John, SOC analyst wants to monitor the attempt of process creation activities from any of...

Vendor: ECCouncil
Product: 312-39
Update on: Mar 24, 2026
Questions: 200

ECCouncil 312-39 Question Answer

John, SOC analyst wants to monitor the attempt of process creation activities from any of their Windows endpoints.

Which of following Splunk query will help him to fetch related logs associated with process creation?

index=windows LogName=Security EventCode=4678 NOT (Account_Name=*$) .. .. ... ..

index=windows LogName=Security EventCode=4688 NOT (Account_Name=*$) .. .. ..

index=windows LogName=Security EventCode=3688 NOT (Account_Name=*$) .. .. ..

index=windows LogName=Security EventCode=5688 NOT (Account_Name=*$) ... ... ...

ECCouncil 312-39 Summary

Price: $52.5 ~~$149.99~~