8. CrowdStrike CCFA Training - IOC Management, IOA & Threat Detection

Welcome to Session 8 of the CrowdStrike Certified Falcon Administrator (CCFA) training series. This session focuses on IOC management and detection concepts within the CrowdStrike Falcon platform, along with a practical demonstration of blocking malicious indicators. What’s Covered in This Session IOC Management in CrowdStrike • Introduction to IOC management in the Falcon console • Understanding how indicators are configured and managed • Controlling execution of known malicious artifacts IOC, IOA & IOM Concepts • Indicator of Compromise (IOC), Indicator of Attack (IOA), Indicator of Misconfiguration (IOM) • Digital forensic evidence used to detect threats and misconfigurations • Visibility across system, application, and network-level activities Threat Detection Scenarios • System-level activities such as unauthorized access attempts, registry changes, malicious process execution • Application-level risks including injection attacks, outdated software, missing patches • Network-level threats such as port scanning, lateral movement, exposed services CrowdStrike Detection Approach • Falcon sensor monitoring on-write and on-execute activities • Use of machine learning for detection and prevention • Integration with CrowdStrike threat intelligence feeds Indicator Types and Use Cases • File hashes (MD5, SHA256), IP addresses, domains, URLs, FQDNs, certificates • Blocking known malicious software, applications, and executables • Managing access to remote tools, websites, and risky platforms Indicator-Based Control Examples • Blocking specific IP addresses and domains • Controlling application execution using file hashes and certificates • Managing software usage policies across endpoints Hands-on Lab – IOC Configuration • Blocking a domain using IOC settings • Testing detection using EICAR sample file • Validating policy enforcement and detection behavior Q&A and Discussion • Addressing queries related to IOC, IOA, and detection mechanisms • Clarifying real-world use cases and implementation scenarios Why This Matters • Enables proactive threat detection and prevention • Helps security teams control malicious activities at endpoint level • Strengthens overall endpoint security posture using intelligence-driven controls In the next session, the training will include a recap of the concepts covered so far along with a detailed overview of prevention policies in CrowdStrike. Stay Connected & Keep Learning! 🔔 Subscribe and hit the bell icon to follow the entire CrowdStrike Falcon series. 👍 Like & share this video if you find it useful. 💬 Drop your questions in the comments; I'll personally respond and guide you. #crowdstrike #crowdstrikefalcon #CrowdStrikeTraining #ccfa #edr #endpointsecurity #threathunting #incidentresponse #socanalyst #cybersecuritytraining #securityoperations #falconplatform #cloudsecurity #blueteam