A SOC uses the MITRE ATT&CK framework to map coverage. An analyst notes that Technique T1055 (Process Injection) has no detection rules in the SIEM. What data source should be prioritized to build detection for this technique?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because process injection (T1055) involves malicious code being injected into legitimate process address spaces; detecting it requires endpoint telemetry including process creation events, API calls (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread), and EDR behavioral analysis of process memory. A is wrong because network flow data does not capture process-level activity needed to detect memory injection techniques.
Full explanation below image
Full Explanation
B is correct because process injection (T1055) involves malicious code being injected into legitimate process address spaces; detecting it requires endpoint telemetry including process creation events, API calls (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread), and EDR behavioral analysis of process memory. A is wrong because network flow data does not capture process-level activity needed to detect memory injection techniques. C is wrong because DNS logs reveal domain resolution activity but do not show process injection behavior. D is wrong because web proxy logs show URL access patterns, not process injection activities.