Free Practice Questions for CrowdStrike CCFH-202b Exam

In the realm of Hunting Analytics , the ability to quantify data is the first step toward identifying outliers—the "needles in the haystack." The stats() function in Advanced Event Search (LogScale) is the most versatile tool for this purpose. While groupBy() is used to organize data into buckets, stats() is required to perform mathematical aggregations such as count(), sum(), avg(), or stdDev().

To identify outliers, a hunter typically wants to see which events occur with the lowest frequency (Least-Frequency Analysis) or which values deviate significantly from the mean. By appending | stats(count(), function=[...]) to a query, the analyst transforms raw event logs into a statistical summary. For example, a hunter might use stats() to count the number of unique external IP connections per process; a process that normally connects to one IP but suddenly c onnects to 500 would stand out as a clear outlier. This quantification is what allows a hunter to move from "searching" to "analyzing." While eval() is used for calculating new fields and sample() is used for performance testing on large datasets, stats() provides the numerical foundation necessary for sophisticated behavioral baselining and the detection of anomalous activity that doesn't trigger standard signature-based alerts.

==========

Creating effective Reports and References within the Falcon console requires selecting the appropriate visualization for the data being presented. When the goal is to highlight a single, high-level metric—such as the "Total Number of Detections"—the Gauge Widget is the standard choice. While its name implies a speedometer-style visual, in the Falcon and LogScale dashboarding environments, the Gauge widget is specifically designed to render a single numerical value (often called a "Single Value" or "Big Number" visualization).

Other widgets serve different analytical purposes: a Time Chart is best for viewing trends over the seven-day period (showing peaks and valleys), a Scatter Chart is used for identifying outliers in multidimensional data, and a Heat Map is ideal for visualizing the frequency of events across two variables (like time of day versus host group). For an executive-level dashboard or a Security Operations Center (SOC) "Summary of Health," the Gauge widget provides immediate clarity. It takes the output of a count function (e.g., | count()) and presents it as a bold, central digit, allowing stakeholders to understand the current threat volume at a single glance without needing to interpret complex axes or color gradients.

Identifying an enterprise-wide file infection requires a hunter to look past simple file names, which adversaries often randomize or mask to evade basic detection. The most effective Hunting Methodology for this scenario is to focus on the file's unique cryptographic hash (MD5, SHA256). Even if an attacker renames a malicious binary (e.g., from malware.exe to svchost.exe) to blend into different environments, the hash remains identical.

By utilizing CrowdStrike Query Language (CQL) in the Event Search or LogScale environments, a hunter can search for a known malicious hash across all ProcessRollup2 and ImageHash events. This allows the analyst to see every instance where that specific file has appeared, regardless of the local file name or path. This technique is particularly powerful for identifying "Polymorphic" behavior where the filename changes but the core payload stays the same. While monitoring alerts (Option A) is reactive and host dashboards (Option B) are localized, hash-based hunting provides a global, enterprise-wide perspective. This ensures that the hunter can identify every single "infected" host, including those where the malware may be dormant or where a local detection has not yet been triggered, enabling a comprehensive and simultaneous remediation effort across the entire organization.

In proactive Hunting Methodology , the context of an execution is just as critical as the command itself. The provided process tree (winlogon - > userinit - > explorer - > powershell_ise) indicates a standard interactive user session where the user manually opened the PowerShell ISE. Because the account belongs to the IT department and the activity occurred during normal working hours , there is a high probability that this is authorized administrative testing or troubleshooting.

Jumping straight to an RTR session or marking the event as a True Positive without investigation could lead to unnecessary business disruption. Conversely, marking it as a False Positive immediately is dangerous, as attackers often "live off the land" using IT credentials. The correct Hunter approach is to expand the investigation window—typically a +/- 10-minute search —to see what happened immediately before and after the command. This helps determine if the script was part of a larger, unexplained chain of events. Contacting the user to verify the activity is a standard "sanitized" inquiry in a professional environment. If the user confirms they were testing a bypass for a legitimate deployment, the event can be tuned. If they deny knowledge, the investigation escalates to a full incident response. This balance of technical telemetry and human verification is a core tenant of the Falcon Hunter's workflow.

In global incident response, timestamps are typically stored in the Falcon platform as Unix epoch time (UTC). To make this data readable and relevant to local investigators, the formatTime() function is used within Event Search to convert these raw numbers into human-readable strings. The timezone parameter is the specific argument required to adjust the output from the default UTC to a specific regional clock, such as Central European Summer Time.

While the format parameter defines how the date appears (e.g., YYYY-MM-DD), and locale might influence language-specific formatting (like month names), only the timezone parameter correctly offsets the hours based on geographic location and Daylight Saving Time rules. For a hunter, providing logs in the correct timezone is not just a matter of convenience; it is essential for correlating Falcon data with other local logs, such as physical badge access records or firewall logs that may be set to local time. Accurate time synchronization across different data sources is vital during the "reconstruction" phase of a hunt to ensure that the sequence of adversary events is perfectly aligned with the real-world timeline of the breach. Utilizing the timezone parameter ensures that the investigation team can accurately determine exactly when a malicious action occurred relative to their own working hours.

==========

Understanding the "parent-child" relationship of processes is a cornerstone of Detection Analysis . In a standard Windows environment, when a user manually opens a Command Prompt (cmd.exe) via the GUI, the parent process is typically explorer.exe (the Windows Shell). Recognizing this baseline behavior is essential for identifying anomalies. For instance, if cmd.exe is spawned by sqlservr.exe or w3wp.exe (IIS), it is a high-confidence indicator of a web shell or SQL injection attack.

While userinit.exe is responsible for setting up the user environment during logon and might occasionally trigger scripts, it is not the primary interactive parent for cmd.exe. Processes like svchost.exe and winlogon.exe spawning a command shell are highly suspicious and often associated with privilege escalation or system-level exploitation. In the Falcon platform, analysts use the Process Tree view to visually inspect these relationships. A "normal" tree shows a user-initiated command line descending from explorer.exe. Deviations from this norm—such as a hidden command shell running as a child of a non-interactive service—trigger detections because they represent common adversary techniques for execution and lateral movement. By mastering the expected lineage of common binaries, hunters can more effectively filter out legitimate administrative activity from genuine threats.

==========

This query is a sophisticated example of using Event Search to visualize potential external threats. The key to identifying the purpose lies in the LogonType=10 filter. In Windows event logging, Logon Type 10 specifically refers to Remote Interactive logons, which are almost exclusively associated with Remote Desktop Protocol (RDP) sessions. By combining this with RemoteAddressIP4=*, the hunter is isolating instances where a user has accessed a system remotely.

The query then utilizes the !cidr function (the exclamation mark denotes a "NOT" operation) to exclude all internal and private IP ranges defined by RFC 1918 (such as 10.x.x.x and 192.168.x.x) as well as loopback and multicast addresses. This ensures that the resulting dataset only contains logons originating from external/public IP addresses . The ipLocation function enriches these external IPs with geographic metadata (city, country, coordinates), and the worldMap function aggregates this data to plot the origin of these RDP connections onto a global map. For a hunter, this is a vital tool for detecting "Impossible Travel" scenarios or identifying unauthorized access attempts from high-risk geographic regions. Visualizing the magnitude of connections per aid (Agent ID) allows the analyst to quickly spot which specific endpoints are being targeted by external RDP brute-force or credential stuffing attacks.

The Bulk domains (often listed as Bulk Domain Investigate ) dashboard is a specialized tool within the Falcon platform designed for broad infrastructure pivoting. While a standard search might show you a single event, the Bulk Domain Investigate tool allows an analyst to enter one or more domain names to receive a comprehensive, global overview of all activity associated with those domains across the entire managed environment.

When an analyst inputs a suspicious domain into this dashboard, Falcon retrieves a list of every host that has attempted to resolve that domain and, crucially, the specific processes responsible for those DNS lookups or network connections. This provides the hunter with immediate visibility into the "Who" and the "How." For example, it might reveal that while the domain was initially seen on one host, it was actually looked up by powershell.exe on three other hosts that had not yet triggered an alert. This capability is essential for Hunting Methodology , as it allows for the rapid identification of a shared command-and-control (C2) infrastructure. By identifying all processes interacting with the domain, the hunter can determine if the threat is an isolated incident or part of a wider campaign, enabling them to transition quickly from identification to large-scale containment and remediation.