312-39V2: Certified SOC Analyst v2Demo

By ECCouncil · Question Mode

QuestionQ142

Log Management

John, a SOC analyst, wants to monitor attempts at process-creation activity across any Windows endpoints. Which of the following Splunk queries will help him retrieve related process-creation logs?

  • A index=windows LogName=Security EventCode=4678 NOT (Account_Name=*$) .. .. ..
  • B index=windows LogName=Security EventCode =5688 NOT (Account_Name=*$).. .. ..
  • C index=windows LogName=Security EventCode =4688 NOT (Account_Name=*$).. .. ..
  • D index=windows LogName=Security EventCode =3688 NOT (Account_Name=*$).. .. ..
Explanation

Windows Security event ID 4688 records that a new process has been created. Filtering the Windows Security log for EventCode 4688 retrieves process-creation audit events; excluding account names ending in $ omits computer accounts. Microsoft Learn: 4688(S) A new process has been created

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!