CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ59

VerifiedEvent Search

You are investigating suspicious use of the PowerShell.exe process in Advanced Event Search and need to ensure that the parent process CSFalconService.exe is excluded from the results.

Which option should be added to the query to exclude CSFalconService.exe from the results?

Explanation

CrowdStrike Query Language uses != for an exact not-equal filter, with the field name on the left side of the operator. ParentBaseFileName != CSFalconService.exe excludes events whose ParentBaseFileName is CSFalconService.exe.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!