CCFH-202B: CrowdStrike Certified Falcon Hunter

Question

An alert is received for this process tree:

IIS/W3WP.exe -> Powershell.exe -> cmd.exe -> whoami.exe -> net1.exe

Which of the following describes what has happened?

Explanation

An IIS worker process spawning PowerShell and command-shell utilities such as whoami and net1 indicates likely post-compromise discovery activity. These commands are commonly used to enumerate the current user context and network or domain information from a compromised web server.

CCFH-202B: CrowdStrike Certified Falcon Hunter

AstroTutor

Notes

Readiness

QuestionQ6

Community Discussion