Which of the following queries will return the parent processes responsible for launching badprogram.exe?
A.
[search (ParentProcess) where name=badprogram.exe ] | table ParentProcessName _time
B.
event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename ParentProcessId_decimal AS TargetProcessId_decimal | fields aid TargetProcessId_decimal] | stats count by FileName _time
C.
[search (ProcessList) where Name=badprogram.exe ] | search ParentProcessName | table ParentProcessName _time
D.
event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename TargetProcessId_decimal AS ParentProcessId_decimal | fields aid TargetProcessId_decimal] | stats count by FileName _time
This query will return the parent processes responsible for launching badprogram.exe by using a
subsearch to find the processrollup2 events where FileName is badprogram.exe, then renaming the
TargetProcessld_decimal field to ParentProcessld_decimal and using it as a filter for the main search,
then using stats to count the occurrences of each FileName by _time.
By renaming TargetProcessld_decimal field to ParentProcessld_decimal, you pivot the targetprocess of badprogram.exe as the child and search for all child process launched by badprogram.exe instead, not the process that spawned badprogram.exe.
query filters for "badprogram.exe" and renames the ParentProcessId_decimal to TargetProcessId_decimal to find the parent processes associated with it. The "stats count by FileName _time" part of the query helps present the results effectively.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
alanalanalan
4 months, 2 weeks agofive55
8 months, 1 week agogr23
10 months, 2 weeks agoPipo12345
11 months, 1 week agojoal23
1 year, 1 month agoChiquitabandita
1 year, 2 months agokangaru
10 months, 1 week agoChiquitabandita
1 year, 2 months agoexamtopics3000
1 year, 3 months agoexamtopics3000
1 year, 3 months ago