Falcon Responder Flashcards
What is svchost.exe
A wrapper for services starting, manages scheduled tasks and services from DLL files, usually showing in Falcon, its the execution of a scheduled task when it’s in the command line.
How long is a quarantined file retained when downloaded vs in the cloud?
30 days when downloaded, 90 days in the cloud
What is services.exe
The tool used to stop and restart services.
What process creates, modifies, and deletes registry keys?
reg.exe
What raw data is available for a DNSRequest event?
index
How many detections are displayed per day per AID?
1000
What sentence best describes the primary use of the Hash Executions search?
A summary view of the environment-wide presence of a given hash list
If trying to create a tightly-scoped allowlist for a certain ML detection group, what grouping might be used first?
Hash
What are the six CrowdStrike objectives?
Gain Access, Keep Access, Explore, Contact Controlled Systems, Follow Through
And then Falcon Detection Method
What MITRE tactics are contained under Gain Access?
Initial Access
Credential Access
Privilege Escalation
What MITRE Tactics are under the Keep Access Objective?
Persistence
Defense Evasion
What MITRE Tactics are under the Explore Objective?
Discovery
Lateral Movement
What single MITRE Tactic falls under the Contact Controlled Systems Objective?
Command and Control
What MITRE Tactics fall under the Follow Through Objective
Collection
Exfiltration
Execution
Impact
What are the 7 different Falcon Detection Methods?
Malware,
Exploit,
Post-Exploit,
Machine Learning,
Custom Intelligence,
Falcon Overwatch
Falcon Intel
What is FDM?
Falcon Detection Method - will show up in Detections as the Objective, with our own Tactic & Technique… meant for detections that don’t cleanly match a MITRE matrix spot.
What is required when creating a custom IOA from scratch?
Create a rule group
Create the custom rule in the group
Enable the rule & group
Assign the IOA rule group to a prevention policy
What are the 4 IOA rule actions?
Monitor
Detect
Block execution (process creation only)
Kill process
Can a custom IOA be applied to more than one prevention policy?
Yes
How long are Detection-Related Events retained?
90 days, by default
Which stages of the cyber kill chain does the Falcon sensor have visibility over?
Only the last 4:
Exploit, Control, Execute, Maintain
What is the maximum size for a quarantined file to be uploaded to the Cloud?
32MB
What is the default retention for “cloudable” events?
7 days by default
What are the 4 rule types for IOA?
Process creation
File creation
Network connection
Domain name
