CCFH-202 Sample Questions & Answers

The stats command is a powerful aggregation tool in CQL. In addition to count, it supports various other functions, including avg() for average, sum() for sum, min() for minimum, max() for maximum, dc() for distinct count, and values() to list distinct values.

This is the most direct and efficient method. The CQL query precisely targets the exfiltration activity by filtering for outbound network events (NetworkSend) from the specific application and user. Using stats sum(bytes_sent) by ComputerName aggregates the total data sent from each host, directly answering the core investigative question. Saving this to a custom dashboard provides a clear visualization (like a bar chart) that is perfect for management reporting and prioritizing the investigation on the hosts with the highest exfiltration volumes.

This query correctly uses the search command with the NOT operator to exclude results. The IN operator allows for checking against a list of values. By combining NOT and IN, the query efficiently filters out any FileWritten events where the FileName ends in either .log or .tmp. The wildcards * are also correctly used to match any filename.

The Host Snapshot feature provides a detailed point-in-time forensic capture of a host's state. This includes a list of running processes, active network connections, loaded drivers, and other critical system information. It is the designated tool for obtaining a comprehensive snapshot for deep analysis without needing a full Real Time Response session.

Credential dumping tools work by opening a handle to the lsass.exe process and reading its memory. The ProcessAccess event is specifically designed to capture this activity, logging when one process (SourceImageFileName) attempts to access another (TargetImageFileName). Searching for ProcessAccess events where lsass.exe is the target is the most direct way to identify the culprit process.

Local Prevalence indicates how many hosts within your own organization have seen the detected file or process. A very low number (e.g., 'Unique' or 'Rare') immediately signals that this is not widespread, common software and could be a targeted or new threat deserving higher priority.

Global Prevalence shows how common the file or process is across the entire CrowdStrike customer base. A low global prevalence suggests the artifact is not a common application and is more likely to be malicious or custom tooling, making it a higher priority for investigation.

T1136: Create Account specifically covers the adversary behavior of creating new local or domain accounts to maintain access to victim systems. This technique falls under the Persistence and Privilege Escalation tactics. A hunt for this technique would involve looking for events related to net user /add commands or other account creation APIs.

False. The User Search feature is comprehensive. It provides a timeline of a user's activity, including logon events, the hosts they accessed, and a detailed list of the processes they executed. This makes it a powerful tool for investigating user-centric incidents and insider threats.

This query is the most precise and effective. It correctly identifies that scheduled tasks on modern Windows systems are typically launched by svchost.exe (hosting the Task Scheduler service). It filters ProcessRollup2 events for powershell.exe being launched by this parent process and, most importantly, includes the specific keyword *PatientDataExport* in the command line. The table command then formats the output neatly for easy review by junior analysts, fulfilling all requirements.

This is the correct approach for outlier analysis in this scenario. It filters for network connection events, then uses stats with the distinct count function dc() on the remote IP address field. It groups the results by ComputerName, effectively counting the number of unique IPs each host connected to. Finally, sort -UniqueIPs orders the results in descending order, bringing the hosts with the most anomalous behavior to the top of the list.