CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ217

VerifiedRule Configuration

Your organization wants to monitor usage of currently authorized remote-access software. The executable is named remote.exe.

How would you trigger a detection to review any process named remote.exe?

Explanation

An IOA rule can monitor process creation and use the regular expression .*\\remote\.exe to match executions of remote.exe, generating a detection for review whenever that process runs.

Community Discussion

No comments yet. Be the first to start the discussion!