Apply MITRE ATT&CK Tactics and Techniques Within Falcon to Provide Context to a Detection CCFR Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In the MITRE ATT&CK framework, what do 'procedures' (the 'P' in TTPs) describe?

   • AThe overall goal an adversary is trying to achieve
   • BThe vulnerability exploited by the adversary
   • CThe category of tools used by the adversary
   • DThe specific steps or commands used to execute a technique
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Falcon detection on a domain controller shows a process (lsass.exe) being accessed by a suspicious tool. The detection is mapped to technique T1003.001 (LSASS Memory). What is the adversary's PRIMARY goal based on this technique?

   • ATo move laterally by using a remote service
   • BTo escalate privileges by exploiting a vulnerability
   • CTo achieve persistence by creating a service
   • DTo steal credentials from memory
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A Falcon detection on a user's workstation shows that a process (explorer.exe) spawned a child process (cmd.exe) that ran 'reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Updater /t REG_SZ /d C:\Users\Public\update.exe'. The detection is mapped to T1547.001 (Registry Run Keys / Startup Folder). What is the adversary's PRIMARY goal?

   • ATo exfiltrate data by copying it to a public folder.
   • BTo establish command and control by creating a new registry value.
   • CTo escalate privileges by modifying a system registry key.
   • DTo achieve persistence by ensuring the malicious executable runs at logon.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An analyst is investigating a Falcon detection that shows a process (cmd.exe) creating a scheduled task. The detection is mapped to technique T1053.005 (Scheduled Task). The analyst wants to determine the most likely 'next step' in the attack chain based on this technique. Which question is the MOST useful to answer to apply the ATT&CK context?

   • AWhat is the parent process of cmd.exe?
   • BWhat is the hostname of the system?
   • CWhat is the scheduled task configured to run?
   • DWhat is the privilege level of the user who created the task?
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In the Falcon console, where can you typically view the MITRE ATT&CK tactic and technique information associated with a specific detection?

   • AIn the detection details page, under the MITRE ATT&CK section
   • BIn the Hosts management page, under the 'Network' tab
   • CIn the Falcon dashboard, under the 'Overview' tab
   • DIn the Falcon installer configuration file
   Reveal Solution Discussion Select an answer first