CCFH-202 Crowdstrike Certified Falcon Hunter Practice Questions

Exploitation is the phase where the adversary takes advantage of a vulnerability to execute code on a victim's system.

Command and Control is the phase where the malware establishes a communication channel back to the attacker to receive instructions.

Actions on Objectives is the final phase where the adversary accomplishes their ultimate goal, such as data exfiltration or destruction.

The SetFileTimestamp event is specifically generated when an action modifies a file's timestamps (creation, modification, access). This event is the most direct and high-fidelity source for detecting Timestomping activity, as it captures the exact moment the modification occurred and which process was responsible.

The Process Timeline initially focuses on the events directly related to the detection. The 'Load Surrounding Events' button is specifically designed to broaden this view, pulling in events that occurred on the same host shortly before and after the detection. This provides crucial context for understanding the full attack sequence.

While administrators frequently use RDP to connect to servers (workstation-to-server), it is highly unusual for them to RDP from one workstation to another (workstation-to-workstation). This pattern is a classic indicator of adversary lateral movement, where an attacker who has compromised one machine uses it as a pivot point to access another.

Within the built-in Hunt Reports, the 'Suspicious File Authentications' report is specifically designed to highlight executables that have invalid or untrusted digital signatures. This is a common characteristic of malware or attacker tools, making this report a valuable starting point for hunts.

Even if a file is deleted from the disk, CrowdStrike Falcon captures the hash of any process at the time of execution and records it within the ProcessRollup2 event. A threat hunter can extract this SHA256 hash and use the global Hash Search feature to find every other instance where that exact binary was executed across the entire environment, regardless of its filename or if it was subsequently deleted.

This query correctly identifies DNS tunneling by first filtering for DNS request events. It then uses the rex command with a regular expression to extract the root domain (e.g., 'example.com' from 'a.b.c.example.com'). Finally, it uses stats to calculate the distinct count (dc) of unique full DomainName values, grouping them by the agent ID (aid) and the extracted root_domain. A high subdomain_count for a single root_domain on a specific host is a strong indicator of DNS tunneling.

In the Falcon event model, the 'Parent Process' is the process that created the event's target. The 'Target Process' is the process on which the action occurred. In the event where cmd.exe launches powershell.exe, cmd.exe is the Parent Process and powershell.exe is the Target Process. In the preceding event where winword.exe launched cmd.exe, winword.exe was the Parent Process.

The certutil.exe binary is not expected to make network connections during its normal certificate management functions. An outbound network connection is highly anomalous and directly supports the hypothesis of it being used to download files.

These specific command-line arguments are used with certutil.exe to fetch a file from a URL and save it to the local disk. Their presence is a key indicator that the tool is being used for file download purposes, which is a common TTP for adversaries.

The -e or -encodedcommand parameter in PowerShell accepts a base64-encoded string. Adversaries use this to hide their commands from simple keyword-based detection and logging. This is a classic example of T1027: Obfuscated Files or Information, specifically sub-technique T1027.010 Command and Scripting Obfuscation.