Crowdstrike Certified Falcon Responder Free Sample Questions

When svchost.exe appears without a parent, it is often because it was started as a Windows Service. The Process Tree focuses on direct parent-child relationships and may not show the service creation event. Pivoting to the Host Timeline provides a chronological view of all system events, allowing the responder to identify the service control manager (services.exe) event that created the malicious service, or associated registry keys that define it.

The most reliable method is to use a custom PowerShell script, such as one that leverages the handle.exe utility or similar functionality, to identify which process has a lock on the file. The runscript command is used to execute such scripts. Once the Process ID (PID) of the locking process is identified, the kill command can be used to terminate it, releasing the lock. Finally, the get command can be successfully executed to retrieve the file.

An IOA (Indicator of Attack) Exclusion is the most precise tool for this scenario. It allows you to suppress a specific behavioral detection (like credential dumping) but only when it originates from a specific process image name, path, and/or command line. This ensures that if any other process on the system attempts the same malicious behavior, it will still be detected, maintaining a strong security posture. Sensor Visibility Exclusions are too broad, and hash-based allowances don't address behavioral detections.

This query correctly identifies the specific event type for a file being written (event_simpleName=FileWritten), filters for the exact filename of interest (TargetFileName=psexec.exe), and crucially, uses wildcards to specify that the write path must contain the string \\ADMIN\$. This is the most precise way to find PsExec being staged on a remote administrative share.

The 'Persistence' tactic (TA0003) describes actions adversaries take to maintain their foothold across restarts, changed credentials, and other interruptions. The specific technique 'T1547.001' details one method of achieving this: placing a program's path in a specific Registry Run Key or a user's Startup Folder, which causes the operating system to automatically execute it when the system starts or a user logs in.

The Bulk Domain Search tool is designed to take a large list of domains and query Falcon's historical event data to identify any endpoints that have made DNS requests for or network connections to those domains. The results provide a list of matching hosts, allowing for rapid scoping of potential compromises.

The run command in RTR executes shell commands on the remote host. On Linux, netstat -anp lists all (-a) numeric (-n) network connections and the process (-p) associated with them. The > is the standard shell operator to redirect the output of the command to a file, in this case, /tmp/connections.txt. The >> operator would append, which is not ideal for creating a fresh report.

The Process Timeline is specifically designed to provide a chronological, filtered view of all events associated with a single process instance (ContextProcessId). This allows the analyst to isolate the actions of one process and see the exact sequence of its activities, which is crucial for understanding its behavior without the noise of other system events. The Host Timeline shows all events on the host, which would be too broad for this specific task.

procdump.exe is a legitimate utility from Microsoft's Sysinternals suite, used for process diagnostics. However, attackers frequently abuse it to dump credentials from the LSASS process memory. A low external prevalence score (like '1') for the official procdump.exe hash is expected because it's not malware itself and is typically only found on systems where administrators have placed it. The detection is triggered by the behavior (reading LSASS memory), not the file's reputation. This is a classic example of a Living-Off-the-Land Binary (LOLBin) attack.