An analyst is triaging a detection that has been categorized under the 'Follow Through' Objective Layer.
Based on the Falcon technical documentation, which of the following adversary tactics is most likely to be observed within this specific layer?

You found a list of SHA256 hashes in an intelligence report and search for them using the Hash Execution Search. What can be determined from the results?

To maintain a logical flow during an incident post-mortem, CrowdStrike recommends describing adversary activity using a specific three-part sentence structure. Which combination best completes this sentence: "The adversary was trying to [1], by [2], using [3]"?

While in an Event Search, a responder clicks on an event action. What does the 'Show Child Processes' event action do?

Host Search is a powerful investigation tool. From which of the following sources is a responder most likely to pivot directly to a Host Search?