CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ17

VerifiedDetection Analysis

While triaging a detection, you observe an event named SyntheticProcessRollup2.

What conclusion can be drawn about this event?

Explanation

A SyntheticProcessRollup2 event represents process information synthesized for a process that began before the sensor was running, allowing the sensor to report context for that already-existing process.

Community Discussion

No comments yet. Be the first to start the discussion!