Question Analysis

A user launched a Windows command prompt and executed a built-in utility to enumerate all active network connections. Using process creation logs, identify the exact tool that produced the list of current connections.

0940a971-809a-48f1-9c4d-b1d785e96ee5
Question ID
14/16
Models Correct
1
Valid Answer
88%
Success Rate
Reference Answer

Human-validated correct answer for this question

netstat
Model Performance Comparison

See how different AI models performed on this question

ModelAnswerKQL QueryStatusAttemptsTimeCost
gemini-2.5-flash-preview-04-17
netstat
DeviceProcessEvents | where ActionType == "ProcessCreated" | where InitiatingProcessFileName =~ "cmd.exe" | where FileName =~ "netstat.exe" | project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, AccountName
Correct
1
10.38s
0.0041
gpt-35-turbo
NETSTAT.EXE
DeviceProcessEvents | where ActionType == 'ProcessCreated' | where FileName endswith '.exe' and tolower(FileName) contains 'netstat' // Filter for 'netstat' utility | extend CommandLine = tolower(InitiatingProcessCommandLine) | where CommandLine contains 'netstat' // Filter for the specific netstat command
Correct
1
2.52s
0.0030
gpt-4-turbo-2024-04-09
netstat
DeviceProcessEvents | where InitiatingProcessFileName == 'cmd.exe' and ProcessCommandLine has 'netstat' | project DeviceId, DeviceName, AccountName, ProcessCommandLine, TimeGenerated | distinct DeviceId, DeviceName, AccountName, ProcessCommandLine, TimeGenerated
Correct
1
8.65s
0.0506
gpt-4.1
NETSTAT.EXE
DeviceProcessEvents | where FileName =~ "netstat.exe" or FileName =~ "netstat" | extend Parent = InitiatingProcessFileName | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, Parent, InitiatingProcessCommandLine | order by TimeGenerated desc
Correct
1
5.40s
0.0130
gpt-4.1-finetuned
None
let CmdStart = DeviceProcessEvents | where FileName =~ "cmd.exe" | summarize arg_min(Timestamp, *) by InitiatingProcessAccountSid, DeviceName, FileName; let BuiltinTools = dynamic([ "netstat.exe", "net.exe", "tasklist.exe" ]); let OriginalTool = DeviceProcessEvents | join kind=inner ( CmdStart ) on $left.DeviceName == $right.DeviceName, $left.InitiatingProcessAccountSid == $right.InitiatingProcessAccountSid | where FileName in (BuiltinTools) | summarize arg_min(Timestamp, *) by DeviceName, InitiatingProcessAccountSid, FileName; OriginalTool | extend ToConsole = iif(isnotempty(ProcessVersionInfoFileDescription), 1, 0) | extend Filename = iif(ToConsole == 1, "N/A", tostring(split(ProcessCommandLine, ">", 1)[1])) | project-reorder DeviceName, InitiatingProcessAccountSid, FileName, ToConsole, Filename | sort by DeviceName desc, InitiatingProcessAccountSid // The query outputs details about the tool found in the cmd.exe process tree, whether output went to the console or file, and the associated machine/user details.
Incorrect
5
83.94s
0.0843
gpt-4.1-mini
No answer provided
No query generated
Incorrect
5
0.00s
0.0055
gpt-4.1-nano
netstat
DeviceProcessEvents | where (FileName endswith 'cmd.exe' or InitiatingProcessFileName endswith 'cmd.exe') | extend ProcessCmdLine = coalesce(InitiatingProcessCommandLine, ProcessCommandLine) | where ProcessCmdLine contains 'netstat' or ProcessCmdLine contains '/netstat' | project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCmdLine, InitiatingProcessId | order by TimeGenerated desc
Correct
4
25.25s
0.0014
gpt-4o
netstat
DeviceProcessEvents | where ActionType == "ProcessCreated" | where InitiatingProcessCommandLine has_any ("netstat", "nbtstat") | extend ToolName = iff(InitiatingProcessCommandLine has "netstat", "netstat", iff(InitiatingProcessCommandLine has "nbtstat", "nbtstat", "")) | project TimeGenerated, InitiatingProcessAccountName, InitiatingProcessCommandLine, ToolName
Correct
2
20.23s
0.0402
grok-3-beta
netstat
DeviceProcessEvents | where InitiatingProcessFileName =~ 'cmd.exe' | where FileName in~ ('netstat.exe', 'ipconfig.exe', 'arp.exe') | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ProcessCreationTime, InitiatingProcessAccountName | order by Timestamp desc
Correct
2
21.83s
0.0383
grok-3-mini-beta
netstat
DeviceProcessEvents | where ProcessCommandLine contains 'netstat' | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine | order by TimeGenerated desc | limit 10
Correct
2
20.14s
0.0031
o1-high
NETSTAT.EXE
DeviceProcessEvents | where ActionType == "ProcessCreated" | where InitiatingProcessFileName =~ "cmd.exe" | where FileName =~ "netstat.exe" | project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
Correct
1
33.42s
0.2441
o1-low
netstat
DeviceProcessEvents | where ActionType == "ProcessCreated" | where InitiatingProcessFileName =~ "cmd.exe" | where FileName =~ "netstat.exe" | project TimeGenerated, DeviceName, FolderPath, InitiatingProcessAccountDomain, InitiatingProcessAccountName, FileName, ProcessCommandLine | order by TimeGenerated desc
Correct
1
17.17s
0.1590
o3-mini-high
netstat
DeviceProcessEvents | where InitiatingProcessFileName =~ "cmd.exe" and ProcessCommandLine has "netstat" | extend ToolExecuted = tostring(split(ProcessCommandLine, ' ')[0]) | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, ToolExecuted | order by TimeGenerated desc
Correct
1
10.27s
0.0100
o3-mini-low
netstat
DeviceProcessEvents | where InitiatingProcessFileName =~ "cmd.exe" and FileName =~ "netstat.exe" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, ProcessCreationTime
Correct
1
25.81s
0.0079
o4-mini-high
netstat.exe
DeviceProcessEvents | where tolower(InitiatingProcessFileName) == "cmd.exe" | where tolower(FileName) == "netstat.exe" or ProcessCommandLine has_any ("netstat", "Get-NetTCPConnection") | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, ChildProcessFileName = FileName, ChildProcessCommandLine = ProcessCommandLine | order by TimeGenerated desc
Correct
2
74.57s
0.0198
o4-mini-low
netstat
DeviceProcessEvents | where InitiatingProcessFileName == "cmd.exe" // Filter to child processes of cmd.exe that enumerate network connections | where ProcessCommandLine contains "netstat" // Select relevant details to identify the tool and context | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
Correct
1
31.35s
0.0123