What CCFH-202b Questions and Answers feature?

Identifying "rare occurrences" is a core technique in Hunting Analytics known as Least Frequency Analysis (LFA) . In a typical enterprise, standard web browsers and legitimate system services will generate millions of events with common UserAgentStrings . Adversaries, however, often utilize custom tools, scripts (like Python or PowerShell), or specialized Command and Control (C2) agents that leave behind unique or highly infrequent user agent signatures.

The query in Option C is the correct CrowdStrike Query Language (CQL) syntax to surface these outliers. The groupBy(UserAgentString, ...) function aggregates all events by their unique user agent. By including count() within the function, the query engine calculates exactly how many times each string has appeared over the specified 30-day window. The collect() function is then used to retain the investigative context—such as the ComputerName and UserName—associated with those strings without splitting the count. Finally, the query pipes the results into sort(_count, order=asc, limit=10). This critical sorting step ensures that the strings with the lowest counts (the "rare" ones) are pushed to the top of the list. This methodology allows a hunter to quickly bypass the "noise" of legitimate traffic and focus on potentially unauthorized tools or non-standard browser versions that could indicate a beachhead or data exfiltration activity.

In the CrowdStrike Falcon platform, the TreeId serves as the primary unique identifier used to correlate all events associated with a specific process execution and its lifecycle. When an analyst is performing an investigation via Event Search using CQL , the TreeId acts as the "glue" that binds disparate telemetry data points together. While a ComputerName identifies the physical or virtual host and event_simpleName describes the action (such as a file creation or network connection), neither provides the execution context required to isolate a specific malicious incident.

The TreeId is specifically designed to group all activity related to a process tree, including the actions of the process itself and its subsequent child processes. By filtering a query using a specific TreeId identified in a detection, a hunter can instantly view every related event—such as DNS requests, registry modifications, and module loads—regardless of how many other unrelated processes are running on the same endpoint. While ParentProcessId can be used to manually trace lineage, it is not as efficient or definitive as the TreeId for automated correlation across the entire dataset. Utilizing the TreeId ensures that the investigation remains focused on the relevant execution path, allowing for a comprehensive reconstruction of the adversary's behavior from the moment of execution until the process terminates.

When conducting an Event Search using the CrowdStrike Query Language (CQL) , precision in naming event types is paramount. The Falcon sensor records the creation and modification of scheduled tasks under the specific event name ScheduledTaskRegistered . This event is highly valuable for hunters investigating Persistence (MITRE T1053), as it captures the specific details of the task, including the command to be executed, the frequency of the trigger, and the identity of the user who created it.

Option B is the correct query because it directly targets the administrative action of task registration and filters the results by the UserName field to isolate actions taken by "Doris." Option A is incorrect as it looks for files with a specific extension, and Option C focuses on the Task Manager GUI process (taskmgr.exe), which is not the process responsible for the actual background registration of tasks (that is typically handled by svchost.exe or schtasks.exe). Option D uses a non-existent event name. By using the ScheduledTaskRegistered event, a hunter can immediately see if an account—potentially a compromised one—is being used to establish a long-term foothold in the environment. This search is a core component of a "Persistence Hunt," where the goal is to find unauthorized automation that allows an attacker's code to survive system reboots and credential rotations.