CCFA: CrowdStrike Certified Falcon Administrator

A Custom IOA domain-name criterion can use a regular expression. .*badguydomain\.com.* matches the target domain, including www.badguydomain.com, while treating the periods as literal periods and allowing surrounding characters. Custom IOA rules use regular-expression logic, and a Prevent action terminates the offending process.