An alert involves credential dumping. Reviewing the causality chain, you notice the following: - lsass.exe is accessed by powershell.exe - Prior to this, cmd.exe launched the PowerShell script What…

Question

Options

• AScripted behavior likely launched manually
• BThere is an indicator of defense evasion
• CPossible credential access tactic
• DIt's a known benign service activity

• A
  28% (9)
• B
  56% (18)
• D
  16% (5)

Explanation

Accessing lsass.exe via PowerShell directly maps to MITRE ATT&CK's Credential Access tactic (T1003 - OS Credential Dumping), confirming C. The cmd.exe → powershell.exe → lsass.exe chain is a classic Living Off the Land (LOLBin) pattern - attackers use built-in Windows tools to blend in and evade security controls - confirming B (Defense Evasion). Together, the chain shows an attacker scripted credential theft while disguising it as normal Windows activity.

Why A is wrong: While cmd.exe launching PowerShell could suggest manual execution, you cannot reliably infer "manual" from this chain alone - it could equally be an automated dropper or scheduled task; more importantly, "scripted + manual" isn't the key security inference here.

Why D is wrong: Legitimate services do not access lsass.exe through a cmd.exe → PowerShell chain; this process lineage is a well-known red flag, not benign behavior.

Memory tip: Lock in "lsass = Credential Access, LOLBin chain = Defense Evasion" - whenever you see lsass accessed by a scripting engine (PowerShell, WScript, etc.) spawned from cmd.exe, your mental shorthand should be "steal creds, hide in plain sight" = C + B.

No community discussion yet for this question.