The Falcon Detections page will attempt to decode Encoded PowerShell Command line parameters when which PowerShell Command line parameter is present?

The Falcon Detections page will attempt to decode Encoded PowerShell Command line parameters when which PowerShell Command line parameter is present?
A . -Command
B. -Hidden
C. -e
D. -nop

View Answer

Answer: A

Explanation:

The Falcon Detections page will attempt to decode Encoded PowerShell Command line parameters when the -Command parameter is present. The -Command parameter allows PowerShell to execute a specified script block or string. If the script block or string is encoded using Base64 or other methods, the Falcon Detections page will try to decode it and show the original command. The – Hidden, -e, and -nop parameters are not related to encoding or decoding PowerShell commands.

Reference: https://www.crowdstrike.com/blog/tech-center/decoding-powershell-commands-in-crowdstrike-falcon/