[Solved] In a threat hunting tool, what is the expected output of this query?search event where process_name = 'cmd.exe' and command_line contains 'net user' | Cybersecurity

Cybersecurity - Advanced Threat Protection

In a threat hunting tool, what is the expected output of this query?
search event where process_name = 'cmd.exe' and command_line contains 'net user'

AAll network traffic logs

BSystem reboot events

CList of command prompt executions involving user account commands

DFailed login attempts

Step-by-Step Solution

Solution:

Step 1: Analyze query filters
The query looks for events where the process is 'cmd.exe' and the command line includes 'net user'.
Step 2: Understand what 'net user' commands do
'net user' is used to manage user accounts, so the output lists such command prompt executions.
Final Answer:
List of command prompt executions involving user account commands -> Option C
Quick Check:
Query filters = cmd.exe running net user commands [OK]

Quick Trick: Filter commands by process and command line content [OK]

Common Mistakes:

MISTAKES

Confusing process name with network traffic
Assuming query returns unrelated events
Ignoring the 'contains' keyword meaning

Master "Advanced Threat Protection" in Cybersecurity

9 interactive learning modes - each teaches the same concept differently

Learn Why Deep Visual Try Challenge Project Recall Time

More Cybersecurity Quizzes

In a threat hunting tool, what is the expected output of this query?

Step 1: Analyze query filters

Step 2: Understand what 'net user' commands do

Final Answer:

Quick Check:

Want More Practice?