CCFH-202B: CrowdStrike Certified Falcon Hunter

Question

You are investigating detections involving network-reconnaissance activity, including multiple commands run by cmd.exe, and must identify the root cause.

How can you rapidly verify whether these commands resulted from an exploited vulnerability?

Explanation

A complete process tree identifies the executable and parent-process chain that launched cmd.exe. If the chain originates from a vulnerable service, application, or other abnormal process, it provides direct evidence that command execution may have followed exploitation rather than normal administrative activity.

CCFH-202B: CrowdStrike Certified Falcon Hunter

AstroTutor

Notes

Readiness

QuestionQ81

Community Discussion