EXCLUSIONS Flashcards
How to write an effective file exclusion rule using glob syntax
- When setting path, start with root folder in full path. Do not include drive letter, device, hard disk vol or leading asterisks or backslashes
- Program Files (x86)\MySoftware*
**Excludes everything in the folder but not subfolders - Program Files (x86)\MySoftware**
**Excludes everything in the folder, including subfolders - Program Files (x86)\MySoftware\SampleSoftware.exe
**Excludes SampleSoftware.exe if it’s in - ProgramFiles(x86)\MySoftware\Users*\Desktop\RunMe.exe **Excludes RunMe.exe within any user Desktop folders
- **\RunMe.exe – (The exception) Globally excludes RunMe.exe in any location
How do you apply pattern exclusions to groups?
2 ways:
-Disable detection on a host
-Can set up a File Exclusion Pattern – prevents detections from appearing for specific file names, paths and extensions
How to manage exclusion files?
Choose “all hosts” or “Groups of hosts”
Select Precedence
**Precedence of exclusion rules enacted on hosts/group of hosts
What does using the Glob Syntax provide when creating exclusions?
- Glob syntax allows you to create exclusion patterns to easily exclude files and folders. Glob syntax supports standard ASCII characters – all alphabetical characters are not case-sensitive
What are the 3 Levels of Exclusion patterns?
3 levels of exclusion patterns:
-ML Exclusions
-IOA Exclusions
-Sensor Visibility Exclusions
Which exclusion pattern stops ML detections and preventions and/or uploads to CS for a trusted file path
- ML Exclusions
Which exclusion pattern stops seeing detections and allow activity for specified IOAs
-IOA Exclusions
Which exclusion pattern creates a sensor visibility exclusion to reduce performance issues in a trusted file path by stopping all sensor visibility for that path .
-Sensor Visibility Exclusions
How to enable exclusion rules?
To enable exclusion rule on host/groups of hosts
-Falcon console > Host Management > Prevention Policy assign to host name
When coming across a detection you know is legitimate, what needs to be done?
-Setup an allowlist or put it in an exclusion
What file executables should be avoided for windows systems when configuring Sensor Visibility exclusions?
-cmd.exe
-command.exe
-PowerShell.exe
-C:\Windows\System32*
What is an indicator of attack (IOA)?
-A logical rule designed to identify and block malicious intent regardless of malware or exploit
How to review any created exclusions?
-Falcon menu>endpoint security>configure>exclusions
What 3 part process in Falcon needs to take place when deploy sensors to monitor your detections?
-Test a subset of hosts on the prevention policy
-Identify any applications that have produced a false positive
-Allowlist the false positives
When doing any type of allowlisting what things need to be identified?
-Tactic
-Technique
How to allowlist a false positive?
Falcon main menu> endpoint security> monitor>endpoint detections>click on a detection that needs to be allowedlisted>scroll down on left side of screen and locate IOC management section> clikc IOC management icon>input description and filename>select host groups to apply or select all hosts> select platform type>select allow, do not detect from the action dropdown> click add hashes
How long does an allowlist take to be applied to an online machine?
-10-15 minutes
How to allowlist a ML detection?
Falcon main menu> endpoint security> monitor>endpoint detections> select a tactic> select a technique>select group dropdown> select grouped by triggering file> select group by host in same dropdown (determines what may need to be excluded or helps narrow down false positives)
