Palo_Alto_Networks
XSIAM-ANALYST · Question #41
An alert involves credential dumping. Reviewing the causality chain, you notice the following: - lsass.exe is accessed by powershell.exe - Prior to this, cmd.exe launched the PowerShell script What…
Sign in or unlock XSIAM-ANALYST to reveal the answer and full explanation for question #41. The question stem and answer options stay visible for context.
Incident Investigation and Response
Question
An alert involves credential dumping. Reviewing the causality chain, you notice the following:
- lsass.exe is accessed by powershell.exe
- Prior to this, cmd.exe launched the PowerShell script
What can you infer?
Options
- AScripted behavior likely launched manually
- BThere is an indicator of defense evasion
- CPossible credential access tactic
- DIt's a known benign service activity
Unlock XSIAM-ANALYST to see the answer
You've previewed enough free XSIAM-ANALYST questions. Unlock XSIAM-ANALYST for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#credential dumping#causality chain#defense evasion#MITRE ATT&CK