CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ196

VerifiedPolicy Application

You have received a list of 100 hashes that are not malicious, but that your company has determined are inappropriate for work computers. They have asked you to ensure these files cannot run in your environment. You have chosen to use Falcon to accomplish this. What is the best way to do so?

Explanation

Falcon IOC Management can import SHA-256 or MD5 file hashes as custom indicators and assign them the Block action. Execution prevention also requires Custom Blocking to be enabled under Execution Blocking in the prevention policy assigned to the affected computers.

Community Discussion

No comments yet. Be the first to start the discussion!