PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #85
You have a close relationship with a vendor who reveals to you privately that they have discovered a vulnerability in their web application that can be exploited in an XSS attack. This application is
The correct answer is A. Create a YARA-L 2.0 rule to detect a time-ordered series of events where an external inbound. The correct approach is to create a YARA-L 2.0 rule that detects a sequence of events where an external inbound connection to a server is followed by a process spawning previously unseen subprocesses. This behavior-based detection can identify potential exploitation of the XSS vu
Question
You have a close relationship with a vendor who reveals to you privately that they have discovered a vulnerability in their web application that can be exploited in an XSS attack. This application is running on servers in the cloud and on-premises. Before the CVE is released, you want to look for signs of the vulnerability being exploited in your environment. What should you do?
Options
- ACreate a YARA-L 2.0 rule to detect a time-ordered series of events where an external inbound
- BCreate a YARA-L 2.0 rule to detect high-prevalence binaries on your web server architecture
- CAsk the Gemini Agent in Google Security Operations (SecOps) to search for the latest
- DActivate a new Web Security Scanner scan in Security Command Center (SCC), and look for
How the community answered
(36 responses)- A72% (26)
- B17% (6)
- C8% (3)
- D3% (1)
Explanation
The correct approach is to create a YARA-L 2.0 rule that detects a sequence of events where an external inbound connection to a server is followed by a process spawning previously unseen subprocesses. This behavior-based detection can identify potential exploitation of the XSS vulnerability in your environment before a CVE is publicly released, without relying on signatures or external threat intelligence.
Topics
Community Discussion
No community discussion yet for this question.