Which of the following processes will the security analyst Identify as the MOST likely indicator of system compromise given the processes running in Task Manager?

A company employee downloads an application from the internet.

After the installation, the employee begins experiencing noticeable performance issues, and files are appearing on the desktop.

Which of the following processes will the security analyst Identify as the MOST likely indicator of system compromise given the processes running in Task Manager?
A . Chrome.exe
B. Word.exe
C. Explorer.exe
D. mstsc.exe
E. taskmgr.exe

View Answer

Answer: D

Explanation:

mstsc.exe is the process name for Remote Desktop Connection, a program that allows users to connect to remote computers or servers over a network or the Internet12. mstsc.exe is an indicator of system compromise if the user did not initiate or authorize a remote connection, as it may mean that an attacker has gained access to the system and is using it to connect to other systems or exfiltrate data3.