In the Powershell Hunt report, what does the filtering condition of commandLine! ="badstring " do?

The correct answer is A. Prevents command lines containing "badstring" from being displayed. In the Powershell Hunt report, the filtering condition of commandLine! ="badstring " prevents command lines containing "badstring" from being displayed. The ! operator is used to negate or exclude a condition from the search results. The * operator is used as a wildcard to…

Threat Hunting and Investigation

Question

In the Powershell Hunt report, what does the filtering condition of commandLine! ="badstring " do?

Options

APrevents command lines containing "badstring" from being displayed
BDisplays only the command lines containing "badstring"
CHighlights "badstring" in all command lines in the output
DHighlights only the command lines containing "badstring"

How the community answered

(57 responses)

A
86% (49)
B
5% (3)
C
7% (4)
D
2% (1)

Explanation

In the Powershell Hunt report, the filtering condition of commandLine! ="badstring " prevents command lines containing "badstring" from being displayed. The ! operator is used to negate or exclude a condition from the search results. The * operator is used as a wildcard to match any number of characters before or after the specified string. Therefore, commandLine! ="badstring " means to filter out any command line that has "badstring" anywhere in it. The other options are not correct, as they do not describe what the filtering condition does.

Topics

#PowerShell Hunt report#command line filtering#query syntax

Community Discussion

No community discussion yet for this question.

Full CCFH-202B Practice