GIAC Certified Incident Handler

A security team is actively monitoring windows event IDs 4634, 4688, and 4697. Which persistence mechanism will they detect with this approach?

Which RITA threat hunting functionality is used to identify C2 activity specific to Meterpreter?

What tcpdump parameter was used to produce the output on lines 2 and 3 shown below?

Which netcat command will listen on port 2222 for connections from a remote system (10.0.0.1)?

Which system is an attacker targeting by running the following command? PS > Invoke-MSOLSpray -UserList ./users.txt -Password Clippers22