4.6 Define Key Data Event Types CCFH Practice Questions (Page 4)

Questions 16–18

1. 16application · medium

   A Falcon Hunter is investigating a suspicious PowerShell process that spawned from a Word document. The hunter needs to determine whether the PowerShell process attempted to modify a Windows registry key to establish persistence. Which Falcon data event type should the hunter query to confirm this behavior?

   • ANetworkConnection events
   • BRegistryActivity events
   • CProcessRollup2 events
   • DFileWrite events
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   During a Falcon Event Search, an analyst wants to review the execution of a suspicious binary on an endpoint. Which key data event type would contain the most relevant information for this investigation?

   • AProcess events
   • BFile events
   • CNetwork events
   • DRegistry events
   Reveal Solution Discussion Select an answer first
3. 18expert · hard

   A Falcon Hunter is investigating a host that is suspected of running a worm that spreads via network shares. The hunter has identified a process that is making many outbound SMB connections. The hunter needs to determine if the process is also writing files to remote shares. Which combination of Falcon data event types would provide the most complete evidence of this worm behavior?

   • AProcessRollup2 and NetworkConnection events
   • BRegistryActivity and NetworkConnection events
   • CNetworkConnection and FileWrite events
   • DProcessRollup2 and FileWrite events
   Reveal Solution Discussion Select an answer first