hard20 pts · first answer countswindows-logsincident-responsethreat-detection

Artefacts of PsExec lateral movement

You suspect an attacker used PsExec to run commands on server FS01 from another host. Which combination of artefacts on FS01 best supports this?

A.Event 4625 logon failures and a new DHCP leaseB.Event 1102 audit log cleared and a Windows Update entryC.A network logon (Event 4624, logon type 3) from the source host, then Event 7045 showing a new service such as PSEXESVC being installed, with access to the ADMIN$ shareD.An Event 4624 logon type 2 at the console and a new printer driver

Discussion 0

Join free to post in the discussion.

Artefacts of PsExec lateral movement

Discussion 0

Related questions