When examining a raw DNS request event, you see a field called ContextProcessld

CrowdStrike CCFR-201b Question Answer

When examining a raw DNS request event, you see a field called ContextProcessld_decimal. What is the purpose of that field?

It contains the TargetProcessld_decimal value for other related events

It contains an internal value not useful for an investigation

It contains the ContextProcessld_decimal value for the parent process that made the DNS request

It contains the TargetProcessld_decimal value for the process that made the DNS request

CCFR-201b PDF/Engine

Get 65% Discount on All Products, Use Coupon: "ac4s65"

When examining a raw DNS request event, you see a field called ContextProcessld_decimal.