Which of the following is a suspicious process behavior?

The most suspicious behavior listed is a non-network process, such as notepad.exe, initiating an outbound network connection. Applications like Notepad are simple text editors and have no legitimate reason to communicate over a network. This activity is a strong indicator of compromise, often resulting from techniques like process injection, where malicious code is injected into a legitimate process to inherit its trust and evade defenses. This allows the malware to perform actions, like C2 communication, under the guise of a benign application.

A. RemoteSigned is a common, often default, PowerShell execution policy that is not inherently suspicious and is used in many legitimate administrative contexts.
B. Internet browsers are designed to access web resources, which requires them to perform numerous DNS requests as part of their normal operation.
C. PowerShell is a command-line shell and scripting language; its fundamental purpose is to execute scripts, making this a normal and expected behavior.

1. CrowdStrike. (2021). CrowdStrike Falcon® Platform Documentation: Understanding Detections. In the section on "Detection Details," the documentation explains how process trees and parent/child relationships are analyzed. An anomalous parent process, like notepad.exe spawning a network-aware process or making a connection itself, is a key indicator of malicious activity.

2. Red Canary. (2022). 2022 Threat Detection Report. While a vendor report, it is widely cited in academic and professional settings for its analysis of MITRE ATT&CK techniques. The report details how adversaries use legitimate processes for malicious ends (T1036 Masquerading), noting that network connections from unexpected processes are a key detection opportunity (p. 24).