QuestionQ220

VerifiedRule Configuration

Which ML exclusion pattern is most accurate for all .exe binaries in C:\Program Files\Software\, including any subfolders of Software?

Explanation

CrowdStrike exclusion patterns use glob syntax where a single asterisk matches characters within one directory level (not across the backslash), while a double asterisk matches across directory boundaries including subfolders. 'Program Files\Software*.exe' therefore matches every .exe in Software and all of its nested subfolders, which is exactly what the question asks. Option A ('.exe') would miss subfolders, and option B ('***.exe') is far too broad, matching .exe files anywhere on disk. Option D is malformed: '*..exe' contains a stray double dot, so it would not correctly match normal .exe filenames.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!