CrowdStrike
CCFH-202B · Question #79
You have found a hash-based indicator of compromise (IOC) in an intelligence report and want to determine if the program has run in your environment. Which search would provide all of the process'…
The correct answer is D. Hash Search. You've hit your limit · resets 12:50am (America/New_York)
IOC Investigation and Hash Analysis
Question
You have found a hash-based indicator of compromise (IOC) in an intelligence report and want to determine if the program has run in your environment. Which search would provide all of the process' executions over the timeframe specified?
Options
- ABulk Host Audit
- BIOC Search
- CProcess Search
- DHash Search
How the community answered
(61 responses)- A2% (1)
- B2% (1)
- C3% (2)
- D93% (57)
Explanation
You've hit your limit · resets 12:50am (America/New_York)
Topics
#IOC Search#hash search#process execution#indicator of compromise
Community Discussion
No community discussion yet for this question.