Which field should you reference in order to find the system time of a *FileWritten event?
What Search page would help a threat hunter differentiate testing, DevOPs, or general user activity from adversary behavior?
An analyst has sorted all recent detections in the Falcon platform to identify the oldest in an effort to determine the possible first victim host. What is this type of analysis called?
Falcon detected the above file attempting to execute. At initial glance, what indicators can we use to provide an initial analysis of the file?
A benefit of using a threat hunting framework is that it:
Which of the following is a suspicious process behavior?
