3.1 Analyze and Interpret Metadata Around Files and Processes Recorded by Falcon CCFH Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During a hunt, an analyst finds a file named 'invoice.pdf.exe' in the Downloads folder. The file's SHA256 hash is not present in any known-good or known-bad list. The file's creation timestamp is 2 minutes before the user's login time, and the last-write timestamp is 1 minute after the user's login. Which combination of metadata fields provides the STRONGEST initial evidence that this file is suspicious?

   • AFilename extension and file size
   • BSHA256 hash and last-write timestamp
   • CFilename extension and creation timestamp
   • DFile path and creation timestamp
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   During a threat hunt, you notice a process with a command line containing 'powershell.exe -enc <base64>'. Which metadata field is most important to examine next to determine if this is suspicious?

   • AThe file hash of powershell.exe
   • BThe user context of the process
   • CThe parent process ID (PPID) to see what launched PowerShell
   • DThe file size of powershell.exe
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An investigator is analyzing a host that was compromised. The following events are observed: (1) A file 'C:\Users\Public\svc.exe' is created; (2) The file's SHA256 hash is unknown; (3) A process 'svc.exe' is spawned with parent process 'services.exe'; (4) The process 'svc.exe' creates a file 'C:\Windows\Tasks\job.ps1'; (5) A scheduled task is created to run 'job.ps1'. Which metadata correlation is MOST critical to confirm that 'svc.exe' is the initial malware and not a legitimate service?

   • AThe SHA256 hash of svc.exe
   • BThe command line of svc.exe
   • CThe file path of svc.exe (C:\Users\Public)
   • DThe parent process of svc.exe (services.exe)
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Falcon analyst is reviewing a process event for 'svchost.exe' with PID 4567. The command line is 'svchost.exe -k netsvcs'. The parent process is 'services.exe' with PID 500. The user context is 'NT AUTHORITY\SYSTEM'. Which metadata field would be MOST important to check to determine if this is a legitimate svchost.exe or a masquerading process?

   • AThe file path of svchost.exe
   • BThe user context (SYSTEM)
   • CThe command line (-k netsvcs)
   • DThe parent process ID (500)
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   You see a Falcon event where a process with PID 1234 has a Parent Process ID (PPID) of 5678. What does this relationship tell you?

   • AProcess 1234 started process 5678
   • BProcess 1234 and 5678 are running on different hosts
   • CProcess 1234 and 5678 are the same process
   • DProcess 1234 was started by process 5678
   Reveal Solution Discussion Select an answer first