Free Preparation Discussions
MENU
CrowdStrike Exam CCFH-202 Topic 2 Question 21 Discussion
Topic #: 2
Adversaries commonly execute discovery commands such as netexe, ipconfig.exe, and whoami exe. Rather than query for each of these commands individually, you would like to use a single query with all of them. What Splunk operator is needed to complete the following query?
The Linux Sensor report is where an analyst would find information about shells spawned by root, Kernel Module loads, and wget/curl usage. The Linux Sensor report is a pre-defined report that provides a summary view of selected activities on Linux hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Linux hosts within a specified time range. The Sensor Health report, the Sensor Policy Daily report, and the Mac Sensor report do not provide the same information.
Georgeanna
5 days agoKaran
6 days agoKandis
6 days agoKerry
8 days agoAnisha
8 days agoHui
9 days agoXuan
16 days ago