A SOC uses the MITRE ATT&CK framework to map coverage. An analyst notes that Technique T1055 (Process Injection) has no detection rules in the SIEM. What data source should be prioritized to build detection for this technique?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — process injection happens on the endpoint, so you need Windows process creation events and EDR monitoring to catch code being stuffed into legitimate processes. Network, DNS, and proxy logs won't show that memory-level behavior.
Full Explanation
The correct data source is Windows endpoint process creation events (event ID 4688) and API call monitoring from an EDR solution, because process injection involves malicious code being injected into legitimate process address spaces. Detecting it requires endpoint telemetry that includes process creation events, API calls such as VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread, and EDR behavioral analysis of process memory. Network flow data (NetFlow/IPFIX) from the core router is wrong because it does not capture process-level activity needed to detect memory injection techniques. DNS query logs from the recursive resolver are wrong because they reveal domain resolution activity but do not show process injection behavior. Web proxy logs showing URL categories are wrong because they show URL access patterns, not process injection activities.