Process Explorer is the correct answer because it is specifically designed to provide a visual, interactive timeline of process execution, including parent-child relationships, file modifications, and network connections. This allows an analyst to reconstruct the exact attack chain, which is precisely what the scenario requires, unlike the broader data sets of Event Search or the high-level views of the Detections Dashboard and Incident Workbench.

Killing the suspicious process and its child processes is the most immediate containment action. While network isolation (Option A) is also a containment step, it does not stop the active process from continuing its malicious actions on the local host. The goal is to halt the ransomware activity in its tracks to prevent encryption, which is best achieved by terminating the malicious process tree directly via real-time response.

Falcon Query Language (FQL) is the native query language for searching CrowdStrike’s data sets. The Process Rollup data set contains summarized process execution data, including command-line arguments, which is where you would find evidence of specific PowerShell cmdlet execution. This approach is efficient and leverages the platform’s built-in hunting capabilities, unlike generic SQL, external Splunk queries, or an inefficient host-by-host API script.

This explanation correctly defines the strategic difference. IOAs (Indicators of Attack) model adversary behavior and tactics (the ‘how’ of an attack), allowing Falcon to detect malicious activity early in the kill chain, often before compromise. IOCs (Indicators of Compromise) are forensic artifacts like hashes or IPs that confirm a system has already been breached. Falcon uses both, but IOAs are key to its next-gen, behavior-based prevention model.

Creating IOA Exclusions is the most precise and recommended method. It allows you to maintain a strong prevention policy globally while creating targeted, behavior-based exceptions for known-good activity. This is more surgical than switching an entire host group to a permissive policy (Option B) or disabling prevention globally (Option A). Sensor Visibility (Option C) does not affect prevention logic; it controls what data is sent to the cloud.

Host Tags are the primary CrowdStrike mechanism for adding custom metadata like ‘Owner,’ ‘Department,’ or ‘Responsible-Team’ to a host. This information is then visible across the platform (including in Spotlight) and is designed specifically for operational tasks like identifying asset owners for remediation. The ‘Note’ field (Option A) is less structured and searchable, while Identity Protection (Option C) and audit logs (Option D) relate to user activity, not asset ownership.

The `get` command in RTR is used to download (or ‘pull’) a file from the remote host to the analyst’s local machine via the Falcon cloud. This is the correct command for the scenario. `ps` lists processes, `cd` changes directory, and `put` is used to upload a file *to* the remote host, which is the opposite of the required action.

The ‘Scheduled Tasks’ investigation pane is a dedicated area within the host details view that lists the tasks retrieved from the system. It allows analysts to quickly review task names, commands, creators, and creation dates without needing to run a manual RTR command or write a custom query, making it the most efficient tool for this specific playbook step.

The Process Rollup data set aggregates process execution events and includes key fields like `ImageFileName` (the name of the executable file). This makes it the ideal data set for hunting for processes based on their executable name. Network Connections (Option B) would show active connections from these tools but not the initial execution, while DNS Requests (Option A) and User Activity (Option D) are less directly relevant to this specific search criteria.

Process Explorer is the correct answer because it is specifically designed to provide a visual, interactive timeline of process execution, including parent-child relationships, file modifications, and network connections. This allows an analyst to reconstruct the exact attack chain, which is precisely what the scenario requires, unlike the broader data sets of Event Search or the high-level views of the Detections Dashboard and Incident Workbench.0