CS0-003 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Network connections (netstat)

  Why this is correct

  Active network connections enumerated via netstat are a primary indicator of remote access tools (RATs) and command-and-control communications, which often accompany lateral movement. The artifact lists both listening and established connections, allowing the hunter to correlate suspicious external IPs and ports with the specific process IDs that own them. In Velociraptor, this yields immediate, direct evidence of an attacker's current or recent remote access session.

• ✓

  Windows Event Logs for WMI activity

  Why this is correct

  WMI is a powerful remote execution channel frequently abused for lateral movement, such as through wmic process call create or Invoke-WmiMethod. The Windows Event Logs, specifically Event ID 4688 with command-line auditing and Event ID 5861, can record the creation of remote processes and the WMI activity itself. Unusual WMI process creations originating from a remote host can reveal an attacker's movement across the network before other signs appear.

• ✗

  File system for malicious executables

  Why it's wrong here

  Searching the file system for malicious executables is a common malware detection technique, but it does not directly identify lateral movement that occurs via legitimate login mechanisms or built-in administrative tools. An attacker often leverages existing binaries (e.g., PowerShell, psexec, or WMI) to move laterally, so the absence of newly dropped executables does not rule out lateral movement. While useful for post-compromise detection, it is secondary to logon events for this specific hypothesis.

• ✗

  Registry hives for persistence

  Why it's wrong here

  Registry hives are more relevant to persistence detection, such as Run or RunOnce keys that re-establish access after a reboot, rather than detecting in-progress lateral movement. Attackers may use registry modifications to survive reboots, but that is a separate stage of the attack lifecycle. While registry data can support a comprehensive hunt, it is not a direct artifact for identifying user logins or remote access patterns associated with lateral movement.

• ✓

  Security Event Logs (logon events)

  Why this is correct

  Security Event Logs containing logon events, particularly Event ID 4624, are the cornerstone of lateral movement detection because they record every successful authentication, including Type 3 (network) and Type 10 (remote interactive) logons. A threat hunter can spot anomalous patterns, such as a user account logging onto multiple hosts in rapid succession or an unexpected host originating a remote login. These events directly represent the ‘movement’ aspect, making them a primary and highly reliable artifact.

Go deeper

Related to this question