Apply MITRE ATT&CK Tactics and Techniques Within Falcon to Provide Context to a Detection CCFR Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An analyst is investigating a Falcon detection on a critical server. The detection shows a process (svchost.exe) creating a new service with a random name. The detection is mapped to T1543.003 (Windows Service). The analyst needs to determine the MOST likely impact of this technique on the server's availability. Which additional ATT&CK context is MOST relevant to assess this impact?

   • AThe parent process of svchost.exe.
   • BThe specific service configuration, such as the service start type and the binary path.
   • CThe tactic associated with the technique (e.g., Persistence, Privilege Escalation).
   • DThe user account under which the service is configured to run.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A Falcon detection on a user's workstation shows that a process (powershell.exe) is running a script that is using the Invoke-WebRequest cmdlet to download a file from a remote server and save it to the user's Downloads folder. The detection is mapped to T1105 (Ingress Tool Transfer). What is the adversary's PRIMARY goal?

   • ATo escalate privileges by exploiting a vulnerability.
   • BTo exfiltrate data from the system.
   • CTo establish persistence by creating a scheduled task.
   • DTo transfer a tool or payload onto the compromised system.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   When investigating a detection in Falcon, what does the 'ATT&CK' field in the detection details typically show?

   • AThe severity score of the detection
   • BThe list of affected users
   • CThe tactic and technique IDs (e.g., TA0005, T1053)
   • DThe hash of the malicious file
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst is investigating a Falcon detection on a web server. The detection shows that a process spawned a child process that ran 'whoami', 'net user', and 'ipconfig' in quick succession. In Falcon, the analyst navigates to the detection details and sees a 'Technique' field populated with 'T1033' (System Owner/User Discovery). Which ATT&CK tactic is this technique most directly associated with?

   • ADiscovery
   • BLateral Movement
   • CCredential Access
   • DExecution
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A Falcon detection is mapped to the 'Lateral Movement' tactic. What does this context suggest about the potential impact?

   • AThe adversary is likely installing a backdoor for persistence
   • BThe adversary is likely exfiltrating data immediately
   • CThe adversary is likely just scanning the network
   • DThe adversary may be attempting to move to other systems to expand access
   Reveal Solution Discussion Select an answer first