Apply MITRE ATT&CK Tactics and Techniques Within Falcon to Provide Context to a Detection CCFR Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A Falcon detection on a workstation shows that a process (winword.exe) spawned a child process (cmd.exe) that ran 'whoami /all'. The detection is mapped to T1033 (System Owner/User Discovery). What is the adversary's PRIMARY goal?

   • ATo execute a malicious payload.
   • BTo discover information about the current user and their privileges.
   • CTo establish persistence on the system.
   • DTo exfiltrate data from the system.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst is triaging a Falcon detection and needs to understand the broader context of the attack. The detection is for a PowerShell script that is obfuscated and uses reflection to load a .NET assembly. In Falcon, the analyst sees the detection is mapped to T1059.001 (PowerShell). What additional information should the analyst look for in the 'MITRE ATT&CK' section of the detection details to BEST understand the adversary's goal?

   • AThe associated group, which will identify the threat actor.
   • BThe associated procedure, which will show the exact command line used.
   • CThe associated tactic, which will indicate the adversary's objective (e.g., Execution, Defense Evasion).
   • DThe associated software, which will name the malware family.
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   A security analyst is reviewing a Falcon detection and sees that it is mapped to multiple techniques under the same tactic. The analyst wants to understand the relationship between these techniques. Where in Falcon can the analyst see the full list of techniques and their associated tactics for this detection?

   • AThe 'Hosts' page under the 'Processes' tab.
   • BThe 'MITRE ATT&CK' section on the 'Detection Details' page.
   • CThe 'IOA Exclusions' page under the 'Detection Exclusions' tab.
   • DThe 'Event Timeline' on the 'Detection Details' page.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst is investigating a Falcon detection on a web server. The detection shows that a process (w3wp.exe) made an outbound connection to an IP address on port 443. The detection is mapped to T1071.001 (Web Protocols). The analyst wants to confirm if this is a legitimate connection or a potential C2 channel. Which additional information from the detection details would be MOST helpful?

   • AThe frequency and regularity of the outbound connections.
   • BThe user agent string in the HTTP request.
   • CThe destination IP address's geolocation.
   • DThe source port used for the connection.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How does understanding the ATT&CK tactic of a detection help an analyst?

   • AIt identifies the specific malware family
   • BIt provides the attacker's IP address
   • CIt reveals the adversary's goal, helping predict potential next steps
   • DIt automatically patches the vulnerability
   Reveal Solution Discussion Select an answer first