CrowdStrike Updated CCFH-202b Exam Questions and Answers by moses

In Detection Analysis , the process w3wp.exe is a critical focal point as it is the IIS (Internet Information Services) Worker Process. Under normal operating conditions, w3wp.exe should be handling web requests and should almost never spawn interactive shells like powershell.exe or cmd.exe. When a process tree shows a web worker process spawning a shell, it is a high-confidence Indicator of Attack (IOA) typically associated with a Web Shell or a successful exploitation of a web application vulnerability.

The subsequent commands—whoami.exe and net1.exe—are classic post-exploitation Reconnaissance tools. whoami is used by an attacker to determine the privileges of the service account they have compromised, while net1 is used to enumerate local or domain users and groups to identify potential targets for lateral movement. The progression from a web process to a shell and then to identity/network discovery is a definitive behavioral pattern of a remote attacker establishing a foothold and performing initial situational awareness. While an administrator might use these tools for troubleshooting (Option B), they would typically do so via a direct login or a remote management session, not through the w3wp.exe parent tree. Recognizing this specific lineage is essential for hunters to differentiate between legitimate administrative maintenance and an active, live-site compromise requiring immediate intervention and containment.

When performing advanced hunting, telemetry from individual events (like a ProcessRollup2) often lacks organizational context, such as the host's Operating System version or its location within the Active Directory Organizational Unit (OU) . In the Falcon platform, this metadata is stored in lookup files like aid_master_main.csv. To enrich real-time event data with this contextual information, the lookup() function is the standard and most efficient method within the CrowdStrike Query Language (CQL) .

The lookup function works by mapping a common field—in this case, the Agent ID (aid) —between the event stream and the static CSV file. By specifying include=[Version, OU], the query instructs the engine to append the specific OS version and OU path to every matching process execution event. This allows a hunter to filter for "older Windows operating systems" (e.g., Windows 7 or Server 2008) or focus specifically on OUs containing "Domain Admins" or "Critical Servers." This methodology is a core component of Search and Investigation Tools , as it transforms raw technical data into actionable intelligence. Without the lookup function, an analyst would have only the technical process details without knowing the strategic importance or the underlying vulnerability (OS version) of the target host, significantly hindering the ability to prioritize the investigation.

==========

In the context of the MITRE ATT & CK Framework , the creation of a scheduled task is a quintessential technique within the Persistence tactic (specifically T1053). Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their flow. By scheduling a task to execute a remote management application, the attacker ensures that their connection to the compromised host is maintained automatically without requiring manual re-exploitation.

Within the Falcon platform, hunters monitor for this behavior by analyzing events such as ScheduledTaskRegistered or process executions originating from taskeng.exe or schtasks.exe. While scheduled tasks can occasionally be used for Privilege Escalation (if the task runs with SYSTEM privileges) or Execution , the primary goal of creating a permanent task for a management application is to ensure long-term, stable access to the environment. Effective hunting methodology involves pivoting from the detection of a new scheduled task to identifying the source process that created it. This allows the analyst to determine if the task was part of a legitimate administrative action or an unauthorized persistence mechanism designed to facilitate further malicious activity, such as data exfiltration or internal reconnaissance.

==========

In proactive Hunting Methodology , the context of an execution is just as critical as the command itself. The provided process tree (winlogon - > userinit - > explorer - > powershell_ise) indicates a standard interactive user session where the user manually opened the PowerShell ISE. Because the account belongs to the IT department and the activity occurred during normal working hours , there is a high probability that this is authorized administrative testing or troubleshooting.

Jumping straight to an RTR session or marking the event as a True Positive without investigation could lead to unnecessary business disruption. Conversely, marking it as a False Positive immediately is dangerous, as attackers often "live off the land" using IT credentials. The correct Hunter approach is to expand the investigation window—typically a +/- 10-minute search —to see what happened immediately before and after the command. This helps determine if the script was part of a larger, unexplained chain of events. Contacting the user to verify the activity is a standard "sanitized" inquiry in a professional environment. If the user confirms they were testing a bypass for a legitimate deployment, the event can be tuned. If they deny knowledge, the investigation escalates to a full incident response. This balance of technical telemetry and human verification is a core tenant of the Falcon Hunter's workflow.