CCFR-201b CrowdStrike Certified Falcon Responder Question and Answers

Malware Action

Impact

Intelligence-Based Match

Script-Based Execution

You can ' t export detailed event data from a detection, you have to use the Process Timeline or an Event Search

In Full Detection Details, you expand the nodes of the process tree you wish to expand and then click the " Export Process Events " button

In Full Detection Details, you choose the " View Process Activity " option and then export from that view

From the Detections Dashboard, you right-click the event type you wish to export and choose CSV. JSON or XML

Eternal Blue

Defense Evasion

Emotet

Phishing

The percentage of the CPU being consumed by the network and disk.

The specific number of telemetry events recorded for network and disk activity by that process.

The total size in megabytes of the data sent over the network and written to disk.

The number of other hosts that have seen similar network and disk activity.

Detect only

Allow

Block

Detect only

Allow

Block

Allow

No action

Detect only

No action

It is the standard Process ID (PID) assigned by the Windows Task Manager.

It is a sensor-assigned, environment-wide unique decimal identifier for that specific process instance.

It represents the memory offset where the process ' s primary thread began.

It is a count of the total number of child processes spawned by that executable.

It provides best practices for different cybersecurity domains, such as Identify and Access Management

It provides a step-by-step cyber incident response strategy

It provides the phases of an adversary ' s lifecycle, the platforms they are known to attack, and the specific methods they use

It is a system that attributes an attack techniques to a specific threat actor

The file has been successfully quarantined by the sensor.

There is related Intelligence (Intel) data available for this detection.

The process has been identified as a legitimate system file.

The host is currently undergoing a remote live response session.

MITRE-Based Falcon Detections Framework

NIST Incident Response Lifecycle

Falcon Adversary Attribution Matrix

Cyber Kill Chain Classification

30 days

60 days

90 days

1 year

Explore, Keep Access, Gain Access, Falcon Detection Method, Contact Controlled systems, Follow Through

Reconnaissance, Delivery, Weaponization, Exploitation, Installation, Command and Control

Identify, Protect, Detect, Respond, Recover, Lessons Learned

Triage, Containment, Remediation, Eradication, Reporting, Recovery

Filename-based allowlist

Hash-based allowlist

Path-based allowlist

Command-line allowlist

Timestamp

Event Name

PID (Process ID)

CPU Temperature

IP searches provide manufacture and timezone data that can not be accessed anywhere else

IP searches allow for multiple comma separated IPv6 addresses as input

IP searches offer shortcuts to launch response actions and network containment on target hosts

IP searches provide host, process, and organizational unit data without the need to write a query

The total CPU usage of the parent process.

The command-line arguments used during the task creation.

The Agent ID (AID) of the host where the detection fired.

The physical location of the endpoint in the office.

Process Creation

File Creation

Domain Name

Scheduled Task

Investigate > Connect to host

View Incident > Connect to host

Actions > Connect to host

IP Summary information from Falcon events containing the given IP

Threat Graph Data for the given IP from Falcon sensors

Unmanaged host data from system ARP tables for the given IP

IP Detection Summary information for detection events containing the given IP

Reduce false positives based on Next-Gen Antivirus settings in the Prevention Policy

Reduce false positives of behavioral detections from IOA based detections only

Reduce false positives of behavioral detections from IOA based detections based on a file hash

Reduce false positives of behavioral detections from Custom IOA and OverWatch detections only

Host Search

Hash Search

User Search

IP Search

CSV

JSON

PDF

Gzip

Command Line

User Name

HTTP Post contents

SHA256 Hash

Agent ID (AID) and Local IP Address

Agent ID (AID) and Target Process ID (TargetProcessId_decimal)

Hostname and MAC Address

User SID and SHA256 Hash

Grouped by Process

Grouped by Alert

Grouped by File Path

Grouped by Severity

Sensor Update Policy

Prevention Policy

Response Policy

Quarantine Management Policy

Process related events can be filtered to display specific event types

Suspicious processes are color-coded based on their frequency and legitimacy over time

Processes responsible for spikes in CPU performance are displayed overtime

A visual representation of Parent-Child and Sibling process relationships is provided

Registry Key Operations

Network File Transfer ports

Unique Executables Written and Process Executions

BIOS and Hardware modification logs

Use the put command to place the script on the host and runscript -hostpath to run the script

Break the script into multiple files under 40 KB and run each one sequentially with runscript -raw

Use the put command to place the script on the host and runscript -cloudfile to run the script

Use the runscript -cloudfile command to upload the script from your local machine and execute it directly

ProcessTimeline Link

PID

UTCtime

Process ID or Parent Process ID

SHA256

MD5

File Type

Filename

1 day

7 days

14 days

30 days

It represents the specific software version or exploit code used to crash a service.

It is the adversary ' s tactical goal: the fundamental reason for performing a specific action.

It is the unique cryptographic hash associated with a malicious file discovered on disk.

It is the specific command-line string used to execute a PowerShell script.

ProcessRollup2

FileCreation

NetworkConnect

RegistryUpdate

Severity

Event Types

User Name

Detection ID

Severity

CrowdScore

Time

Triggering File

Filename

Host Name

Hash

Date Quarantined

Scripts (.ps1, .sh)

Executables (.exe)

Executions (Process starts)

Archive files (.zip, .7z)

< Technique > , < Tactic > , < Objective >

< Objective > , < Tactic > , < Technique >

< Objective > , < Technique > , < Tactic >

< Tactic > , < Objective > , < Technique >

Theprocess explorer opens and the detection is removed from the console

The process explorer opens and you ' re able to view the processes and process relationships

The process explorer opens and the detection copies to the clipboard

The process explorer opens and the Event Search query is run for the detection

Host Timeline

Process Timeline

User Timeline

Administrative Timeline

Machine Learning

Behavioral

Intelligence

Custom IOA

They allow for searching multiple items (up to 500) at once.

Regular Expressions (Regex) are allowed within the search fields.

Search results can be exported for further analysis.

They search across historical telemetry in the cloud.

Selecting a Rule Type (e.g., Process Creation).

Specifying the Severity level of the resulting detection.

Assigning a specific host group to the IOA rule at the time of creation.

Providing a unique name for the rule.

Process Tree > PNG

Process Tree > JPEG

Detection > CSV

Process Tree > JSON

List of running services and drivers.

Macro Execution History for Microsoft Office products.

Recent network connections and IP addresses.

List of local user accounts and administrators.

Indicator of Compromise (IOC)

Indicator of Attack (IOA)

Known Malware Alert

Intelligence Data Match

A remote service exploitation targeting a system process.

A phishing attack where the user executed a malicious file from the desktop.

A scheduled task running under the SYSTEM account.

A supply chain attack targeting the Windows Boot manager.

/tmp/cs/quarantine

/Library/CS/Quarantine

/Applications/Falcon/Quarantine

/Users/Shared/CS/Quarantine

event_type

event_simpleName

action_id

process_status

It allows for the automated decryption of files affected by ransomware.

It provides a standardized view of the attack lifecycle to help understand adversary behavior.

It enables the sensor to block kernel-level drivers from unknown publishers.

It provides a real-time count of the total number of files on the endpoint.

by using Hosts page in the Investigate tool

by reviewing " Groups " in Host Management under the Hosts page

under " Audit " by running Sensor Visibility Exclusions Audit

only by searching event data using Event Search

It allows a responder to upload a file to the cloud for detonating in a sandbox.

It allows for a summary view of the environment-wide presence of a given list of multiple hashes.

It allows an administrator to block a single hash across all machines.

It provides a detailed process tree for every execution of a single hash.

A global intelligence report about a new adversary.

A specific detection that occurred on a particular host.

The main settings menu of the Falcon console.

The help documentation in the Support portal.

Only detection events

All cloudable events

Only process events

Only network events

browser_type

index

cpu_usage_percent

monitor_mode

A detection triggered by the Machine Learning engine.

A Falcon Overwatch-pushed detection.

A detection based on a Custom IOA.

A detection matched against a known Intelligence IOC.