CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ79

VerifiedHunting Analytics

Which hunting query’s results might show that an adversary is conducting reconnaissance from a particular host?

Explanation

A query for ReconDetected events filtered by aid=?aid isolates reconnaissance detections on the specified host. Collecting the associated ImageFileName and CommandLine values identifies the processes and commands involved in that host’s reconnaissance activity.

Community Discussion

No comments yet. Be the first to start the discussion!