← Alert Investigation Playbooks — Endpoint, Network, Identity, Email
Module Quiz
10 questions · Pass at 80%
Question 1 of 10
An alert fires: 'Word.exe spawned cmd.exe, which spawned powershell.exe -enc [encoded string].' Which ATT&CK technique chain best describes this activity, in order?