Explain What Information a Process Timeline Will Provide CCFR Practice Questions (Page 5)

Questions 21–22

1. 21application · medium

   An analyst is examining a Process Timeline for a host that was infected with a credential-stealing malware. The timeline shows: winlogon.exe → lsass.exe, and then a separate branch: svchost.exe → rundll32.exe → malware.exe. The analyst needs to determine if the malware accessed lsass.exe. Which action would best help the analyst make this determination?

   • ACheck the Process Timeline for an injection event where malware.exe injected code into lsass.exe.
   • BConclude that malware.exe accessed lsass.exe because both processes appear on the same host.
   • CReview the timeline for a network connection event between malware.exe and lsass.exe.
   • DLook for a process creation event where lsass.exe spawned malware.exe.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following data sources contribute to a Process Timeline in Falcon Responder?

   • AProcess creation, termination, and injection events
   • BDNS query logs and network flow data
   • CRegistry key modifications and file writes
   • DUser login and logout events
   Reveal Solution Discussion Select an answer first