CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ33

VerifiedEvent Search

A detection includes a suspicious process named reallysus.exe. Its TargetProcessId is 123456789.

Which query returns every event associated with this process?

Explanation

Process execution and lifecycle records use TargetProcessId; subsequent activity performed in the process context uses ContextProcessId; and activity initiated through RPC can use RpcClientProcessId. An OR query across these three fields captures the process record and its directly or RPC-associated telemetry.

Community Discussion

No comments yet. Be the first to start the discussion!