CCFA-200B: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ98

VerifiedRules Configuration

Your organization wants to monitor the use of currently authorized remote-access software. The executable is named remote.exe.

How would you trigger a detection for review of any process named remote.exe?

Explanation

A custom IOA rule can monitor process-creation activity and generate a detection when the process image path matches a regular expression. The pattern .*\\remote\.exe matches any path whose executable name is remote.exe, while treating the periods as literal characters.

Community Discussion

No comments yet. Be the first to start the discussion!