An unhandled error has occurred.
Reload
X
UIZFORGE
Exams
Pricing
Career Paths
Resources
EN
Login
Sign Up
1
/ 5
Advanced
In Advanced Hunting, a query must identify devices where a process named rundll32.exe loaded from a user-writable path and was followed by a DNS query to a newly seen domain. Which table combination is most relevant?
Use DeviceProcessEvents for the process evidence and DeviceNetworkEvents or DeviceDnsEvents for the subsequent domain activity.
Use EmailAttachmentInfo and EmailEvents because DLL loads are attachment metadata.
Use AlertEvidence only because it contains every raw process and DNS event.
Use CloudAppEvents only because DNS queries are SaaS application events.
AI Tutor
Stuck? Get a hint
