Crowdstrike

---
name: crowdstrike
description: "Expert agent for CrowdStrike Falcon EDR platform. Covers Falcon sensor deployment, prevention/detection policies, Real Time Response (RTR), IOA/IOC management, CQL threat hunting, OverWatch, and Charlotte AI. WHEN: \"CrowdStrike\", \"Falcon\", \"RTR\", \"Falcon Insight\", \"OverWatch\", \"CQL\", \"Threat Graph\", \"IOA tuning\", \"Falcon sensor\", \"Charlotte AI\"."
license: MIT
---

# CrowdStrike Falcon

This skill covers CrowdStrike Falcon, the cloud-native endpoint detection and response platform. It has deep expertise in Falcon sensor architecture, policy configuration, threat hunting with CQL, Real Time Response operations, and IOA/IOC management.

## How to Approach Tasks

When you receive a request:

1. **Classify the request type:**
   - **Deployment / sensor management** — Load `references/architecture.md`
   - **Policy configuration (prevention/detection)** — Load `references/best-practices.md`
   - **Threat hunting** — Load `references/best-practices.md` for CQL guidance
   - **RTR operations** — Load `references/best-practices.md` for RTR commands
   - **Incident response** — Use RTR and detection investigation workflow below
   - **IOA/IOC management** — Load `references/best-practices.md`

2. **Identify module tier** — CrowdStrike capabilities vary by tier (Go/Pro/Enterprise/Elite/Complete MDR). Confirm what the user has access to before recommending features.

3. **Load context** — Read the relevant reference file for the specific area.

4. **Analyze** — Apply CrowdStrike-specific reasoning. Understand how Threat Graph AI correlates events and how IOA behavioral rules differ from traditional signatures.

5. **Provide actionable guidance** — Include specific Falcon console navigation, CQL queries, or RTR commands where applicable.

## CrowdStrike Falcon Architecture Overview

CrowdStrike is a fully cloud-native EDR platform. There is no on-premises management console.

**Core components:**
- **Falcon Sensor** — Lightweight agent (~25MB) deployed on endpoints. Communicates via TLS to Falcon cloud. Supports Windows, macOS, Linux, mobile (iOS/Android via Falcon for Mobile).
- **Threat Graph** — CrowdStrike's cloud-based AI/ML correlation engine. Processes trillions of events per week, correlating endpoint telemetry across all CrowdStrike customers to identify attack patterns.
- **Falcon Platform (console)** — Web UI at `falcon.crowdstrike.com`. All management, investigation, and response performed here.
- **Falcon Insight** — EDR component providing access to endpoint telemetry via CQL queries.
- **Falcon Prevent** — NGAV component providing on-sensor prevention (ML, behavioral, custom IOA).

**Module tiers:**
| Tier | Key Additions |
|---|---|
| Falcon Go | NGAV, device control, basic EDR |
| Falcon Pro | + Threat Intelligence, Falcon Insight (limited) |
| Falcon Enterprise | + Full Insight, custom IOA, OverWatch |
| Falcon Elite | + Identity Protection, Zero Trust |
| Falcon Complete MDR | Fully managed detection and response by CrowdStrike |

## Sensor Deployment

### Supported Platforms

| Platform | Sensor Type | Min Version Support |
|---|---|---|
| Windows | Windows sensor (CS sensor installer) | Windows 7 SP1 / Server 2008 R2 |
| macOS | macOS sensor | macOS 10.13 (High Sierra) |
| Linux | Linux sensor (RPM/DEB) | RHEL 6, Ubuntu 14.04 |
| Windows Server Core | Windows sensor | Supported (no GUI required) |
| VDI (persistent) | Standard deployment | Full support |
| VDI (non-persistent) | Use CID + provisioning tool | Special clone considerations |

### Deployment Methods

**Windows — Group Policy / SCCM / Intune:**
```powershell
# Silent install with CID
msiexec /i WindowsSensor.msi /quiet CID=<CID_with_checksum>

# Verify installation
sc query csagent
# Look for STATE: RUNNING
```

**Linux:**
```bash
# RPM-based (RHEL/CentOS/Amazon Linux)
sudo rpm -ivh falcon-sensor-*.rpm
sudo /opt/CrowdStrike/falconctl -s --cid=<CID>
sudo systemctl start falcon-sensor

# DEB-based (Ubuntu/Debian)
sudo dpkg -i falcon-sensor-*.deb
sudo /opt/CrowdStrike/falconctl -s --cid=<CID>
sudo systemctl start falcon-sensor
```

**macOS:**
```bash
# Install pkg
sudo installer -pkg FalconSensorMacOS.pkg -target /
# Set CID via falconctl
sudo /Applications/Falcon.app/Contents/Resources/falconctl license <CID>
```

### Sensor Verification and Health

```powershell
# Windows — Check sensor status
sc query csagent
Get-Service -Name csagent

# Check sensor version
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\CSAgent\Sim" | Select Version

# Linux — Check sensor status
sudo systemctl status falcon-sensor
sudo /opt/CrowdStrike/falconctl -g --version
sudo /opt/CrowdStrike/falconctl -g --rfm-state  # Reduced Functionality Mode

# macOS
sudo /Applications/Falcon.app/Contents/Resources/falconctl stats
```

**Reduced Functionality Mode (RFM):** Sensor is running but operating with limited capabilities, typically due to incompatible kernel version on Linux. Check kernel compatibility matrix and update sensor or kernel.

## Policy Configuration

### Prevention Policies

Prevention policies control NGAV behavior — what the sensor will block without human intervention.

**Key prevention policy settings:**

| Setting | Description | Recommendation |
|---|---|---|
| Extra caution | Blocks potentially unwanted programs aggressively | Test in Test mode first |
| Suspicious processes | Blocks processes matching suspicious behavioral patterns | Enable in Protect mode after tuning |
| Script control | Blocks/monitors PowerShell, VBScript, JScript execution | Use "Script-Based Execution Monitoring" + Block |
| Intelligence feeds | Block based on CrowdStrike threat intelligence | Enable |
| Custom blocking | Customer-defined process or file hash blocks | Use for known-bad organization-specific files |

**Prevention policy modes:**
- **Disabled** — No prevention, detection only
- **Detection** (Monitor) — Generate alerts but do not block
- **Prevention** (Protect) — Block and alert
- **Prevention + Alert** — Block, alert, and show user notification

**Best practice:** Maintain at minimum two policies — Workstations and Servers. Servers often need more conservative prevention settings due to critical business processes.

### Detection Policies

Detection policies control the verbosity of alerts and which detection categories are enabled.

**Key detection categories:**
- Cloud-delivered machine learning (off-sensor ML)
- Behavioral indicators (IOA-based alerting)
- Windows exploit mitigation
- Intelligence-based detections

## CQL (CrowdStrike Query Language) for Falcon Insight

CQL is used to query endpoint telemetry in Falcon Insight (Investigate > Threat Hunting or Events Search).

### CQL Syntax Fundamentals

```
# Basic field = value query
event_simpleName = "ProcessRollup2" AND FileName = "powershell.exe"

# Wildcard matching
CommandLine = "*-enc*" OR CommandLine = "*EncodedCommand*"

# Case-insensitive (default in CQL)
FileName = "mimikatz.exe"

# Time range (last 24 hours)
# Specified in the UI date picker, not in query syntax

# Multiple values using IN
FileName IN ("cmd.exe", "powershell.exe", "wscript.exe")

# NOT
event_simpleName = "ProcessRollup2" AND FileName != "svchost.exe"
```

### Essential Event Types (event_simpleName)

| Event | Description |
|---|---|
| `ProcessRollup2` | Process execution events |
| `NetworkConnectIP4` | IPv4 network connections |
| `NetworkConnectIP6` | IPv6 network connections |
| `DnsRequest` | DNS query events |
| `FileOpenInfo` | File access events |
| `RegGenericValueUpdate` | Registry value writes |
| `CommandHistory` | Executed command history |
| `UserLogon` | User authentication events |
| `SensorHeartbeat` | Sensor check-in events |
| `DetectionSummaryEvent` | Alert/detection summaries |

### Key CQL Hunting Queries

**Encoded PowerShell execution:**
```
event_simpleName = "ProcessRollup2"
AND FileName = "powershell.exe"
AND (CommandLine = "*-enc*"
     OR CommandLine = "*encodedcommand*"
     OR CommandLine = "*-e *"
     OR CommandLine = "*-nop*")
```

**Suspicious child processes from Office applications:**
```
event_simpleName = "ProcessRollup2"
AND ParentBaseFileName IN ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe")
AND FileName IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe")
```

**LSASS memory access (credential dumping):**
```
event_simpleName = "ProcessRollup2"
AND TargetProcessId_decimal != ""
AND TargetFileName = "*lsass.exe*"
| groupby([FileName, CommandLine])
```

**Lateral movement via PsExec/similar:**
```
event_simpleName = "ProcessRollup2"
AND FileName = "psexesvc.exe"
| groupby([ComputerName, UserName])
```

**DNS requests to high-entropy domains (DGA detection):**
```
event_simpleName = "DnsRequest"
AND DomainName = "*.*"
| groupby([DomainName, ComputerName])
| sort(count(), order=desc)
```

**Scheduled task creation:**
```
event_simpleName = "ProcessRollup2"
AND FileName = "schtasks.exe"
AND CommandLine = "*/create*"
| groupby([ComputerName, CommandLine, UserName])
```

## Real Time Response (RTR)

RTR provides an interactive shell session on any Falcon-monitored endpoint. Available in Enterprise tier and above.

### RTR Session Types

- **Responder** — Read-only: `ls`, `ps`, `netstat`, file download
- **Active Responder** — Read-write: file operations, process management, script execution
- **Admin** — Full: PUT custom files, run scripts, escalated commands

### Essential RTR Commands

```bash
# System information
runscript -raw=```systeminfo```

# List running processes
ps

# List network connections
netstat

# List directories
ls C:\Windows\System32\

# Get a file (download to Falcon console)
get C:\Users\user\Desktop\suspicious.exe

# Kill a process by PID
kill 1234

# Manage services
runscript -raw=```sc query malware_service```
runscript -raw=```sc stop malware_service```

# Check scheduled tasks
runscript -raw=```schtasks /query /fo LIST /v```

# Delete a malicious file
rm C:\Users\Public\payload.exe

# Dump process to file (requires Admin RTR)
memdump --pid 1234 --path C:\Temp\lsass.dmp
```

### RTR Bulk Operations

RTR can target device groups for multi-host operations:
1. Navigate to Hosts > Groups
2. Create/select device group
3. Use Detections > Respond to initiate RTR session
4. Use "Run Script on Multiple Hosts" for bulk execution

### RTR Script Management

Pre-built scripts stored in Falcon: Response > Scripts
```powershell
# Example: Collect forensic artifacts script
Get-Process | Select-Object Name, Id, CPU, WorkingSet, Path | Export-Csv C:\Temp\processes.csv
Get-NetTCPConnection | Export-Csv C:\Temp\connections.csv
Get-ScheduledTask | Export-Csv C:\Temp\scheduled_tasks.csv
```

## IOA (Indicators of Attack) Management

IOAs are behavioral rules that trigger on patterns of activity regardless of file hash or reputation.

### Custom IOA Rules

Custom IOAs allow organizations to write behavioral detection rules for their specific environment.

**IOA Rule components:**
- **Rule Group** — Container for related rules (e.g., "Finance Workstations Custom IOA")
- **Rule Type** — Windows Process Creation, Windows Network Connection, Windows Registry, etc.
- **Pattern** — Regex-based matching against fields (ImageFileName, CommandLine, etc.)
- **Action** — Detect only, or Detect + Prevent
- **Severity** — Informational, Low, Medium, High, Critical

**Custom IOA example — Detecting Base64-encoded PowerShell:**
```
Rule Name: Encoded PowerShell Execution
Rule Type: Windows Process Creation
ImageFileName: .*\\powershell\.exe
CommandLine: .*((\-e[nc]{0,1})|(\-[Ee][nN][cC][oO][dD][eE][dD])).*
Action: Detect
Severity: High
```

**Custom IOA example — Suspicious Parent for cmd.exe:**
```
Rule Name: Office App Spawning CMD
Rule Type: Windows Process Creation
ParentImageFileName: .*(\\winword\.exe|\\excel\.exe|\\outlook\.exe)
ImageFileName: .*\\cmd\.exe
Action: Detect + Prevent
Severity: Critical
```

### IOC Management (Indicators of Compromise)

Navigate to: Intelligence > IOC Management (or via API)

**IOC types supported:**
- SHA256 file hash
- MD5 file hash
- Domain
- IP address (IPv4 / IPv6)
- URL

**IOC actions:**
- **Detect** — Alert on match, no block
- **Block** — Prevent execution/connection (file execution for hashes, network for IPs/domains)
- **No Action** — Allowlist / suppress

**IOC upload via API (bulk):**
```python
import falconpy
ioc_api = falconpy.IOC(client_id="CLIENT_ID", client_secret="CLIENT_SECRET")

ioc_api.create_indicator(
    body={
        "indicators": [
            {
                "type": "sha256",
                "value": "abc123...",
                "action": "prevent",
                "severity": "high",
                "description": "Known ransomware dropper",
                "tags": ["ransomware", "incident-2024-001"]
            }
        ]
    }
)
```

## OverWatch and Charlotte AI

### OverWatch (Managed Threat Hunting)

OverWatch is CrowdStrike's 24/7 managed threat hunting team included with Enterprise and above tiers.

- Hunts across all Falcon customer telemetry for novel attack patterns
- Escalates findings as "OverWatch Detections" in the Falcon console
- Provides written narratives with attack chains in notifications
- Response SLA: Notification within 1 minute of confirmed malicious activity

**What OverWatch does NOT do:**
- OverWatch does NOT perform containment/response — that is the customer's responsibility
- OverWatch does NOT replace your own security operations
- Containment requires enabling RTR and acting on OverWatch notifications

### Charlotte AI (Generative AI Assistant)

Charlotte AI is CrowdStrike's AI assistant embedded in the Falcon console (available in applicable tiers).

**Capabilities:**
- Natural language threat hunting queries (converts English to CQL)
- Alert triage and explanation
- Incident summarization
- Remediation guidance generation
- Security posture questions

**Example Charlotte AI prompts:**
- "Show me all endpoints where PowerShell ran with encoded commands in the last 7 days"
- "Summarize this detection and tell me if it's likely a real attack"
- "What is the full attack chain for detection ID 12345?"
- "Which hosts have the most critical detections this week?"

## Reference Files

Load these for deep knowledge in specific areas:

- `references/architecture.md` — Falcon sensor architecture, cloud backend, Threat Graph AI, sensor deployment at scale, VDI/cloud workload considerations, kernel driver model
- `references/best-practices.md` — Prevention policy tuning, RTR operational procedures, IOA rule writing guidelines, CQL hunting playbooks, OverWatch integration workflows

## Diagnostic Scripts

Ready-made Falcon API script (read-only Detections scope) in `scripts/`.

- `scripts/01-detection-summary.sh` -- Recent detections summarized by severity/tactic/host (SOC triage)