CCFH-202Preview

Event Search data is recorded with which time zone?

Which of the following is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers?

Lateral movement through a victim environment is an example of which stage of the Cyber Kill Chain?

In the MITRE ATT&CK Framework (version 11 - the newest version released in April 2022), which of the following pair of tactics is not in the Enterprise: Windows matrix?

Which of the following is TRUE about a Hash Search?

When performing a raw event search via the Events search page, what are Event Actions?

Which of the following best describes the purpose of the Mac Sensor report?

In the Powershell Hunt report, what does the “score” signify?

When reviewing a DNS request in the Event Search, you're curious which process made the request. Which Event Action would be the quickest way to show you the process?

You have found a hash-based indicator of compromise (IOC) in an intelligence report and want to determine if the program has run in your environment. Which search would provide all of the process’ executions over the timeframe specified?

What is the purpose of the rename command in this query?

event_simpleName=ProcessRollup2 [search event_simpleName=ProcessRollup2 FileName=excel.exe | rename TargetProcessId_decimal AS ParentProcessId_decimal | fields aid ParentProcessId_decimal] | stats count by FileName CommandLine

What information is provided when using IP Search to look up an IP address?

Which field in a DNS Request event points to the responsible process?

Which of the following does the Hunting and Investigation Guide contain?

Which of the following Event Search queries would only find the DNS lookups to the domain: www.randomdomain.com?

SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time. Which eval function is correct?

When exporting the results of the following event search, what data is saved in the exported file (assuming Verbose Mode)? event_simpleName=*Written | stats count by ComputerName

During an investigation you find out that files are being written to disc by a malicious process. While many are displayed in the detections as context items, you want to see all files written to your host by this process.

What Splunk search would work for this scenario?

Which report would you use to find when a specific user last reset their password?

Which of the following is a suspicious process behavior?

Which of the following is an example of a Falcon threat hunting lead?

A benefit of using a threat hunting framework is that it:

An analyst has sorted all recent detections in the Falcon platform to identify the oldest in an effort to determine the possible first victim host. What is this type of analysis called?

What part of the Investigate module should you use when you want to write custom queries to analyze, explore, or hunt for suspicious or malicious activity in your environment?