CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ73

VerifiedDetection Analysis

You are examining a process tree in which WmiPrvSE started PowerShell with the following command:

Question Image

What does this command do?

Explanation

DownloadString retrieves the PowerSploit Invoke-Shellcode script from GitHub, and IEX executes it. The specified windows/meterpreter/reverse_http payload uses -Lhost 172.17.0.21 and -Lport 8080 as its callback endpoint, establishing a reverse connection.

Community Discussion

No comments yet. Be the first to start the discussion!