Where are quarantined files stored on Windows hosts?
According to theCrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, when you quarantine a file from a host using IOC Management or Real Time Response (RTR), you are moving it from its original location to a secure location on the host where it cannot be executed2.The file is also encrypted and renamed with a random string of characters2.On Windows hosts, quarantined files are stored in C:\Windows\System32\Drivers\CrowdStrike\Quarantine folder2.
Limited Time Offer
25%
Off
Currently there are no comments in this discussion, be the first to comment!
Currently there are no comments in this discussion, be the first to comment!