CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ3

VerifiedEvent Search

Falcon is producing detections for a malicious file, evil.exe, across several hosts and varying file paths as end users try to run it.

Which query can proactively hunt for locations where the file exists before a user executes it?

Explanation

A broad hunt should search both ProcessRollup2 and SyntheticProcessRollup2 telemetry, match evil.exe case-insensitively, extract the final filename from the image path, and aggregate the results by host, path, and command-line details. This identifies occurrences across hosts without limiting the search to a single agent ID or a particular user-path pattern.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!