7B). In such cases, the WAF must decode these patterns before applying matching rules. Enabling URL decoding ensures the WAF recognizes encoded payloads and applies protections appropriately. This is a recommended hardening strategy against bypass techniques for command injection and remote code execution.

The STIX intelligence feed in the exhibit identifies specific malicious domains, such as:

fightcovid19.shop

nocovid19.shop

stopcovid19.shop

These are categorized as “Malicious FQDN Indicator.” The recommended cybersecurity actions when such threat intelligence is received are:

D. Block network access to identified domains: This directly prevents users or systems from communicating with known malicious infrastructure and is a critical first step in threat mitigation.

B. Add a SIEM rule to alert on connections to identified domains: This ensures that any attempted communication with these domains is flagged for immediate review and action, enabling real-time threat detection and incident response.

Blocking all .shop domains (Option A or C) would be overbroad and potentially disruptive, as many legitimate websites also use that TLD. Option E (routing to block hole) could be valid as a DNS strategy, but B and D represent the most actionable and precise responses per standard incident response practices.

Process Explorer is an advanced Windows-based utility that shows real-time data about running processes, CPU usage, services, DLLs, and handles. It is specifically designed for this kind of investigation and is part of the Sysinternals Suite.

According to the CyberOps Technologies (CBRFIR) 300-215 study guide curriculum, command-and-control (C2) communication is a strong indicator that a system has already been compromised and is actively under the control of an attacker. Sudden outbound traffic to high-risk regions and resolution of known malicious domains are high-confidence signs of an active threat. Therefore, prioritizing detection and disruption of this outbound traffic is critical to prevent further damage or data exfiltration.

While monitoring vulnerability exploitation (B) and gathering port scan data (D) are also valuable, they are more preventive or forensic in nature. The most immediate threat—and therefore the top priority—is stopping active C2 communications.

The PowerShell cmdlet Get-Content reads content line-by-line from a file and is commonly used for processing logs or large text files. When combined with Select-String, it can search for specific patterns (such as "ERROR" or "SUCCESS") within those lines and return a collection of matching objects, including metadata like line number and line content.

Option D uses:

Get-Content –Path: Correct syntax to read the log file from a UNC path.

Select-String “ERROR”, “SUCCESS”: Searches for these terms in each line and returns matching lines as structured output.

The other options (A, B, C) use non-existent or incorrect cmdlets/parameters such as Get-Content-Folder, –ifmatch, –Directory, which are invalid in PowerShell.