7.3 Conduct Hypothesis and Hunting Lead Generation in Order to Prove Them Using Falcon Tools CCFH Practice Questions (Page 6)

Questions 26–27

1. 26application · medium

   You have formulated the hypothesis: 'A malicious PowerShell script is downloading and executing a payload from a non-standard port.' To prove this using Falcon tools, which query approach is the most appropriate first step?

   • ASearch for all PowerShell processes and review their command lines for download patterns.
   • BSearch for network connections to non-standard ports (e.g., 4444, 8080) and correlate with PowerShell processes.
   • CSearch for all file downloads in the last 24 hours.
   • DSearch for processes named 'powershell.exe' only.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   You are investigating a hypothesis that a specific user account was used to perform a DCSync attack. You find that the account has made a large number of replication requests (e.g., DS-Replication-Get-Changes). Which additional evidence from Falcon would most strongly prove the hypothesis?

   • AThe replication requests occurred during business hours.
   • BThe account has recently changed its password.
   • CThe replication requests originated from a process that is not the normal replication process (e.g., not ntdsutil.exe or the domain controller's own process).
   • DThe account is a domain admin.
   Reveal Solution Discussion Select an answer first