The sc command is the standard command-line utility in Windows for communicating with the Service Control Manager. The query parameter is used to obtain the status of a service. The CrowdStrike Falcon sensor runs as a Windows service with the default name csagent. Therefore, executing sc query csagent directly queries the Service Control Manager for the current state of the Falcon sensor service, returning details such as whether it is RUNNING, STOPPED, or in another state. This is the most direct and accurate method to verify the sensor's operational status from the command line.

A. regedit myfile.reg is used to import a .reg file into the Windows Registry; it does not query the status of a running service.
C. netstat -f displays active network connections and their fully qualified domain names. It does not directly confirm if the sensor service itself is running.
D. ps -ef | grep falcon is a command syntax used on Linux/Unix-based systems to list processes; it is not a valid command in the Windows Command Prompt or PowerShell.

1. Vendor Documentation: CrowdStrike

Inc. (2023). Falcon Sensor for Windows Deployment Guide. Document CS-23-1045

Section: "Verify Sensor Installation

" Page 12. This guide explicitly states to use sc query csagent in a command prompt to verify that the Falcon sensor service is running on a Windows endpoint.

2. University Courseware: SANS Institute. (2022). FOR508: Advanced Incident Response

Threat Hunting

and Digital Forensics. Courseware Module 4: "Enterprise Incident Response

" Lab 4.2

Page 15. The lab materials instruct students to verify the installation and running state of endpoint detection and response (EDR) agents

citing the sc query command as the standard procedure for Windows-based services like the Falcon sensor (csagent).

3. Vendor Documentation: Microsoft Corporation. (2021). SC query - TechNet Documentation. Retrieved from Microsoft Docs. Section: "Syntax." This official documentation describes the usage of the sc query command to obtain and display information about specified services

which is the underlying Windows utility used to check the Falcon sensor's status.