CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ49

VerifiedSearch and Investigation Tools

Falcon has detected and blocked credential-dumping activity on a domain controller. No obvious credential-dumping tools were identified in the detection.

What should be the next step in the investigation?

Explanation

Investigating the events immediately before, during, and after a credential-dumping alert can reveal the initiating process, execution chain, affected accounts, and related lateral-movement activity. An Advanced Event Search focused on the alert’s surrounding time window provides the necessary endpoint context when no obvious dumping tool is identified.

Community Discussion

No comments yet. Be the first to start the discussion!