7.3 Conduct Hypothesis and Hunting Lead Generation in Order to Prove Them Using Falcon Tools CCFH Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   You are investigating a hypothesis that a specific server was compromised and is being used as a command and control (C2) relay. You find a process on the server making outbound connections to an IP address that is not on any blocklist. Which combination of Falcon evidence would most strongly prove the hypothesis?

   • AThe process has a valid digital signature and the connection is to a well-known cloud provider.
   • BThe connection is to an IP address that has been seen in other security alerts.
   • CThe process is named 'svchost.exe' and the connection is to port 443.
   • DThe process is unsigned, was spawned from a parent process that is not the normal service host, and the connection is to an IP in a country where the company has no business.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A hypothesis states: 'An attacker is using a legitimate Windows tool (e.g., certutil.exe) to download a payload.' Which Falcon Search query would be the most effective to test this hypothesis?

   • ASearch for all processes named 'certutil.exe'.
   • BSearch for all network connections to external IPs.
   • CSearch for files with a '.exe' extension in the temp directory.
   • DSearch for 'certutil.exe' with a command line containing 'urlcache' or 'verifyctl' and a network connection.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   You are hunting for a possible supply chain attack. Your initial hypothesis is: 'A legitimate software update is being used to deliver malware.' You find a process that is signed by a known software vendor, but it is making a network connection to an IP address that is not associated with the vendor. What is the most appropriate next step in the iterative hunting process?

   • AImmediately escalate the process to incident response.
   • BExpand the search to include all signed processes that make network connections.
   • CConclude the hypothesis is false because the process is signed by a trusted vendor.
   • DRefine the hypothesis to focus on the specific vendor and the unexpected network connection, and investigate the IP address further.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What type of Falcon tool output can be used as evidence to support or refute a hypothesis?

   • AThe hunter's personal notes
   • BThe organization's security policy document
   • CSearch results showing matching events
   • DA list of all users in the organization
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   You have a hypothesis that a specific adversary is using a legitimate remote management tool (e.g., AnyDesk) for persistence and remote access. Your environment has many users who legitimately use AnyDesk for IT support. Which Falcon query approach would be the most effective to prove the hypothesis while minimizing false positives?

   • ASearch for all remote access tools in the environment.
   • BSearch for all processes named 'AnyDesk.exe'.
   • CSearch for network connections to AnyDesk's servers.
   • DSearch for 'AnyDesk.exe' running from a non-standard installation path (e.g., temp directory) or with a command line that includes a specific connection string.
   Reveal Solution Discussion Select an answer first