CrowdStrike
CCFH-202B · Question #66
Your environment has several PowerShell scripts running that are Base64 encoded. Which of the following areas of Falcon will show you the decoded PowerShell commands?
The correct answer is D. Command Line view of a Detection. You've hit your limit · resets 12:50am (America/New_York)
Malware and Script Analysis
Question
Your environment has several PowerShell scripts running that are Base64 encoded. Which of the following areas of Falcon will show you the decoded PowerShell commands?
Options
- APowerShell Encoded Commands report
- BPowerShell Hunt report
- CEvent Search for event_simpleName=processrollup2 FileName=powershell.exe
- DCommand Line view of a Detection
How the community answered
(27 responses)- A4% (1)
- C4% (1)
- D93% (25)
Explanation
You've hit your limit · resets 12:50am (America/New_York)
Topics
#PowerShell#Base64 encoding#command line#detection details
Community Discussion
No community discussion yet for this question.