Security professionals can identify this behavior by checking logs for process IDs, processes with arbitrary letters and numbers, and malicious files downloaded from the Internet.

Security professionals can identify this behavior by checking logs for process IDs, processes with arbitrary letters and numbers, and malicious files downloaded from the Internet.

• A. Use of Command-Line Interface Detection
• B. Use of PowerShell Detection
• C. Internal Reconnaissance Detection
• D. HTTP User Agent

Answer: (A)

Command-Line Interface Detection is about watching how commands are issued and what processes they start. Logs that show the exact process IDs and the lineage of processes help you see when a program launches and what it spawns next. Malware often uses random-looking names with letters and numbers to hide itself, so spotting processes with arbitrary names is a red flag. When those logs also reveal files being downloaded from the Internet, it points to payload delivery driven by command-line actions. By correlating CLI activity, quirky or spoofed process names, and download events, you can detect an attacker’s behavior that relies on the command line to execute and deploy malware.

Command-Line Interface Detection is about watching how commands are issued and what processes they start. Logs that show the exact process IDs and the lineage of processes help you see when a program launches and what it spawns next. Malware often uses random-looking names with letters and numbers to hide itself, so spotting processes with arbitrary names is a red flag. When those logs also reveal files being downloaded from the Internet, it points to payload delivery driven by command-line actions. By correlating CLI activity, quirky or spoofed process names, and download events, you can detect an attacker’s behavior that relies on the command line to execute and deploy malware.