CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ18

VerifiedHunting Methodology

You observe an unusual spike in PsExec usage across multiple machines in your environment.

Which action will confirm whether this activity is legitimate or malicious?

Explanation

PsExec is commonly used for legitimate remote administration but can also be abused for lateral movement. Confirming whether the commands came from an authorized administrator performing known, approved activity distinguishes legitimate use from potentially malicious behavior.

Community Discussion

No comments yet. Be the first to start the discussion!