John, SOC analyst wants to monitor the attempt of process creation activities from any of...

ECCouncil 312-39 Question Answer

John, SOC analyst wants to monitor the attempt of process creation activities from any of their Windows endpoints.

Which of following Splunk query will help him to fetch related logs associated with process creation?

index=windows LogName=Security EventCode=4678 NOT (Account_Name=*$) .. .. ... ..

index=windows LogName=Security EventCode=4688 NOT (Account_Name=*$) .. .. ..

index=windows LogName=Security EventCode=3688 NOT (Account_Name=*$) .. .. ..

index=windows LogName=Security EventCode=5688 NOT (Account_Name=*$) ... ... ...

312-39 PDF/Engine

Get 65% Discount on All Products, Use Coupon: "ac4s65"