CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ47

VerifiedDetection Analysis

A detection identifies a malicious PowerShell script with the following process flow:

Unknown Process => chrome.exe => wscript.exe => powershell.exe

Which process should be investigated further to determine the script’s source?

Explanation

wscript.exe is the direct parent of powershell.exe and can run script files through Windows Script Host. Its command-line arguments and associated script file provide the direct source that launched the malicious PowerShell script.

Community Discussion

No comments yet. Be the first to start the discussion!