Perform threat hunting →hardMultiple ChoiceObjective-mapped

SC-200 Perform threat hunting Practice Question

Your organization uses Microsoft Sentinel with the Microsoft 365 Defender connector. You are hunting for a threat that uses 'process hollowing' to evade detection. Which advanced hunting query in Microsoft Defender for Endpoint would be most effective?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

DeviceProcessEvents | where InitiatingProcessFileName != ImageFileName | where ParentProcessFileName != ImageFileName

Process hollowing often involves a child process with a different parent image; DeviceProcessEvents can show such anomalies. Option B is wrong because it looks for specific image names. Option C is wrong because file events are less direct. Option D is wrong because it waits for alerts.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
DeviceProcessEvents | where InitiatingProcessFileName != ImageFileName | where ParentProcessFileName != ImageFileName
Why this is correct
Process hollowing typically involves a process where the original image is replaced; this query finds mismatches between initiating, parent, and image file names.
✗
DeviceProcessEvents | where FileName in~ ('rundll32.exe', 'regsvr32.exe', 'mshta.exe')
Why it's wrong here
These are common LOLBins but not specific to process hollowing.
✗
DeviceFileEvents | where FileName contains 'hollow'
Why it's wrong here
No standard file naming includes 'hollow'.
✗
AlertInfo | where Title contains 'Process hollowing'
Why it's wrong here
This relies on pre-built detections; hunting is proactive beyond alerts.

Go deeper

SC-200 Perform threat hunting Practice Question

Why each option matters

Option-by-option breakdown

Related to this question