SPLK-5001
Full exam simulation
Threat Hunting
You are hunting for living-off-the-land binary (LOLBin) abuse on Windows endpoints. You have Sysmon EventCode 1 process creation logs. Which search best surfaces suspicious use of a signed Microsoft binary to download or execute remote content?