CCFH-202B: CrowdStrike Certified Falcon Hunter

NetworkConnectIP4 provides the remote IP address, while ProcessRollup2 provides process details such as the file name, user name, and command line. Correlating the network event’s ContextProcessId with the process event’s TargetProcessId identifies connections made by wget; grouping the resulting records by RemoteAddressIP4 produces the address overview. CrowdStrike documents this same process-to-network correlation, matching ContextProcessId from network events to TargetProcessId from ProcessRollup2.