CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ77

VerifiedSearch and Investigation Tools

You identify a user instance in your environment using a Cloudflared tunnel daemon that is producing unusual command-line activity.

What actions would you take to determine whether the unusual activity is malicious or legitimate?

Explanation

Cloudflared can support legitimate remote-access and application-tunneling workflows, while also being susceptible to abuse. Reviewing the associated command lines and comparing them with approved, known legitimate usage establishes whether the observed behavior matches normal operations before escalation or remediation.

Community Discussion

No comments yet. Be the first to start the discussion!