CrowdStrike
CCFR-201B · Question #54
You are reviewing the raw data in an event search from a detection tree. You find a FileOpenInfo event and want to find out if any other files were opened by the responsible process. Which two field…
The correct answer is C. ContextProcessId_decimal and aid. #event_simpleName=FileOpenInfo does not have 'TargetProcessId' in it's field. ContextProcessId reflects more on the 'responsible process' that spawned the FileOpenInfo event.
Event Search and Analysis
Question
You are reviewing the raw data in an event search from a detection tree. You find a FileOpenInfo event and want to find out if any other files were opened by the responsible process. Which two field values do you need from this event to perform a Process Timeline search?
Options
- AParentProcessId_decimal and aid
- BResponsibleProcessId_decimal and aid
- CContextProcessId_decimal and aid
- DTargetProcessId_decimal and aid
How the community answered
(34 responses)- A6% (2)
- B3% (1)
- C79% (27)
- D12% (4)
Explanation
#event_simpleName=FileOpenInfo does not have 'TargetProcessId' in it's field. ContextProcessId reflects more on the 'responsible process' that spawned the FileOpenInfo event.
Topics
#event search#ContextProcessId_decimal#aid field#process timeline search
Community Discussion
No community discussion yet for this question.