300-220 CBRTHD: Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity

By Cisco · Question Mode

QuestionQ25

Threat Hunting Techniques

Refer to the exhibit.

Question Image

A SOC team is investigating an endpoint after observing suspicious communications with a malicious IP address. During the investigation, the team reviews the host's running processes.

On which element should the team focus next to continue the investigation?

Explanation

A calc.exe process launched by svchost.exe hosting the Schedule service is an anomalous parent-child process relationship. svchost.exe normally hosts Windows services; it should not ordinarily start Calculator, so this process execution may indicate abuse of the scheduled-task service or malicious execution.

Community Discussion

No comments yet. Be the first to start the discussion!