312-39V2: Certified SOC Analyst v2

By ECCouncil · Question Mode

QuestionQ142

VerifiedLog Management

John, a SOC analyst, wants to monitor attempts at process-creation activity across any Windows endpoints. Which of the following Splunk queries will help him retrieve related process-creation logs?

Explanation

Windows Security event ID 4688 records that a new process has been created. Filtering the Windows Security log for EventCode 4688 retrieves process-creation audit events; excluding account names ending in $ omits computer accounts. Microsoft Learn: 4688(S) A new process has been created

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!