Broadcom-VMware
5V0-91.20 · Question #57
Review the following search: childproc_name:"rundll32.exe" AND -digsig_result:"Signed" AND path:c:\windows\* What is this search looking for?
The correct answer is A. Processes being launched by rundll32.exe running out of the windows directory that are not signed. See the full explanation below for the reasoning.
Question
Review the following search:
childproc_name:"rundll32.exe" AND -digsig_result:"Signed" AND path:c:\windows*
What is this search looking for?
Options
- AProcesses being launched by rundll32.exe running out of the windows directory that are not signed
- BInstances of rundll32.exe running out of the windows directory that are not signed
- CInstances of rundll32.exe running out of the windows directory that are signed
- DProcesses launching rundll32.exe running out of the windows directory that are not signed
How the community answered
(27 responses)- A85% (23)
- B4% (1)
- C4% (1)
- D7% (2)
Community Discussion
No community discussion yet for this question.