A transit threat hunter correlates host behaviors linked to defensive-control evasion. Which pattern is most relevant to flag for follow-up?

Transit threat hunters correlating host behaviors for defensive-control evasion should prioritize high-signal process genealogy anomalies. Unsigned script hosts that spawn networking tools in unusual parent-child chains suggest living-off-the-land or script-driven staging that bypasses expectations about signed updaters and normal help-desk activity. That pattern warrants follow-up: verify reputation and signature status, inspect command lines, map network destinations, and determine whether the chain aligns with known transit IT change windows or looks like evasion of application control and AV assumptions.

Nightly approved patch reboots are expected maintenance noise when correlated with change records. Signed vendor updaters contacting known update CDNs on schedule typically match allowlisted software supply chains. Help-desk tickets about monitor brightness preferences are user-comfort noise with no evasion relevance. None of those match the hunter's need to flag behaviors linked to control evasion.

Exam caveat: the stem asks for the pattern most relevant to flag for follow-up in the context of defensive-control evasion—not the most common municipal IT event. Routine ops and comfort tickets are distractors.

Operational check for transit SOC: build detections or hunts for unsigned interpreters/script hosts launching networking utilities (for example, unusual powershell/wscript/cscript/mshta → curl/bitsadmin/net connections), baseline legitimate parent-child pairs from approved transit software, and ticket anomalies with EDR process trees attached so analysts can close or escalate quickly.