CCFR-201b CrowdStrike Certified Falcon Responder Question and Answers

The Process Activity View creates a consolidated view of all detection events for that process that can be exported for further analysis

The Process Activity View will show the Detection time of the earliest recorded activity which might indicate first affected machine

The Process Activity View only creates a summary of Dynamic Link Libraries (DLLs) loaded by a process

The Process Activity View creates a count of event types only, which can be useful when scoping the event

Filename

Host Name

Hash

Date Quarantined

SHA256

MD5

File Type

Filename

The standard Process ID (PID) assigned by the Windows operating system.

A sensor-assigned decimal number that is unique for each process across time and hosts.

The memory address where the process’s executable is loaded.

The total number of seconds the process has been running.

Theprocess explorer opens and the detection is removed from the console

The process explorer opens and you ' re able to view the processes and process relationships

The process explorer opens and the detection copies to the clipboard

The process explorer opens and the Event Search query is run for the detection

File Metadata

Process Timeline

Intel Indicators

Execution History

Analyzing historical logs from the past 90 days to find missed threats.

Investigating incoming telemetry in real time or on a near real-time basis to catch active threats.

Scanning every file on a hard drive once per week for dormant viruses.

Manually updating the Falcon sensor on every machine in the fleet.

It allows for the automated decryption of files affected by ransomware.

It provides a standardized view of the attack lifecycle to help understand adversary behavior.

It enables the sensor to block kernel-level drivers from unknown publishers.

It provides a real-time count of the total number of files on the endpoint.

PowerShell spawned Notepad.exe, which injected a thread back to Excel.exe

The thread injection was considered a Medium severity injection

PowerShell spawned Notepad.exe, which injected a thread back to PowerShell

Notepad.exe injected itself into Excel.exe

Use the Falcon console to network contain Bob-Desktop

Access Bob-Desktop via RTR and run the contain command

Find the IP address associated with the exfiltration and block it by creating an IOA

Find the IP address associated with the exfiltration and block it by creating an IOC

C:\Temp\CrowdStrike\Quarantine

C:\Windows\System32\Drivers\CrowdStrike\Quarantine

C:\Program Files\CrowdStrike\Quarantine

C:\Users\Public\CrowdStrike\Quarantine

It provides a summary of all alerts over a selected time period.

It can be filtered by host name or severity.

Clicking on a ProcessID value within the report pivots to a pre-populated Event Search.

The report can be exported to a CSV file.

Set the -timeout argument to off

Set the -timeout argument to a longer period

Rerun the script

Change the timeout policy in the console settings

Reduce false positives based on Next-Gen Antivirus settings in the Prevention Policy

Reduce false positives of behavioral detections from IOA based detections only

Reduce false positives of behavioral detections from IOA based detections based on a file hash

Reduce false positives of behavioral detections from Custom IOA and OverWatch detections only

Identifying future threats using predictive AI models.

Applying an investigative approach across historical timed buckets of telemetry to find past activity.

Terminating a malicious process as it starts to execute.

Recovering files that were encrypted by a ransomware attack.

A managed neighbor is currently network contained and an unmanaged neighbor is uncontained

A managed neighbor has an installed and provisioned sensor

An unmanaged neighbor is in a segmented area of the network

A managed sensor has an active prevention policy

User Search

Host Search

Hash Search

IP Search

Timestamp

Event Name

PID (Process ID)

CPU Temperature

Sensor Update Policy

Prevention Policy

Response Policy

Quarantine Management Policy

Activity

Investigate

Configuration

Dashboards

Create a Quarantine Rule that will quarantine all identified artifacts across the entire environment

Create Custom IOA rules to prevent the execution of these artifacts

Create a workflow to trigger on a new endpoint detection, query the telemetry data of the endpoint for known artifacts, and select Remove All Associated Artifacts as an action

Create a workflow to trigger on a new endpoint detection, conditions that match the detection, and as an action a PowerShell script to kill associated processes and remove all artifacts

ParentProcessld_decimal and aid

ResponsibleProcessld_decimal and aid

ContextProcessld_decimal and aid

TargetProcessld_decimal and aid

Local prevalence is the frequency with which the hash of the triggering file is seen across the entire Internet

Local Prevalence tells you how common the hash of the triggering file is within your environment (CID)

Local Prevalence is the Virus Total score for the hash of the triggering file

Local prevalence is the frequency with which the hash of the triggering file is seen across all CrowdStrike customer environments

Filter on ' Analyst: Alex '

Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections

Filter on ' Hostname: Alex ' and ' Status: In-Progress '

Filter on ' Status: In-Progress ' and ' Assigned-to: Alex*

IP Summary information from Falcon events containing the given IP

Threat Graph Data for the given IP from Falcon sensors

Unmanaged host data from system ARP tables for the given IP

IP Detection Summary information for detection events containing the given IP

The file is downloaded as a 7-zip archive and requires the password ' infected ' for extraction.

The file is downloaded in its raw binary format without any encryption or compression.

The file is downloaded as a standard ZIP archive but does not require a password to open.

The file is downloaded as an encrypted .exe that can only be opened by a CrowdStrike sensor.

Group by Filename

Group by Hash

Group by Command Line

Group by User

An adversary is trying to keep access through persistence by creating an account

An adversary is trying to keep access through persistence using browser extensions

An adversary is trying to keep access through persistence using external remote services

adversary is trying to keep access through persistence using application skimming

Registry Key Operations

Network File Transfer ports

Unique Executables Written and Process Executions

BIOS and Hardware modification logs

A list of every time a user has logged in or out of the machine.

Every host-relevant event (Process, File, Registry, Network) recorded in a given timeframe.

A history of every hardware change or driver update on the endpoint.

A log of every time the Falcon sensor was updated or restarted.

The sensor will block the activity and alert the user with a pop-up.

The sensor will create detections with ' Informational ' severity but will not block the activity.

The sensor will log the activity in the audit logs but will not generate a detection.

The sensor will automatically isolate the host from the network.

Glob Syntax

Kleene Star Syntax

RegEx

SPL(Splunk)

Global (applies to all hosts in the environment)

Only the specific host where the file was originally quarantined

All hosts within the same host group as the source host

All hosts running the same operating system version

Do nothing, as this file is common and well known

From detection, click the VT Hash button to pivot to VirusTotal to investigate further

From detection, use API manager to create a custom blocklist

From detection, submit to FalconX for deep dive analysis

Only detection events

All cloudable events

Only process events

Only network events

Show Responsible Process Data

Inspect

Show +/- 10-minute windows of events

Investigate Host

45 Days

90 Days

Days

Quarantined files are not deleted

To manage the installation and update of Falcon sensors.

To provide a summary of the current threat state and active detections in the environment.

To view the raw telemetry of every event happening on the network.

To audit the changes made by other Falcon administrators.

An interactive user login via RDP.

A Windows Service or a process launched by the Service Control Manager.

A web browser download initiated by the end user.

A script executed directly from a removable USB drive.

A remote service exploitation targeting a system process.

A phishing attack where the user executed a malicious file from the desktop.

A scheduled task running under the SYSTEM account.

A supply chain attack targeting the Windows Boot manager.

Use the put command to place the script on the host and runscript -hostpath to run the script

Break the script into multiple files under 40 KB and run each one sequentially with runscript -raw

Use the put command to place the script on the host and runscript -cloudfile to run the script

Use the runscript -cloudfile command to upload the script from your local machine and execute it directly

Investigate the host for manipulation of the root folder

Investigate the host for any Potentially Unwanted Programs (PUP)

Investigate the host for an interactive remote terminal

Investigate the host for developer activity

Incidents aggregate related detections to reduce alert fatigue.

Incidents are defined as inactive after 10 hours pass without any new related activity.

A high CrowdScore indicates a higher likelihood of a sophisticated or widespread attack.

CrowdScore is only visible to users with the ' Falcon Administrator ' role.

Filename-based allowlist

Hash-based allowlist

Path-based allowlist

Command-line allowlist

Draw Process Explorer

Show a +/- 10-minute window of events

Show a Process Timeline for the responsible process

Show Associated Event Data (from TargetProcessld_decimal or ContextProcessld_decimal)

10%

20%

50%

100%

Operating System

File Signature

Command Line

Sensor Version

45 Days

30 Days

Quarantined files are never deleted from the host

90 Days

The Response Policy must allow for the execution of Workflows

The script must exist on the host locally

The script must contain input and output JSON fields

The Share with workflows option must be enabled for the custom script

The file is common off-the-shelf malware seen globally.

The file is internally developed software unique to the organization.

The file is a standard Windows system component.

The file is a known commodity tool used by many different actors.

An adversary uses an automated script to bruteforce S3 bucket permissions.

An adversary uses a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment.

An adversary executes an API call to terminate all running EC2 instances in a region.

An adversary deploys a crypto-miner inside a compromised Docker container.

Identifies a detailed list of all process executions for the specified hashes

Identifies hosts that loaded or executed the specified hashes

Identifies users associated with the specified hashes

Identifies detections related to the specified hashes

Severity

CrowdScore

Time

Triggering File

Investigate > Quarantine

Endpoint Security > Monitor > Quarantined Files

Configuration > Response > Quarantine

Dashboards > Security > Quarantine

Process Timeline

Host Timeline

User Timeline

Network Timeline

Process Termination

File Quarantine

Process Restart

Network Isolation

Inspect

Show Responsible Process Data

Draw Process Explorer

Show Associated Event Data

The External IP and the Username of the logged-in user.

The Agent ID (AID) and the Target Process ID (TargetProcessId_decimal).

The MAC Address of the host and the SHA256 hash of the file.

The Policy ID and the timestamp of the first event.

Remote exploitation of a system service

User execution via a Phishing email or drive-by download

Malicious persistence via a WMI event subscription

Credential theft through a compromised Domain Controller