Review the following EDR query: (parent_name:powershell.exe OR parent_name:cmd.exe) AND netconn_co_nt [] TO *] Which process would show in the query results?

Question

Options

• AProcesses invoked by Powershell.exe and cmd.exe with a single network connection event
• BProcesses invoking Powershell.exe and cmd.exe with multiple network connection events
• CProcesses invoked by Powershell.exe or cmd.exe with any number of network connection events
• DProcesses invoking Powershell.exe or cmd.exe with multiple network connection events

• A
  81% (54)
• B
  9% (6)
• C
  3% (2)
• D
  7% (5)

No community discussion yet for this question.