Câu 16: SPLK-5001: Splunk Certified Cybersecurity Defense Analyst

During their shift, an analyst receives an alert about an executable being run from C:\Windows\Temp. Why should this be investigated further?

1. A. Temp directories aren’t owned by any particular user, making it difficult to track the process owner when files are executed.
2. B. Temp directories are flagged as non-executable, meaning that no files stored within can be executed, and this executable was run from that directory.
3. C. Temp directories contain the system page file and the virtual memory file, meaning the attacker can use their malware to read the in memory values of running programs.
4. D. Temp directories are world writable thus allowing attackers a place to drop, stage, and execute malware on a system without needing to worry about file permissions. — đáp án hiện tại