Câu 23: CCFH-202B: CrowdStrike Certified Falcon Hunter
You are investigating detections around network reconnaissance activity including multiple commands executed by cmd.exe and need to identify the root cause. How can you quickly verify if these commands are the result of an exploited vulnerability?
Nội dung câu hỏi
You are investigating detections around network reconnaissance activity including multiple commands executed by cmd.exe and need to identify the root cause. How can you quickly verify if these commands are the result of an exploited vulnerability?
Các lựa chọn
Đáp án được giữ gọn theo nhãn A, B, C, D trong phần bình chọn tương tác.
- A. Check the process tree and all parent processes to see how cmd.exe was launched — đáp án hiện tại
- B. Contain the host and see if more commands are being issued by this process
- C. Compare the utilized commands in cmd.exe to other commands used by admins of this organization
Cộng đồng
0 bình luận công khai. Tên thành viên được ẩn một phần.
Chưa có bình luận. Mở giao diện tương tác để bắt đầu thảo luận.