CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ27

VerifiedDetection Analysis

A detection contains the following command line:

C:\Windows\system32\cmd.exe /Q /c echo ping -n 1 google.com ^> \\VICTIM-MACHINE\C$\__output 2^>^&1 >  
C:\Windows\pJYOrvQB.bat & C:\Windows\system32\cmd.exe /Q /c C:\Windows\pJYOrvQB.bat &del C:\Windows\pJYOrvQB.bat

What activity does this describe?

Explanation

The command performs a single ping to google.com, capturing the result through a temporary batch file and an administrative C$ share, then deletes the batch file. This is consistent with Impacket-style remote command execution and is used to test network connectivity for reconnaissance. MITRE ATT&CK documents both Impacket smbexec.py use with C$ shares and ping-based connectivity checks as reconnaissance.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!