CCFH-202B: CrowdStrike Certified Falcon Hunter

ProcessRollup2 records process execution data, while NetworkConnectIP4 records IPv4 network connections. The TargetProcessId on the process event is matched to ContextProcessId on the network event; filtering the process event to powershell.exe before that join identifies IPv4 connections attributable to PowerShell.