A security team wants to detect if any processes on Windows endpoints are injecting code into other processes. Which EDR telemetry event type most directly captures this activity?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because process injection requires the injecting process to call OpenProcess to gain a handle to the target, then VirtualAllocEx and WriteProcessMemory to write code into the target's memory space; EDR telemetry capturing these API calls directly surfaces injection attempts. A is wrong because file creation events capture files written to disk; fileless injection does not necessarily involve file creation.
Full explanation below image
Full Explanation
B is correct because process injection requires the injecting process to call OpenProcess to gain a handle to the target, then VirtualAllocEx and WriteProcessMemory to write code into the target's memory space; EDR telemetry capturing these API calls directly surfaces injection attempts. A is wrong because file creation events capture files written to disk; fileless injection does not necessarily involve file creation. C is wrong because registry modifications may accompany some persistence techniques but do not directly capture process injection. D is wrong because network connections may indicate C2 communication after injection but do not reveal the injection activity itself.