CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ100

VerifiedRule Configuration

You must create a rule that blocks every Telegram process execution in your environment.

Which custom IOA rule configuration would achieve this?

Explanation

A Custom IOA rule with the Block Execution action prevents matched processes from launching. The Image Filename regular expression .*Telegram.* matches image filenames containing Telegram, thereby blocking Telegram process executions.

Community Discussion

No comments yet. Be the first to start the discussion!