CCFA: CrowdStrike Certified Falcon Administrator

Question

You need the capability to monitor suspicious VBA macros. Which Sensor Visibility setting should be enabled in the Prevention policy settings?

Explanation

Script-Based Execution Monitoring enables CrowdStrike Falcon Script Control for requests scanned through the Windows AMSI interface, including VBA macros that originate in Microsoft Office applications.

Learn more

Blocking Fileless Script-based Attacks with Falcon Script Control

CCFA: CrowdStrike Certified Falcon Administrator

AstroTutor

Notes

Readiness

QuestionQ213

Community Discussion