CAS-004 Practice Question: A threat hunter wants to identify potential…

Correct answer & explanation

Windows Event ID 4624 (Logon) from domain controllers records successful authentication events, which can indicate lateral movement when an account logs into multiple systems. Event ID 4648 (Logon with explicit credentials) shows when credentials are used explicitly to connect to another system, a common lateral movement technique. Event ID 5140 (File share accessed) logs access to file shares, often used for data staging or tool transfer during lateral movement. DNS query logs primarily show domain name resolution requests. While unusual DNS queries might indicate command-and-control or data exfiltration, they are less directly indicative of lateral movement between hosts because lateral movement typically involves authentication or resource access events rather than DNS lookups. Therefore, DNS query logs are the least useful data source for identifying lateral movement.