At a hospital, a clinical PC raises an alert after one process injects code into another process, and no known file hash was involved. Which endpoint technology fits the alert?

A host-based intrusion detection system that flagged the code injection from process behavior, with no known file hash fits an alert whose evidence is one process injecting code into another, with no known file hash to match. Host-based intrusion detection watches what processes do on that PC. Code injection is a behavior on the host, so the sensor that can raise this alert is the one watching the endpoint, not a device that only sees packets elsewhere. A host firewall on the clinical PC whose only job is to allow or deny network ports allows or denies ports. A port decision does not describe one process writing code into another process, and the alert was not a blocked or permitted port. A VPN concentrator that terminates remote clinician tunnels and does not watch process behavior terminates remote tunnels for clinicians. It does not observe process relationships on the clinical PC, and the scenario never mentions a remote tunnel. A NetFlow collector that stores conversation summaries from the hospital core, not process events stores conversation summaries from the network core. Those summaries have addresses, ports, and counts. They do not show a process injecting code, and they are not collected from inside the PC. Exam caveat: this kind of host alert can fire on behavior alone, so the absence of a known file hash does not make the alert a network event. Operational check: open the endpoint alert and confirm it names the injecting process and the target process on that clinical PC.