Which of the following is a suspicious process behavior?

The correct answer is D. Non-network processes (eg, notepad exe) making an outbound network connection. Non-network processes are processes that are not expected to communicate over the network, such as notepad.exe. If they make an outbound network connection, it could indicate that they are compromised or maliciously used by an adversary. PowerShell running an execution policy…

Threat Detection and Analysis

Question

Options

APowerShell running an execution policy of RemoteSigned
BAn Internet browser (eg, Internet Explorer) performing multiple DNS requests
CPowerShell launching a PowerShell script
DNon-network processes (eg, notepad exe) making an outbound network connection

How the community answered

(42 responses)

A
5% (2)
B
10% (4)
C
2% (1)
D
83% (35)

Explanation

Non-network processes are processes that are not expected to communicate over the network, such as notepad.exe. If they make an outbound network connection, it could indicate that they are compromised or maliciously used by an adversary. PowerShell running an execution policy of RemoteSigned is a default setting that allows local scripts to run without digital signatures. An Internet browser performing multiple DNS requests is a normal behavior for web browsing. PowerShell launching a PowerShell script is also a common behavior for legitimate tasks.

Topics

#suspicious process behavior#non-network processes#outbound connections#behavioral analysis

Community Discussion

No community discussion yet for this question.

Full CCFH-202B Practice