Câu 30: SPLK-5002: Splunk Certified Cybersecurity Defense Engineer

Based on a recent red team exercise, an organization is highly concerned about pass the hash attacks especially including tools like Empire. Which EventСode associated to PowerShell Script Block Logging would be used to detect this activity?

1. A. EventCode=4126
2. B. EventCode=4168
3. C. EventCode=4624
4. D. EventCode=4104 — đáp án hiện tại