MENU
A threat hunter wants to detect credential dumping attempts that bypass traditional malware detection. Which telemetry source is MOST effective for this purpose?
The correct answer is endpoint memory access telemetry. Credential dumping often involves accessing sensitive memory regions, such as LSASS, rather than deploying obvious malware.
Modern attackers frequently use:
Legitimate tools
In-memory techniques
Living-off-the-land binaries
These methods bypass file-based detection entirely. Email, DNS, and firewall logs provide limited visibility into memory-level abuse.
Endpoint memory telemetry enables detection of:
Unauthorized LSASS access
Suspicious handle requests
Abnormal process injection
This telemetry is foundational for detecting credential access techniques in modern environments. Therefore, option B is correct.