The correct approach is to use a workflow that triggers from a new endpoint detection, queries the endpoint telemetry for known artifacts, and then uses the built-in “Remove All Associated Artifacts” action. This is stronger than simply blocking execution because the scenario requires cleanup of multiple artifact types: an executable, a startup shortcut, and a registry Run key. A Custom IOA can prevent or detect behavior, but it does not automatically remove all related artifacts already present on the host. A quarantine rule is also too narrow because not all artifacts are files suitable for quarantine, especially registry persistence. Using Falcon workflow automation makes the remediation repeatable for future detections and reduces manual responder effort while preserving consistent artifact removal logic across impacted endpoints.