Exam SecOps-Pro Topic 1 Question 42 Discussion

Option E offers the most robust solution for detecting sophisticated encoded PowerShell. The 'Anomaly' rule type is key for baselining normal activity and detecting deviations. Simply looking for '-EncodedCommand' (Option A, C) will generate many false positives, as legitimate tools also use it. Option B attempts decoding, which is powerful, but hardcoding specific malicious strings is not scalable for polymorphic attacks, and it's a 'Correlation' rule, not 'Anomaly'. Option D uses parent process analysis, which is a good filter but doesn't leverage baselining. Option E enhances the detection by adding' (long encoded commands are often malicious) and 'entropy_score' (high entropy indicates encoding/obfuscation). Combining these calculated fields with anomaly detection on the count of such suspicious commands per ' host_name, user_name' provides a high-fidelity, adaptive rule that minimizes false positives by learning normal behavior. This aligns with advanced threat hunting and detection in XSIAM.