A process that provides the details of an activity or event that can extract possible attacks in the form of Trojans or worms in the system.

A process that provides the details of an activity or event that can extract possible attacks in the form of Trojans or worms in the system.

• A. TCPview
• B. Splunk
• C. Windows registry
• D. Log analysis

Answer: (D)

Analyzing logs from the system and security tools to uncover evidence of malicious activity is the idea here. Log analysis collects details of events across many sources—OS logs, application logs, firewall and IDS logs, and network devices—and lets you correlate them over time. Trojans and worms leave traces: unusual process startups, unexpected or out-of-schedule network connections, beaconing to external hosts, rapid replication attempts, or repeated authentication failures. By reviewing the sequence and context of these events, you can piece together a picture of an infection or propagation, even if the malware tries to hide in plain sight. The strength of this approach is the ability to see patterns across time and across hosts, which is essential for detecting stealthy or evolving attacks. TCPview focuses on current live connections and ports rather than a historical activity trail, so it doesn’t provide the full event history needed to spot malware. The Windows registry stores configuration and startup items but doesn’t deliver an activity timeline that reveals attacks. A tool like Splunk can perform log analysis, but the described process is log analysis itself—the technique you’d use, possibly implemented with such a tool.

Analyzing logs from the system and security tools to uncover evidence of malicious activity is the idea here. Log analysis collects details of events across many sources—OS logs, application logs, firewall and IDS logs, and network devices—and lets you correlate them over time. Trojans and worms leave traces: unusual process startups, unexpected or out-of-schedule network connections, beaconing to external hosts, rapid replication attempts, or repeated authentication failures. By reviewing the sequence and context of these events, you can piece together a picture of an infection or propagation, even if the malware tries to hide in plain sight. The strength of this approach is the ability to see patterns across time and across hosts, which is essential for detecting stealthy or evolving attacks.

TCPview focuses on current live connections and ports rather than a historical activity trail, so it doesn’t provide the full event history needed to spot malware. The Windows registry stores configuration and startup items but doesn’t deliver an activity timeline that reveals attacks. A tool like Splunk can perform log analysis, but the described process is log analysis itself—the technique you’d use, possibly implemented with such a tool.