Security professionals can monitor the activities of an adversary by checking for unusual commands executed in the Batch scripts and PowerShell and by using packet capturing tools.

Security professionals can monitor the activities of an adversary by checking for unusual commands executed in the Batch scripts and PowerShell and by using packet capturing tools.

• A. Use of Command-Line Interface
• B. Internal Reconnaissance Detection
• C. Unspecified Proxy Activities Detection
• D. Use of PowerShell Detection

Answer: (B)

Monitoring for adversary activity during the reconnaissance phase involves looking for signs of information-gathering inside the environment and across the network. Unusual commands being executed in batch scripts and PowerShell are classic host-based indicators that an attacker is enumerating systems, collecting data, or testing defenses. When you add packet capturing into the mix, you gain visibility into suspicious network-level activity such as probing, unusual communication patterns, port scans, or beaconing that often accompanies early intrusion steps. Together, these signals point to internal reconnaissance—the adversary’s attempts to map out assets, services, and defenses before moving deeper. That broader focus on detecting attacker information-gathering activities within the network and endpoints is why internal reconnaissance detection is the best fit. The other options are narrower or misaligned with the described indicators. Focusing on the command-line interface or PowerShell alone misses the network-side signals captured by packet analysis. Proxy activity detection centers on external access paths and may not directly capture internal reconnaissance behaviors shown by scripted commands or internal traffic patterns.

Monitoring for adversary activity during the reconnaissance phase involves looking for signs of information-gathering inside the environment and across the network. Unusual commands being executed in batch scripts and PowerShell are classic host-based indicators that an attacker is enumerating systems, collecting data, or testing defenses. When you add packet capturing into the mix, you gain visibility into suspicious network-level activity such as probing, unusual communication patterns, port scans, or beaconing that often accompanies early intrusion steps. Together, these signals point to internal reconnaissance—the adversary’s attempts to map out assets, services, and defenses before moving deeper. That broader focus on detecting attacker information-gathering activities within the network and endpoints is why internal reconnaissance detection is the best fit.

The other options are narrower or misaligned with the described indicators. Focusing on the command-line interface or PowerShell alone misses the network-side signals captured by packet analysis. Proxy activity detection centers on external access paths and may not directly capture internal reconnaissance behaviors shown by scripted commands or internal traffic patterns.