PSAP Practice Questions - TCM Practical SOC Analyst Professional Exam

Access More Questions

During an investigation, an analyst observes a Windows process with a parent of 'svchost.exe' spawning 'cmd.exe' which in turn executes 'whoami.exe'. Which MITRE ATT&CK technique does this process tree most strongly suggest?

T1059.003 — Windows Command Shell T1055 — Process Injection T1543.003 — Windows Service T1078 — Valid Accounts

Correct Answer:

T1059.003 — Windows Command Shell

Access more questions from this quiz

Continue to PSAP Practice Questions - TCM Practical SOC Analyst Professional Exam for more practice questions and the full quiz experience.

Access More Questions