CrowdStrike

CCFH-202B · Question #6

Which of the following queries will return the parent processes responsible for launching badprogram exe?

The correct answer is B. event_simpleName=processrollup2 [search event_simpleName=processrollup2. The Parent Process is when rename ParentProcessId_decimal as TargetProcessId_decimal.

Threat Hunting with Event Search

Question

Which of the following queries will return the parent processes responsible for launching badprogram exe?

Options

A[search (ParentProcess) where name=badprogranrexe ] | table ParentProcessName _time
Bevent_simpleName=processrollup2 [search event_simpleName=processrollup2
C[search (ProcessList) where Name=badprogram.exe ] | search ParentProcessName | table
Devent_simpleName=processrollup2 [search event_simpleName=processrollup2

How the community answered

(47 responses)

A
4% (2)
B
57% (27)
C
15% (7)
D
23% (11)

Explanation

The Parent Process is when rename ParentProcessId_decimal as TargetProcessId_decimal.

Topics

#parent process#sub-search#ProcessRollup2#process hunting

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion

Full CCFH-202B Practice