Evaluate the following process tree observed in a detection:root

CrowdStrike CCFR-201b Question Answer

Evaluate the following process tree observed in a detection:

root > smss.exe > winlogon.exe > userinit.exe > explorer.exe > windows_media_player_y35s21-4ak.exe

Based on the parent-child relationships, which entry source is most likely?

A remote service exploitation targeting a system process.

A phishing attack where the user executed a malicious file from the desktop.

A scheduled task running under the SYSTEM account.

A supply chain attack targeting the Windows Boot manager.

CCFR-201b PDF/Engine

Get 65% Discount on All Products, Use Coupon: "ac4s65"

Evaluate the following process tree observed in a detection:root > smss.