Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CCFA > PREVENTION POLICIES > Flashcards

PREVENTION POLICIES Flashcards

1
Q

What is the default policy used for?

A
  • The Default Policy is a fallback policy applied to hosts that don’t have an assigned policy.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are best practices when configuring default policies?

A

– You should configure its policy options to be conservative “catch all” settings you’re comfortable applying to any host in your environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How to configure a detection- only policy?

A

Default Policy is detection only
- Configuration > Prevention Policies> create new policy>input platform, name, description> create policy> click a row of policy settings to manage individually or click enable all>save>confirm> enable> enable policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is machine learning on a “sensor” vs the “cloud”

A

-Sensor ML:
- Sensor Machine Learning is Online + Offline
- On sensor are detections that occur when a process runs
-Includes Sensor Anti Malware on all supported OS Platforms
-Adware/PUP on MacOS.

-Cloud ML:
- Cloud Machine Learning is online
- Cloud Based Machine Learning detections occur when a file is written to disk.
- Cloud Machine Learning – includes both Cloud Anti Malware and Adware/PUP.
**Critical Component of detection/prevention of known, emerging, and zero day malware/ransomware attacks.
-Cloud Machine Learning does NOT interfere with traditional AV tools

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Explain best practice Phase 1: Initial Deployment

A

-Run Phase 1 for minimum time to allow most applications to execute while you triage detections/address any false positives as appropriate.

-Set ML settings to detect only so you can safely triage detections

-Enable behavior-based protections for ransomware and IOAs.
**has low probability for false positives, but give you immediate protection against dangerous exploits.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define the NextGen AV Settings

A

-Cloud Based ML
-Sensor ML
-On Write (Files written to disk)
-Quarantine.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What do end user notifications do?

A

-Portrays message to end user when an action is in violation of policy assigned to end host.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How to assign a prevention policy to groups and hosts?

A

-Falcon menu> Endpoint Security>Configure> prevention policies> edit icon near policy you want config>assigned host groups tab>add groups to policy>select groups>Add groups to policy>Settings Tab>Enable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does precedence do regarding prevention policies?

A
  • Determines which policy’s configuration settings are applied to a host when the host is a member of one or more policies.
  • Each host can belong to one or more host groups – host groups can be assigned one or more policies
  • With dynamic groups, a newly installed sensor inherits relevant groups, and applies policy with highest precedence to the host. Provides host with its initial policy settings.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Explain best practice Phase 3: Optimal Protection

A

-Run phase 3 identical to recommended single phase settings and your ultimate policy goals.

-Some customers also like to start a representative set of non-production systems as a test

-Set ML Preventions to Aggressive if you’re confident that all needed exclusions have been applied

-Enable remaining recommended IOA based prevention policy settings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the 3 phases to describe policy best practices?

A

3 Phase Process:

-Phase 1: Initial Deployment

-Phase 2: Interim Protection

-Phase 3: Optimal Protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which best policy practice is used for a rapid deployment scenario & the customer has pre-existing antivirus or host intrusion prevention system (HIPS)?

A

-Phase 1: initial deployment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which best policy practice is used once the customer’s AV is disabled or uninstalled?

A

Phase 2: Interim Protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Explain best practice Phase 2: Interim Protection

A

**Disable or uninstall other 3rd party AV products now.
-Run phase 2 for minimum time required to allow most applications to execute while you continue to triage detections/address any false positives as appropriate.

-Set ML Detections to Aggressive and ML Preventions to Moderate

-Enable additional IOA – based prevention settings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which best policy practice is used to establish a customer’s ultimate policy goals?

A
  • Phase 3: Optimal Protection
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What happens when you assign a host group to a policy?

A

The host group will no longer appear in list of available groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How do end user notifications show up?

A
  • Shows up as a pop-up notification to the end user when the Falcon sensor blocks, kills, or quarantines an unauthorized action

-Messages also show up in the Windows Event Viewer under Apps and Service Logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Where on the Falcon Console can you configure Precedence?

A

Hosts > Host Groups > Policies Assigned > Precedence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What features does the Cloud ML provide?

A

-Cloud AntiMalware/Detection

-Cloud AntiMalware/Prevention
SensorAntiMalware/Detection/Prevention

-Detect on Write, Quarantine on Write, Quarantine & Security Center Registration, Cloud Adware

-PUP Detection/Prevention, Sensor Adware & PUP Detection/Prevention,
-Enable detection at a level above set for prevention

-Triage detection data/allowlist false positives. Once confident that majority of applications have executed, increase detection/prevention sliders, repeat triage, and allowlist. Repeat until you’ve reached recommended settings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

When does a host automatically get assigned to the default policy

A

-If a host is not a part of any groups, or the groups it belongs to has no policies assigned

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Initially what settings in the default policy are set to?

A

All settings in the default policy are Disabled

22
Q

What features does the Sensor ML provide?

A

-Includes Sensor Anti Malware on all supported OS Platforms, and Adware/PUP on MacOS.

-Sensor Anti Malware – provides ML Based on-sensor AV protection for malicious files, including offline protection.

23
Q

What are the Policy Settings?

A
  • Notify End Users
    -Unknown Executables
    -Unknown Detection Related Executables
    -Sensor Tampering Protection
23
Q

What are the types of categories?

A

-Enhanced Visibility
-Firmware
-Cloud ML
-On Write
-Quarantine
-Execution Blocking
-Exploit Mitigation
-Ransomware
-Exploitation Behavior
-Lateral Movement and Credential Access
-Remediation

24
Q

What are the sensor capability types?

A

-Sensor Visibility
-Next Gen AV
-Malware Protection
-Behavior Based Prevention

25
Q

What does the Notify End Users policy setting do?

A

-Display notification when a prevention action occurs
**only prevention

26
Q

What does the Unknown Executables and Unknown Detection Related Executables policy setting do?

A

-Controls portable executable files, executed on endpoint and whose hashes we haven’t seen before in cloud

-Control whether files are uploaded to cloud for advanced analysis, and if done for all unknown files or just related to detections.
**Results are never shared with 3rd party.

27
Q

What does the Sensor Tampering Protection policy setting do?

A

-Blocks attempts to tamper with sensor.

-Protects sensor related files, folders, and registry objects from renaming or deletion.

28
Q

What does the Enhanced Visibility category do?

A

Enabling sensor visibility settings as recommended – provides various IOA based prevention settings with data required to detect/prevent potentially malicious activity, and significantly enhanced your investigation and threat hunting capabilities

29
Q

What are the Enhanced Visibility Settings?

A

Additional User Mode Data:
-Allows sensor to gather additional data from user mode component by loading a library that hooks system APIs.
-Uses DLL injection to track process and thread activity, leverages internal or private APIs, which will help surface detections related to process hijacking or unauthorized reads of process data.

HTTP Detections:
-Allow sensor to monitor unencrypted HTTP traffic and certain encrypted HTTPS traffic on sensor for malicious patterns and generate detection events on non Server systems.

Interpreter Only:
-Provides visibility into malicious PowerShell interpreter usage. For hosts running Windows 10, Script Based Execution Monitoring may be used instead.

Engine:
-Provides visibility into malicious System Management Automation engine usage by any application – Requires Interpreter Only.

Redact HTTP Detection Details:
-Remove certain info from HTTP Detection events, including URL, raw HTTP Header, and POST Bodies if they were present. Affects additional details that would be included and may include personal information. When disabled, information is used to improve the response to detection events. Has no effect unless HTTP Detections is also enabled.

30
Q

What does the Cloud ML category do?

A

-Includes Cloud Anti-malware and Adware/PUP.
**Both Feature separate level sliders for Detection and Prevention.

-Enable detection first at a level above set for prevention

-Triage detection data and allowlist false positives as appropriate by hash via IOC Management.
**Use Cloud based ML to detect and prevent known malware for online hosts.

31
Q

What does the On Write category do?

A

-Use ML to analyze suspicious/quarantine suspicious files when they’re written to disk.

-To adjust detection sensitivity, change Anti Malware Detection levels in Sensor ML and Cloud ML.

32
Q

What does the Quarantine category do?

A

-Quarantine Executable files after they are prevented by NGAV

33
Q

What does the Execution Blocking category do?

A

-Custom Blocking, Suspicious Processes, Suspicious PowerShell Scripts/Commands, Suspicious Registry Operations, and Intelligence Sourced Threats, compliment Machine Learning preventions.

34
Q

What does the Exploit Mitigation category do?

A

-Stops attempts to exploit vulnerabilities and prevents hosts from being compromised.

-Prevention is only applied to new processes that start after the feature has been enabled.

-Next Gen AV Quarantine: Quarantine executable files after they’re prevented by NGAV. Set Anti-malware prevention levels to moderate and don’t use other AV solutions. Falcon registers with Windows Security Center – disables Defender.

-Unauthorized Remote Access IOA Category: Chopper Webshell, XPCOM Shell, Empyre Backdoor

  • Credential Dumping IOAs Category: Kc Password Decoder, Hash Collector
35
Q

What does the Remediation category do?

A

-Advanced Remediation, 3 Phase Prevention Policy Settings

36
Q

What does the Lateral Movement and Credential Access Category category do?

A

-Covers prevention of activity that is used to escalate logon privileges, such as usage of Windows Logon Bypass to open a command prompt

37
Q

What does the Exploitation Behavior category do?

A

-Exploitation Behavior Prevention IOAs involve blocking activities that occur immediately after the initial exploitation of an application.

38
Q

What does the Ransomware category do?

A

-Backup deletion, Cryptowall, File Encryption, File System Access

39
Q

What does the Firmware category do?

A

-BIOS Deep Visibility: Visibility into BIOS – detect suspicious and unexpected images.

40
Q

How to enable or disable prevention settings?

A

In the prevention policy settings page select enable all or select row to configure> save> confirm

41
Q

Which precedence will the CS Cloud give to different polices to resolve conflicts?

A
  • Cloud will automatically apply policy with the higher precedence.
42
Q

If a host is not a part of any groups, or the groups it belongs to has no policies assigned, it is automatically assigned a….

A
  • default policy
43
Q

What is the exception for a sensor being assigned a default policy?

A

The sensor is already set to a targeted policy

44
Q

Define prevention policies

A

-What activity will trigger detections and preventions on your hosts

45
Q

What are phase 1 prevention policies?

A

-Prevention policies that are intended to be used by customers setting up falcon for the the first time

46
Q

What are the characteristics of the phase 1 prevention policy?

A

-Part of a rapid deployment phase
*to be used with an existing antivirus and/or HIPS suite

-Does not fully protect

-Use for the minimum time required
*used for apps to execute, while triaging detections and allowlist false positives

47
Q

How to adjust policy precedence?

A

prevention policies page>toggle edit precedence on>click arrows to arrange the order of your policies>save

47
Q

How to adjust policy precedence?

A

prevention policies page>toggle edit precedence on>click arrows to arrange the order of your policies>save

48
Q

How long should it take you to get into establishing prevention policies phase 3?

A

-Within 90 days

49
Q

How long should it take to complete full sensor deployment and establish phase 2 settings

A

-No more than 45 days

CCFA (19 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions