CCFA-200B: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ26

VerifiedRules Configuration

Your organization wants to monitor use of currently authorized remote-access software. The executable is named remote.exe.

How would you trigger a detection for review whenever a process named remote.exe runs?

Explanation

A Custom IOA rule can create a detection when a process is created and its executable path matches the regular expression for remote.exe. This provides detection-and-review monitoring without excluding the activity or relying on retrospective event searches.

Community Discussion

No comments yet. Be the first to start the discussion!