CCFH-202B: CrowdStrike Certified Falcon Hunter

Windows service configuration includes a fully qualified path to the executable that implements the service; standard Windows service binaries commonly run from the Windows System32 directory. Filtering ServiceStarted events to exclude System32 and servicing paths focuses on non-standard launch locations. Grouping by service display name, counting the events, and sorting ascending places the least-used services first.