A security administrator is tasked to investigate an alert about a suspicious running process trying to modify a system registry.
Which components can be checked to further inspect the cause of the alert?

Question

A security administrator is tasked to investigate an alert about a suspicious running process trying to modify a system registry.

Which components can be checked to further inspect the cause of the alert?

Jason Hicks · Accepted Answer

Event details, command lines, and TTPs involved

Jason Hicks · Answer

Command lines. Device ID, and priority score

Jason Hicks · Answer

TTPs involved, network connections, and child path

Jason Hicks · Answer

Priority score, file reputation, and timestamp

List of questions