CrowdStrike Certified Falcon Hunter (CCFH) Practice Tests

Explanation

Regular, periodic outbound connections at precise time intervals — such as exactly every 60 seconds — with consistent short connection durations are a documented behavioral indicator of command-and-control beaconing. Adversaries implement beaconing as a keep-alive mechanism so compromised endpoints check in with attacker-controlled infrastructure for new commands on a defined schedule. The machine-precise regularity of the interval sustained over six hours is what distinguishes this from benign service traffic. Legitimate Windows update traffic from svchost.exe is not synchronized to exact second-level intervals and does not connect to arbitrary external IPs on that schedule. The appropriate next step is to investigate the specific svchost.exe process instance — examining its loaded DLL module count is critical, because a legitimate svchost.exe instance hosts a defined service group and loads many expected modules, while a svchost.exe used for beaconing via process injection typically has fewer than 10 loaded modules. Injecting into svchost.exe is a common adversary technique for blending malicious C2 traffic with normal Windows process activity to evade casual inspection.

Explanation

Initial Access (TA0001) encompasses techniques adversaries use to gain an entry point into a target environment. Delivering a malicious macro-enabled document via a targeted email maps directly to the spearphishing attachment technique within this tactic. Execution (TA0002) encompasses techniques that result in adversary-controlled code running on a local or remote system. The macro executing within the document and causing the stager payload to download and run on the host maps to user execution of a malicious file and scripting interpreter techniques within this tactic. These two tactics represent what is observable in Falcon endpoint telemetry from the described events. Reconnaissance (TA0043) and Resource Development (TA0042) are pre-attack preparation phases that occurred before the observed intrusion began — gathering information about the target and establishing attack infrastructure respectively — and are not reflected in endpoint telemetry generated during the intrusion itself. Privilege Escalation (TA0004) describes attempts to gain higher-level permissions than initially obtained; standard macro execution does not inherently constitute privilege escalation, and the scenario contains no indication that the macro requested or obtained elevated privileges beyond the analyst's existing user context.

Explanation

Legitimate explorer.exe instances load a large number of DLL modules to support the full Windows shell environment — shell extensions, COM objects, thumbnail handlers, and integrated components collectively produce a module list far exceeding single digits. A compromised explorer.exe targeted by process injection techniques such as process hollowing typically displays an abnormally low module count, often fewer than 10 loaded modules, because the injection creates a stripped-down process that bypasses normal shell initialization. Observing only 6 loaded DLLs in an explorer.exe instance is a recognized behavioral indicator of process injection warranting immediate investigation. The absence of a living parent process is not suspicious and does not indicate compromise: userinit.exe legitimately spawns explorer.exe during Windows logon and then terminates, leaving explorer.exe without a living parent in process tree views. The correct Windows shell startup sequence is winlogon.exe launching userinit.exe, which launches explorer.exe and then exits — winlogon.exe is the grandparent of explorer.exe, not its direct parent. Windows 10 did not reduce explorer.exe's default module footprint; a 6-module count remains anomalous regardless of operating system version and warrants investigation as a potential injection indicator.

Explanation

Outlier analysis for process execution rarity aggregates ProcessRollup2 events by process image filename using groupby() and then sorts the resulting counts in ascending order to surface binaries appearing on the fewest hosts in the environment. Processes executing across many hosts are typically common system utilities or standard enterprise software and are statistically less suspicious; binaries appearing on only one or two systems — especially sensitive servers or executive endpoints — warrant investigation as statistical outliers relative to the environmental baseline. Using match() against a known-good allowlist is a valid complementary technique but addresses allowlist-based comparison rather than discovering statistically rare processes not yet catalogued in any list. DNS request aggregation identifies outlier network communication behavior, which is a different investigation objective from process execution prevalence analysis. Sorting network connections in descending count order targets high-volume beaconing behavior rather than process rarity across the fleet, addressing a fundamentally different adversary pattern.

Explanation

CQL supports regular expression matching using forward-slash delimiters with optional modifier flags following the closing slash. The /i flag enables case-insensitive mode, causing the pattern to match all capitalization variants. The backslash before the period escapes it to match a literal dot rather than the regex any-character metacharacter, ensuring the filter matches the full file extension rather than any single character. This makes /powershell\.exe/i the correct filter for matching powershell.exe, POWERSHELL.EXE, Powershell.exe, and all other capitalization combinations. CQL string matching using double quotes is case-sensitive by default — FileName="powershell.exe" will not match capitalized variants. Wildcard matching using asterisk patterns also does not override CQL case-sensitive behavior, so FileName=*powershell* would miss capitalized variants. There is no tilde prefix operator for case-insensitive string comparison in CQL; this syntax does not exist in the language.