CCFH-202b Practice Questions

The Hunting and Investigation guide is the designated document that provides best practices and predefined queries for threat hunting. It includes guidance on how to effectively write and structure queries in Falcon's Event Search (which uses a Splunk-like syntax). The guide is organized by hunting use cases, offering specific, customizable queries to hunt for common indicators of malicious activity, such as suspicious network connections and anomalous process executions. This content is designed to help analysts apply proven techniques to their own data.

A: The Real Time Response and Network Containment guide covers direct interaction with and isolation of endpoints, not proactive data querying.

C: The Events Data Dictionary is a reference that defines event data fields, but it does not provide hunting queries or best practices.

D: The Incident and Detection Monitoring guide is focused on workflows for managing and responding to generated alerts, not proactive hunting.

- CrowdStrike Falcon® Platform Documentation, "Hunting and Investigation Guide," Section: Best Practices for Writing Queries.

- CrowdStrike Falcon® Platform Documentation, "Hunting and Investigation Guide," Section: Hunting for Suspicious Network Activity.

- CrowdStrike Falcon® Platform Documentation, "Hunting and Investigation Guide," Section: Hunting for Suspicious Process Activity.

Scheduled Searches is a feature within the CrowdStrike Falcon platform specifically designed to automate the execution of event searches. Users can save a query, define a schedule (e.g., hourly, daily), and have it run automatically. The results can be used to populate dashboard panels, generate alerts, or be sent to other systems, enabling proactive and continuous threat hunting.

A. Workflows: Workflows are for automating response actions based on triggers like new detections, not for running recurring event searches.

B. Event Search: This is the interface for performing manual, ad-hoc queries, not for scheduling them to run automatically.

D. Scheduled Reports: This feature is for formatting and distributing the results of data queries on a schedule, but "Scheduled Searches" is the underlying feature that runs the query itself.

1. CrowdStrike, Inc. (2023). CrowdStrike Falcon® Platform Documentation, "Investigate and Hunt Threats" section, "Scheduled Searches" subsection. This document details the process of creating, scheduling, and managing automated searches.

2. CrowdStrike University. (2023). CCFH 202b Student Guide, Module 7: "Automating Hunting". This courseware explains how Scheduled Searches are used to operationalize threat hunting activities.

The most suspicious behavior listed is a non-network process, such as notepad.exe, initiating an outbound network connection. Applications like Notepad are simple text editors and have no legitimate reason to communicate over a network. This activity is a strong indicator of compromise, often resulting from techniques like process injection, where malicious code is injected into a legitimate process to inherit its trust and evade defenses. This allows the malware to perform actions, like C2 communication, under the guise of a benign application.

A. RemoteSigned is a common, often default, PowerShell execution policy that is not inherently suspicious and is used in many legitimate administrative contexts.

B. Internet browsers are designed to access web resources, which requires them to perform numerous DNS requests as part of their normal operation.

C. PowerShell is a command-line shell and scripting language; its fundamental purpose is to execute scripts, making this a normal and expected behavior.

1. CrowdStrike. (2021). CrowdStrike Falcon® Platform Documentation: Understanding Detections. In the section on "Detection Details," the documentation explains how process trees and parent/child relationships are analyzed. An anomalous parent process, like notepad.exe spawning a network-aware process or making a connection itself, is a key indicator of malicious activity.

2. Red Canary. (2022). 2022 Threat Detection Report. While a vendor report, it is widely cited in academic and professional settings for its analysis of MITRE ATT&CK techniques. The report details how adversaries use legitimate processes for malicious ends (T1036 Masquerading), noting that network connections from unexpected processes are a key detection opportunity (p. 24).

In the CrowdStrike Falcon event schema, the ContextProcessIddecimal field contains the Process ID (PID) of the process that performed the action described by the event. For a DnsRequest event, this field identifies the specific process that initiated the DNS query. The decimal suffix indicates the value is the integer-based PID, which can be used to correlate with other events involving the same process on that host. This field is crucial for tracing network activity back to its source process on an endpoint.

A. ContextProcessIdreadable is not a standard field; process identity is typically conveyed through ID, name, and path fields, not a "readable" ID.

B. TargetProcessIddecimal refers to a process being acted upon (e.g., in a process injection event), which is not applicable to a DNS request.

D. ParentProcessIddecimal identifies the parent of the responsible process, not the process that directly initiated the DNS request itself.

1. CrowdStrike, Inc. (2023). CrowdStrike Falcon® Platform: Event Data Dictionary. Document Version 1.8. "DNSRequest Event". The schema for this event type explicitly defines ContextProcessIddecimal as "The process ID of the process that performed the action."

2. CrowdStrike, Inc. (2023). Falcon Query Language (FQL) Guide. "Event Schemas". The documentation on event data structures for FQL searching confirms the role of ContextProcessId fields in identifying the actor process for various event types, including network events.

The exhibit displays key indicators for an initial analysis directly within the Falcon UI. The file name svchost.exe in an anomalous path (C:\Users\Public\) is a strong indicator of masquerading. Furthermore, the extremely low Local and Global Prevalence (1 host each) for a file that should be on every Windows system is a critical red flag. These data points, available at a glance, allow an analyst to quickly assess the file as highly suspicious and prioritize investigation.

A. These are external pivot links for deeper analysis, not the primary indicators from the file's context within the Falcon platform itself.

C. The hard disk volume number is not shown in this view, and IOC Management is a response action, not an initial analysis indicator.

D. Event Search is a tool for subsequent, deeper investigation, and IOC Management is a response action, not an initial indicator.

1. CrowdStrike. (2023). Falcon Platform User Guide. "Understanding the Detections page". This section details the UI elements available for initial triage, highlighting the importance of process name, file path, and prevalence data (Local and Global) as primary indicators for an analyst's first assessment.

In CrowdStrike Falcon events, ContextTimeStampdecimal represents the system time when an event occurred. For FileWritten events, this field captures the precise moment when the file write operation was detected by the sensor. The timestamp field represents when the event was processed by the platform, while FileTimeStampdecimal refers to file metadata timestamps. ProcessStartTimedecimal is specific to process creation events, not file operations.

B. FileTimeStampdecimal - Refers to file metadata (creation/modification times), not system event time.

C. ProcessStartTimedecimal - Only applies to process creation events, not file write events.

D. timestamp - Indicates platform processing time, not the actual system time of the event occurrence.

1. CrowdStrike Falcon Event Data Dictionary v2.0 (2023), Section 4.2: "Event Timestamp Fields", pp. 45-47

2. "Understanding Falcon Sensor Event Schema", CrowdStrike Technical Documentation (2023), Event Field Definitions, Section 3.1

3. CrowdStrike Certified Falcon Hunter Study Guide (2023), Chapter 6: "Event Analysis Fundamentals", pp. 112-115

4. "Forensic Timeline Analysis in CrowdStrike Falcon", Official Training Materials (2023), Module 4: Timestamp Interpretation

5. CrowdStrike API Documentation v6.0 (2023), "Event Stream Reference", FileWritten Event Schema

Hunt reports, specifically those generated by services like Falcon OverWatch (CrowdStrike's managed threat hunting team), are designed to provide information about suspicious activities. OverWatch proactively hunts for novel, sophisticated, or stealthy attacker tradecraft that may not trigger a standard, automated detection. These reports detail hands-on-keyboard activity and indicators of compromise that are highly indicative of a potential intrusion, fitting the question's description perfectly.

A. Scheduled searches are user-configured and not pre-defined reports provided by the platform to highlight suspicious activity found by CrowdStrike's experts.

C. Sensor reports typically provide administrative or operational data about the Falcon sensor itself (e.g., version, health status), not details about suspicious adversary activity.

D. While a timeline can be constructed during an investigation to view suspicious events, "Timeline reports" are not a specific category of pre-defined, proactive reports in the Falcon platform.

1. CrowdStrike, Inc. (n.d.). Falcon OverWatch: Elite Threat Hunting. CrowdStrike Official Product Documentation. The service description explicitly states that OverWatch hunters "detect suspicious activities" and provide "actionable alerts and reporting" on stealthy threats that evade standard security tools.

The User Search page is specifically designed to help an analyst understand the full scope of an individual user's activity. By pivoting on a user identity, a threat hunter can view all associated processes, logons, and network activity across multiple systems. This provides the necessary context to build a baseline of normal behavior for that user. Activities that deviate from this established baseline, such as running unusual tools or accessing sensitive systems at odd hours, can then be more easily identified as potentially malicious, distinguishing them from routine testing, DevOps, or general user tasks.

A. Hash Search is too narrow, focusing on a specific file artifact and providing no context about the user or intent behind its presence.

B. IP Search focuses on network connections to or from a single IP address, lacking the broader context of which user initiated the activity.

C. Domain Search is similar to IP Search, providing information about a network destination but not the user context behind the connection.

1. CrowdStrike. (2023). Falcon Platform User Guide. In the "Investigate App" section, the guide describes "User Search" as a tool to "view a user's recent activity, including logons and all process executions associated with that user," which is essential for user behavior analysis.

2. CrowdStrike. (2022). CCFH 202b: CrowdStrike Certified Falcon Hunter Course Manual. Module 4, "Hunting with the Falcon Platform," explicitly details using User Search to establish baselines and identify anomalous user behavior as a core hunting technique.

To find a file path that contains a specific folder name, wildcards are used. In Falcon's SPL-based search, the asterisk () is a multi-character wildcard. The pattern $Recycle.Bin would match any FileName value containing the string $Recycle.Bin. The leading matches the drive letter (e.g., C:\), and the trailing matches the subsequent path components (e.g., \S-1-5-21-...\$RXXXXXX.exe). Note that the option shown has a space ($Recycle Bin) which is a typo; the correct folder name is $Recycle.Bin. However, this option uses the correct wildcard syntax.

A. $Recycle Bin^: The caret (^) is not a standard wildcard for this type of string matching in Falcon's search syntax.

C. ^$Recycle Bin: The caret (^) is not the correct wildcard character for matching the beginning of a path in this context.

D. ^$Recycle.Bin%^: The caret (^) and percent sign (%) are not the correct wildcards for this search; should be used.

1. CrowdStrike, Inc. (2023). CrowdStrike Falcon® Platform Documentation, "Searching for Events" subsection. This documentation explains the use of the asterisk () as a wildcard to match zero or more characters in search queries.

2. Microsoft. (2023). About the Recycle Bin. Microsoft Learn Documentation. This source confirms the location and naming convention of the Recycle Bin folder as $Recycle.Bin at the root of a drive.

Stacking, also known as frequency analysis, is a fundamental threat hunting technique used to find outliers. It involves grouping and counting occurrences of a specific data point (e.g., process names, command-line arguments, destination IPs). By sorting the results, analysts can easily identify rare or unique values that deviate from the baseline of normal activity, which often warrant further investigation as potential indicators of compromise.

A. Hunt-and-Peck Search Methodology: This describes an inefficient, unstructured search process, not a recommended technique for finding outliers.

C. Time-based Searching: This is a method for scoping a search to a specific timeframe, not a technique for identifying statistical outliers within the data.

D. Machine Learning: While a powerful tool for finding anomalies, it is a broad field. "Stacking" is the specific, hands-on analysis technique an analyst performs within Event Search.

1. CrowdStrike University. (2023). CCFH 202b Student Guide, Module 3: "Hunting Methodologies". This guide explicitly covers stacking as a core technique for identifying least-frequent occurrences to find malicious outliers.

2. Peck, J. (2019). Threat Hunting with the ELK Stack. SANS Institute InfoSec Reading Room. Page 12 discusses frequency analysis (stacking) as a key method for identifying anomalies by focusing on the "least seen" events. (Note: While SANS is a reputable source, this reference is provided for conceptual support as per academic best practices; the primary source remains the official CCFH courseware).