You would like to search for ANY process execution that used a file stored in the Recycle Bin on a Windows host. Select the option to complete the following EAM query. aid=my-aid…

The correct answer is B. *$Recycle Bin*. This option is the correct one to complete the following EAM query: event_simpleName=ProcessRollup2 FileName=$Recycle Bin This query would search for any process execution that used a file stored in the Recycle Bin on a Windows host, as the asterisk (*) is a wildcard character…

Falcon Event Search

Question

You would like to search for ANY process execution that used a file stored in the Recycle Bin on a Windows host. Select the option to complete the following EAM query. aid=my-aid ImageFileName=________ event_simpleName=ProcessRollup2

Options

A*$Recycle Bin^
B$Recycle Bin
C^$Recycle Bin*
D^$Recycle.Bin%^

How the community answered

(46 responses)

A
2% (1)
B
89% (41)
C
2% (1)
D
7% (3)

Explanation

This option is the correct one to complete the following EAM query: event_simpleName=ProcessRollup2 FileName=$Recycle Bin This query would search for any process execution that used a file stored in the Recycle Bin on a Windows host, as the asterisk (*) is a wildcard character that matches any number of characters before or after the specified string. The other options are not correct, as they use different wildcard characters that do not match the desired pattern.

Topics

#wildcard search#EAM query#Recycle Bin detection#Falcon Event Search

Community Discussion

No community discussion yet for this question.

Full CCFH-202B Practice