CYSA+ 003 Lab Notes
What is a good indicator that someone is attempting a port scan on your network? - ANS-When
logs indicate attempts to scan 3 or more ports at once
What does nmap -r do? - ANS-Sets nmap to scan ports in numerical order
What does nmap -T2 do? - ANS-Sets nmap to scan ports in serial rather than parallel
(synchronously)
What are the two components of an IoC? - ANS-Observable (fact) and indicator (theory)
What does netstat -n do? - ANS-Displays addresses and port numbers in numerical order
What does netstat -o do? - ANS-Displays Process ID
What does netstat -p do? - ANS-Limits display of protocol to specified, e.g tcp
What does tasklist /FI do? - ANS-Filters input. Sample command is "PID eq 4"
How do you filter by net stat protocol in windows? - ANS---protocol = inet
What is a good indicator that someone is attempting a port scan on your network? - ANS-When
logs indicate attempts to scan 3 or more ports at once
What does nmap -r do? - ANS-Sets nmap to scan ports in numerical order
What does nmap -T2 do? - ANS-Sets nmap to scan ports in serial rather than parallel
(synchronously)
What are the two components of an IoC? - ANS-Observable (fact) and indicator (theory)
What does netstat -n do? - ANS-Displays addresses and port numbers in numerical order
What does netstat -o do? - ANS-Displays Process ID
What does netstat -p do? - ANS-Limits display of protocol to specified, e.g tcp
What does tasklist /FI do? - ANS-Filters input. Sample command is "PID eq 4"
How do you filter by net stat protocol in windows? - ANS---protocol = inet