PSAP
TCM Security Practical SOC Analyst Professional (PSAP)
Attacker Ttp ReconstructionEnglish
Exam overviewPractice session
During an investigation, an analyst observes a Windows process with a parent of 'svchost.exe' spawning 'cmd.exe' which in turn executes 'whoami.exe'. Which MITRE ATT&CK technique does this process tree most strongly suggest?
Loading your practice session…