CrowdStrike Falcon

/ IT Support Playbook

545 Endpoints • SU-Win-Prod & RTR-Win-Prod

Cloud:
Open Falcon Detections ↗ • Host Management (545 Hosts) ↗ • CrowdStrike Cloud Status ↗

How to Trace & Mitigate a Flagged Alert

5-step triage procedure for frontline IT Support when an alert fires in CrowdStrike Falcon.

1

Check the Action Status Header

Open the alert in Activity > Endpoint Detections and check the status header badge:

PREVENTED ✓ Threat Contained

The file or script was blocked or quarantined immediately by Falcon before runtime. The host is safe. Review the source with the user, but no emergency containment is required.

DETECTED ⚠ Review Required

The action was logged and flagged, but NOT blocked by policy. The command executed on the endpoint. Proceed through Steps 2–5 to trace the execution and apply containment if necessary.

2

Trace the Process Tree (Parent vs Child)

Look directly above the flagged process node in the Execution Tree to find what launched it.

Execution Tree Hierarchy:
[1] explorer.exe (PID 2104) User Windows desktop session
└── [2] OUTLOOK.EXE (PID 4820) User opened email attachment
└── [3] WINWORD.EXE (PID 7112) Word document execution
└── [4] powershell.exe -enc SQBFA... (PID 9340) FLAGGED NODE
Legitimate IT Parent Binaries:
  • CcmExec.exe (ConfigMgr / SCCM hardware inventory)
  • services.exe (Windows System Background Services)
  • Authorized RMM management tools & scheduled backup scripts
High-Suspicion Parents (Living-off-the-Land):
  • Office apps (OUTLOOK, WINWORD, EXCEL) launching CMD/PowerShell
  • Web browsers (chrome.exe, msedge.exe) spawning shell scripts
  • Unknown binaries executing from C:UsersAppDataLocalTemp
3

Inspect Command Line Arguments

Select the flagged node in Falcon and read the full command-line string in the right-hand panel.

Common Adversary Flags:
  • -enc / -EncodedCommand: Base64 payload obfuscation.
  • DownloadString / IWR: Web cradle pulling code from internet.
  • -ExecutionPolicy Bypass: Disabling PowerShell security controls.
  • vssadmin delete shadows: Ransomware deleting shadow copies.
Safe Base64 PowerShell Decoder:

Safely decode the Base64 parameter on your local machine without executing it:

[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String("PASTE_ENCODED_STRING_HERE"))
4

Determine the Verdict

Evaluate the activity against our operational criteria:

A. Verified IT Automation (False Positive)

The parent process is an approved tool (ConfigMgr, Intune, RMM) and the command matches scheduled maintenance. -> Proceed to Path 5B (Closure).

B. Unverified / Adversary Activity (True Threat)

An office macro, browser, or temp directory launched encoded commands or network downloads. -> Proceed to Path 5A (Containment & Escalation).

5

Execute Mitigation Procedure

Select the appropriate resolution path:

Path 5A: Active Threat Mitigation Action Required
1. Apply Network Containment:

In Falcon Console, open Host Management, select the machine, and click Network Contain. This blocks lateral movement while keeping the Falcon sensor connection alive.

⚠ Do NOT reboot the computer. Rebooting purges volatile RAM memory needed for forensics.

2. Collect Artifacts via RTR:

Connect to the host using policy RTR-Win-Prod. Use get "C:path ile.ext" to pull the script or binary to the cloud. (memdump is disabled by policy to prevent endpoint freezing).

3. Escalate to Security Lead:

Notify the SOC Lead with Hostname, Detection ID, and User Account.

Path 5B: Routine False Positive Closure Document & Close

Copy this standard note into the Falcon detection comment box:

Update detection status in Falcon to: Closed -> False Positive.

Copied to clipboard