Apply MITRE ATT&CK Tactics and Techniques Within Falcon to Provide Context to a Detection CCFR Practice Questions (Page 5)

Questions 21–23

1. 21foundation · easy

   A Falcon detection shows that a process created a scheduled task to run a script. Which ATT&CK technique is most directly associated with this behavior?

   • ACredential Dumping
   • BData Obfuscation
   • CScheduled Task/Job
   • DNetwork Sniffing
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An analyst is investigating a Falcon detection on a workstation. The detection shows that a process (cmd.exe) is running 'net user /add hacker P@ssw0rd'. The detection is mapped to T1136.001 (Local Account). What is the adversary's PRIMARY goal?

   • ATo create a new local account for persistence or lateral movement.
   • BTo establish command and control by creating a new user.
   • CTo exfiltrate data by copying it to a network share.
   • DTo escalate privileges by adding a user to the Administrators group.
   Reveal Solution Discussion Select an answer first
3. 23application · easy

   A junior analyst is reviewing a Falcon detection and needs to quickly understand the adversary's overall objective and how this detection fits into a larger attack chain. Where in the Falcon console should the analyst look to find the ATT&CK tactic and technique information linked to this specific detection?

   • AThe 'Falcon Overwatch' page, under the 'Proactive Hunting' tab
   • BThe 'IOA Exclusions' page, under the 'Event History' tab
   • CThe 'Hosts' page, under the 'Installed Applications' tab
   • DThe 'Detection Details' page, under the 'MITRE ATT&CK' section
   Reveal Solution Discussion Select an answer first