CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ85

VerifiedSearch and Investigation Tools

You observe numerous command-line processes calling back to an unusual domain and are reviewing it in the Bulk Domain Investigate dashboard.

What should you do next?

Explanation

A suspicious domain contacted by many command-line processes should be assessed through its reputation and correlated with connection history to determine whether the pattern indicates malicious activity, such as command-and-control communications.

Community Discussion

No comments yet. Be the first to start the discussion!