What does the following search do?

The correct answer is D. Displays a list of processes and their parent processes. The search filters on EventCode=4688 (Windows event for process creation) and then uses stats count, values(process) by parent_process_name. This produces a list of processes (child processes) along with their parent processes, showing how many times each parent process created…

Advanced Threat Hunting and Analytics

Question

Options

ADisplays a list of newly created processes and the user that created them.
BDisplays a count of processes created by the same user.
CDisplays a count of processes created by the same child process.
DDisplays a list of processes and their parent processes.

How the community answered

(43 responses)

A
5% (2)
B
12% (5)
C
2% (1)
D
81% (35)

Explanation

The search filters on EventCode=4688 (Windows event for process creation) and then uses stats count, values(process) by parent_process_name. This produces a list of processes (child processes) along with their parent processes, showing how many times each parent process created child processes.

Topics

#process analysis#parent-child process#SPL search#process tree

Community Discussion

No community discussion yet for this question.

Full SPLK-5002 Practice