CCFR-201 Sample Questions & Answers

The Bulk Domain Search tool is designed to take a large list of domains and query Falcon's historical event data to identify any endpoints that have made DNS requests for or network connections to those domains. The results provide a list of matching hosts, allowing for rapid scoping of potential compromises.

The run command in RTR executes shell commands on the remote host. On Linux, netstat -anp lists all (-a) numeric (-n) network connections and the process (-p) associated with them. The > is the standard shell operator to redirect the output of the command to a file, in this case, /tmp/connections.txt. The >> operator would append, which is not ideal for creating a fresh report.

The Process Timeline is specifically designed to provide a chronological, filtered view of all events associated with a single process instance (ContextProcessId). This allows the analyst to isolate the actions of one process and see the exact sequence of its activities, which is crucial for understanding its behavior without the noise of other system events. The Host Timeline shows all events on the host, which would be too broad for this specific task.

procdump.exe is a legitimate utility from Microsoft's Sysinternals suite, used for process diagnostics. However, attackers frequently abuse it to dump credentials from the LSASS process memory. A low external prevalence score (like '1') for the official procdump.exe hash is expected because it's not malware itself and is typically only found on systems where administrators have placed it. The detection is triggered by the behavior (reading LSASS memory), not the file's reputation. This is a classic example of a Living-Off-the-Land Binary (LOLBin) attack.

This set of actions addresses all primary objectives. A User Search on the compromised service account will reveal if it was used elsewhere (scoping). Searching for all powershell.exe executions helps identify similar attack patterns on other systems. A Bulk IP search for the attacker's IP will quickly determine if any other hosts have communicated with it. These steps effectively use Falcon's tools to expand the investigation from a single host to the entire environment to understand the full scope.

The runscript command is the designated RTR command for executing scripts from the cloud library (Response Scripts and Files). The -CloudFile parameter specifies the name of the script to be executed on the target host. The standard run command is for built-in shell commands and cannot execute scripts from the cloud library directly.

On Windows systems, the Falcon sensor stores quarantined files in the C:\Windows\System32\drivers\CrowdStrike\Quarantine\ directory. Knowing this path is essential for manual retrieval using RTR if the standard 'Download Quarantined File' UI option is unavailable or if a scripted approach is needed.

CrowdStrike provides a dedicated audit log for all Real Time Response activities to ensure accountability and provide a clear record of actions taken on endpoints. This log, found under the Real Time Response section of Host Management, captures details such as the user who initiated the session, the target host, the session start and end times, and a full list of commands executed.

A User Search provides a user-centric view, aggregating data like successful and failed logons, account lockouts, and password changes for a specific user account across the entire environment. A Host Search provides a host-centric view, showing details like OS version, sensor health, IP addresses, and applied policies for a single machine.