A threat hunter is looking for evidence of living-off-the-land (LOtL) techniques on Windows endpoints. Which combination of data sources provides the best hunting surface?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because LOtL attacks abuse built-in tools (PowerShell, WMI, certutil, mshta, regsvr32, etc.); Sysmon process creation with command lines captures what ran and how, PowerShell Script Block Logging captures obfuscated script content after deobfuscation by the engine, WMI logs capture WMI-based persistence and execution, and network events show resulting C2 connections — together providing comprehensive LOtL visibility. A is wrong because AV signatures miss LOtL techniques that use legitimate binaries.
Full explanation below image
Full Explanation
B is correct because LOtL attacks abuse built-in tools (PowerShell, WMI, certutil, mshta, regsvr32, etc.); Sysmon process creation with command lines captures what ran and how, PowerShell Script Block Logging captures obfuscated script content after deobfuscation by the engine, WMI logs capture WMI-based persistence and execution, and network events show resulting C2 connections — together providing comprehensive LOtL visibility. A is wrong because AV signatures miss LOtL techniques that use legitimate binaries. C is wrong because application crash and service start logs provide minimal LOtL detection value. D is wrong because DHCP and DNS logs are useful for network hunting but do not capture endpoint execution context.