A red team exercise revealed that traditional IOCs (e.g., hash, IP, domain) for a known malware family were easily bypassed by polymorphic variants. The malware, however, consistently performs a unique sequence of API calls to inject code into legitimate processes: 'NtOpenProcess' -> 'NtAllocateVirtualMemory' -> 'NtWriteVirtualMemory' -> 'NtCreateRemoteThread'. To counter this, an XSIAM engineer needs to create a high-fidelity BIOC. Which of the following XQL queries best represents this behavioral pattern while minimizing false positives from legitimate applications performing similar operations?
正解：E
Option E is the most comprehensive and effective XQL query for this complex BIOC. Option A is too generic and will generate many false positives. Option B is closer but lacks crucial filters for common legitimate processes that might perform similar actions (e.g., debuggers, security tools) and doesn't specify a time window, which is critical for behavioral sequences. Option C is too specific to only the last step and might miss the full chain. Option D is too broad and only relies on reputation. Option E correctly uses the 'pattern' command to define the exact sequence of API calls, ensuring they occur within a specific 'time_window' and 'by' the same 'host_id' and 'process.pid'. Critically, it includes exclusions for 'target_process.name' (common legitimate injection targets like csrss.exe, winlogon.exe, explorer.exe, dwm.exe) and filters for 'stage_l .process.reputation != 'trusted" to reduce false positives while accurately targeting malicious injection attempts.
