EXCLUSIONS Flashcards
(46 cards)
How to write an effective file exclusion rule using glob syntax
- When setting path, start with root folder in full path. Do not include drive letter, device, hard disk vol or leading asterisks or backslashes
- Program Files (x86)\MySoftware*
**Excludes everything in the folder but not subfolders - Program Files (x86)\MySoftware**
**Excludes everything in the folder, including subfolders - Program Files (x86)\MySoftware\SampleSoftware.exe
**Excludes SampleSoftware.exe if it’s in - ProgramFiles(x86)\MySoftware\Users*\Desktop\RunMe.exe **Excludes RunMe.exe within any user Desktop folders
- **\RunMe.exe – (The exception) Globally excludes RunMe.exe in any location
How do you apply pattern exclusions to groups?
2 ways:
-Disable detection on a host
-Can set up a File Exclusion Pattern – prevents detections from appearing for specific file names, paths and extensions
How to manage exclusion files?
Choose “all hosts” or “Groups of hosts”
Select Precedence
**Precedence of exclusion rules enacted on hosts/group of hosts
What does using the Glob Syntax provide when creating exclusions?
- Glob syntax allows you to create exclusion patterns to easily exclude files and folders. Glob syntax supports standard ASCII characters – all alphabetical characters are not case-sensitive
What are the 3 Levels of Exclusion patterns?
3 levels of exclusion patterns:
-ML Exclusions
-IOA Exclusions
-Sensor Visibility Exclusions
Which exclusion pattern stops ML detections and preventions and/or uploads to CS for a trusted file path
- ML Exclusions
Which exclusion pattern stops seeing detections and allow activity for specified IOAs
-IOA Exclusions
Which exclusion pattern creates a sensor visibility exclusion to reduce performance issues in a trusted file path by stopping all sensor visibility for that path .
-Sensor Visibility Exclusions
How to enable exclusion rules?
To enable exclusion rule on host/groups of hosts
-Falcon console > Host Management > Prevention Policy assign to host name
When coming across a detection you know is legitimate, what needs to be done?
-Setup an allowlist or put it in an exclusion
What file executables should be avoided for windows systems when configuring Sensor Visibility exclusions?
-cmd.exe
-command.exe
-PowerShell.exe
-C:\Windows\System32*
What is an indicator of attack (IOA)?
-A logical rule designed to identify and block malicious intent regardless of malware or exploit
How to review any created exclusions?
-Falcon menu>endpoint security>configure>exclusions
What 3 part process in Falcon needs to take place when deploy sensors to monitor your detections?
-Test a subset of hosts on the prevention policy
-Identify any applications that have produced a false positive
-Allowlist the false positives
When doing any type of allowlisting what things need to be identified?
-Tactic
-Technique
How to allowlist a false positive?
Falcon main menu> endpoint security> monitor>endpoint detections>click on a detection that needs to be allowedlisted>scroll down on left side of screen and locate IOC management section> clikc IOC management icon>input description and filename>select host groups to apply or select all hosts> select platform type>select allow, do not detect from the action dropdown> click add hashes
How long does an allowlist take to be applied to an online machine?
-10-15 minutes
How to allowlist a ML detection?
Falcon main menu> endpoint security> monitor>endpoint detections> select a tactic> select a technique>select group dropdown> select grouped by triggering file> select group by host in same dropdown (determines what may need to be excluded or helps narrow down false positives)
When should you apply ML exclusions?
-When there is a number of detections associated with a certain application or binary
How to create a ML Exclusion?
Falcon main menu> endpoint security>monitor> endpoint detections>click the identified triggering file If not ther click the search bar and type triggering file & select the file you want to manage> select the grouping drop down and select Grouped by Hash> select grouped by command line in same dropdown (shows the triggering file path)>copy the file path>select grouped by host in same dropdown> contact host and see if there is an alternative file path that doesn’t trigger detections if NOT, then add to an exclusion
What do machine learning exclusions prevent?
-Stops ML detections and preventions for the specified file path
falcon main menu>endpoint security>configure> exclusions>make sure your in machine learning exclusions tab>create exclusion>select all hosts or group of hosts>next> select detections and preventions checkbox under the excluded from section>paste file path in exclusion pattern text area> click test pattern to make sure its written/ pasted correctly>create exclusion>
How to create an IOA exclusion
-Falcon menu>endpoint security>monitor>endpoint detections>click on a detection that needs to be allowlisted>make sure that the tactic and technique is NOT machine learning>determine that the program is a legit binary operating in your environment>scroll down left side of the screen and locate the command line and file path sections>scroll back up and click create IOA exclusion>click host groups and select groups to be targeted>input name and description>next>create exclusion>
How can an IOA detection be identified?
-If the tactic and technique do NOT mention ML
What’s ineligible for a self-Service IOA exclusion?
-Overwatch detections
-Custom IOA detections
-Small set of internal detection types
