CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ55

VerifiedHunting Methodology

Falcon Machine Learning prevented and quarantined a file as it was being written to disk, with VSCode as its parent process. The system owner compiled this file.

What should the next steps be?

Explanation

A Machine Learning prevention is remediated, when the file is verified as expected and benign, with a Machine Learning exclusion. Private sandbox detonation supports safe analysis before allowing it. IOA exclusions are for matching behavioral IOA rules, and Sensor Visibility Exclusions control sensor telemetry rather than exempting a file from Machine Learning prevention.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!