Interview Q&A — Technical Depth

Phases 02–07: Binary formats, OPSEC hygiene, OS internals, privilege escalation, Active Directory, Kerberos, process injection, EDR internals, and detection engineering.

Full answers for each question are provided in the WARMUP.md of each referenced phase. This file contains the questions plus condensed principal-level answer outlines for rapid review.

Tooling (Phase 02)

Q: What is imphash, how is it computed, and where on the Pyramid of Pain does it sit?

Outline: MD5 of normalized (dll_no_ext.func_lower) list, joined by commas. Sits at Hash layer — bottom of pyramid. Trivially changed by adding one dummy import + recompile. Useful for family classification in DFIR triage, not as a durable production detection. Durable detection is at TTP level: API call sequence via ETW-TI.

Q: What OPSEC indicators does a compiled tool leave by default? Name three and their detection.

Outline: (1) PDB path — pefile/strings; (2) Default named pipe (MSSE-*) — Sysmon EID 17; (3) Compilation timestamp (TimeDateStamp not zeroed) — dumpbin /headers. Each is a bottom- to-mid pyramid IOC. The durable detection is still behavioral (ETW-TI alloc/write sequence).

OS Internals: Windows (Phase 04)

Q: Walk me through the Windows access-token model. What is a SID, a privilege, and how does an object's DACL get checked?

Outline: Process has primary token: user SID + group SIDs + privilege table. Object has DACL (ordered ACEs). Access check = SeAccessCheck(token, DACL, requested_mask) — DENY before ALLOW, all SIDs in token checked. SID = identity; privilege = capability flag (orthogonal). Escalation usually abuses a privilege (SeImpersonatePrivilege) not an identity.

Q: Why is UAC not a security boundary?

Outline: Microsoft formally documented: UAC is a "convenience prompt," not a security boundary. Bypasses are not patched as security vulnerabilities. Admin-split-token user is one auto-elevation or user-approval away from High-IL, then from SYSTEM. Do not treat Medium-IL admin as a wall.

Q: Explain the SeImpersonatePrivilege potato family — privilege, why service accounts have it, the escalation, and the detection.

Outline: Privilege = right to impersonate a token handed to you. Service accounts get it so they can act as connecting users (IIS/SQL legitimate use). Potato family: coerce a SYSTEM-bearing process to authenticate to attacker-controlled pipe/COM → ImpersonateNamedPipeClient → SYSTEM token → CreateProcessWithTokenW. Detection: Security EID 4673 (privilege use in unexpected context), Sysmon EID 1 (service process spawning interactive shell).

OS Internals: Linux (Phase 04)

Q: What is the difference between SUID and cap_setuid? Why enumerate both?

Outline: SUID = mode bit → kernel sets euid = file_owner_uid on execve. cap_setuid = xattr capability → process can call setuid(0). Both produce euid=0. find -perm -4000 only finds SUID; getcap -r / finds capabilities. Miss either command → miss that entire escalation class. Separate commands, separate findings.

Active Directory (Phase 05)

Q: Explain Kerberoasting — what it is, the API sequence, the detection.

Outline: Kerberoasting (T1558.003): any authenticated domain user can request a TGS (Ticket Granting Service ticket) for any account with an SPN. The TGS is encrypted with the account's NT hash. Attacker requests TGS → extracts from memory → cracks offline → recovers plaintext password. API: KerberosRequestService → CCache.dump. Detection: Security EID 4769 with EncryptionType = 0x17 (RC4-HMAC, weak — preferred by Kerberoasting tools) from an unusual user or high volume. Hardening: use AES-only (msDS-SupportedEncryptionTypes) + long random passwords on service accounts + detect via 4769 volume anomaly.

Q: What is the difference between unconstrained, constrained, and resource-based constrained delegation? Why is unconstrained most dangerous?

Outline:

  • Unconstrained (TrustedForDelegation): computer/account can impersonate any user to any service. If attacker controls or compromises this computer, they can steal any user's TGT that authenticates to it. Most dangerous: leads to domain admin if a DA TGT is captured.
  • Constrained (TrustedToAuthForDelegation): S4U2Self + S4U2Proxy allow impersonation to a specific list of target SPNs only. Safer but if AllowedToDelegateTo includes a DC service (cifs/dc01), it is still a domain admin path.
  • RBCD (Resource-Based Constrained Delegation): the target resource controls who can delegate to it via msDS-AllowedToActOnBehalfOfOtherIdentity. If an attacker can write that attribute (via GenericWrite on the computer object), they can add their own computer account and forge S4U2Proxy tickets to impersonate domain admin on the target.

Detection: Security EID 4769 with unusual service name + user combination for delegation abuse. BloodHound-style path finding surfaces delegation relationships as attack edges.

Injection & EDR (Phases 06–07)

Q: Walk me through remote thread injection — API sequence, sensors, detection.

Outline: OpenProcess (Sysmon EID 10 on handle open with PROCESS_VM_WRITE mask) → VirtualAllocEx (ETW-TI ALLOCATE_VIRTUAL_MEMORY) → WriteProcessMemory (ETW-TI WRITE_VIRTUAL_MEMORY) → CreateRemoteThread (Sysmon EID 8). Detection: Sigma rule on CreateRemoteThread where SourceImage starts with C:\Users\ and TargetImage is a system process.

Q: Explain ETW vs ETW-TI. If an attacker patches EtwEventWrite, what goes blind, what survives?

Outline: User-mode ETW (CLR, DNS, PowerShell) is patchable in-process: patch EtwEventWrite in the process's ntdll.dll copy → that process's user-mode providers go silent. ETW-TI (Microsoft-Windows-Threat-Intelligence) is kernel-emitted: fires inside the kernel system-call implementation before returning to user mode. User-mode EtwEventWrite patch does not reach kernel callbacks. ETW-TI alloc/write/map events survive. The patch itself is observable: RWX write to ntdll.dll .text section. Detection: ETW-TI for the patch attempt (memory write to system DLL) + user-mode provider silence correlation.

Q: Walk me from a telemetry gap to a closed gap: missing data source → Sysmon config change → Sigma rule → verification.

Outline: (1) Run Lab 01 (EDR telemetry gap analyzer) with actual sensor inventory → partial or blind for a target technique. (2) Identify the missing data source (e.g., sysmon_eid_8 not configured). (3) Add CreateRemoteThread rule to Sysmon config XML; reload (Sysmon.exe -c config.xml). (4) Write Sigma rule on logsource: category: create_remote_thread, detection keyed on SourceImage anomaly. (5) Convert Sigma rule to the SIEM format. (6) Run a benign Atomic Red Team test for T1055.003; verify Sysmon EID 8 appears and the rule fires. (7) Run normal activity; verify no false positives. Before state: partial coverage. After: covered.