CCFR-201 Crowdstrike Certified Falcon Responder Practice Questions

The diagram shows a classic spear-phishing attack chain. The user opens an email in outlook.exe, which contains a malicious Word document, launching winword.exe. The Word document exploits a vulnerability in the old Equation Editor (eqnedt32.exe), which then spawns a command shell (cmd.exe) to execute a PowerShell payload (powershell.exe). The root of this entire chain is outlook.exe, representing the initial entry vector via a malicious email.

The Hash Search tool is specifically designed for this purpose. By inputting an MD5, SHA1, or SHA256 hash, a responder can query the Falcon platform to see a list of all endpoints where a file with that exact hash has been observed. This is the most efficient method for scoping the presence of a specific malicious file across the enterprise.

'ML-Based Prevention' signifies that CrowdStrike's machine learning engine analyzed the static attributes of a file (without executing it) and determined it to be malicious. This is a key component of next-generation antivirus (NGAV) capabilities, allowing Falcon to block zero-day malware that does not have a known signature or hash.

This statement is false. While reg query is for reading registry values, RTR also provides commands like reg set and reg delete which allow a responder with appropriate privileges to modify and delete registry keys and values, which is a critical capability for remediating persistence mechanisms.

When svchost.exe appears without a parent, it is often because it was started as a Windows Service. The Process Tree focuses on direct parent-child relationships and may not show the service creation event. Pivoting to the Host Timeline provides a chronological view of all system events, allowing the responder to identify the service control manager (services.exe) event that created the malicious service, or associated registry keys that define it.

The most reliable method is to use a custom PowerShell script, such as one that leverages the handle.exe utility or similar functionality, to identify which process has a lock on the file. The runscript command is used to execute such scripts. Once the Process ID (PID) of the locking process is identified, the kill command can be used to terminate it, releasing the lock. Finally, the get command can be successfully executed to retrieve the file.

An IOA (Indicator of Attack) Exclusion is the most precise tool for this scenario. It allows you to suppress a specific behavioral detection (like credential dumping) but only when it originates from a specific process image name, path, and/or command line. This ensures that if any other process on the system attempts the same malicious behavior, it will still be detected, maintaining a strong security posture. Sensor Visibility Exclusions are too broad, and hash-based allowances don't address behavioral detections.

This query correctly identifies the specific event type for a file being written (event_simpleName=FileWritten), filters for the exact filename of interest (TargetFileName=psexec.exe), and crucially, uses wildcards to specify that the write path must contain the string \\ADMIN\$. This is the most precise way to find PsExec being staged on a remote administrative share.

The 'Persistence' tactic (TA0003) describes actions adversaries take to maintain their foothold across restarts, changed credentials, and other interruptions. The specific technique 'T1547.001' details one method of achieving this: placing a program's path in a specific Registry Run Key or a user's Startup Folder, which causes the operating system to automatically execute it when the system starts or a user logs in.