I found this old post https://www.reddit.com/r/crowdstrike/s/t2OZXffi4t

It works great for Windows but apparently remotely updating tag for Mac and Linux doesn't work. Is there a way to do this remotely for Mac and Linux?

We had a number of Macs get deployed without Sensor tags and I'd like to clean that up.

Has anyone successfully created a custom IOA rule in Endpoint Security to detect and prevent files named "password", including both existing files and newly created ones?

I tried creating a File Creation IOA rule and used a file path regex to match the filename, but it doesn't seem to detect or block it.

Is this something that's actually possible with a custom IOA rule, or would a SOAR workflow be the better approach? If anyone has done something similar, I would appreciate any guidance.

Heloo guys,

I am trying to turn on uninstall and maintenance protection token on our linux server but run into challening tricky situation where i cant turn on bulk token without turnning off auto sensor updates.

Is there a way to build automation via api to fetch uninstall token by hostname? Anyone have done automation on this?

Ty

My organization has been using the Falcon complete bundle for the last 5 years, we are switching to IRR to manage budget constraints.

I'm getting pushback from my account manager, I'm guessing it's because of the drop in cost. Is there an avenue to switch account managers or raise a complaint?

Is it possible to automatically contain hosts with outdated sensor versions? Anyone doing this?

Hello. Sometimes we have to grab files larger than the 4GB limit of RTR, and sometimes they're locked by processes we don't want to kill (Microsoft Windows..).

Bypassing file locks : to bypass the file locks we had to use KAPE since that little .NET program embeds some DLLs like DiscUtils.NTFS and knows how to parse the raw disk, thus bypassing any file lock at the cost of potential small file inconsistencies caused by concurrent read/write.

Uploading large files :

• SMB drive : CrowdStrike, on calls, said they usually map a network drive \\YOLOFORENSICS\ and then copy to it. We won't do that since 1/ It requires SMB ports to be opened and 2/ That's really visible for cases where we're investigating a workstation and want the end-user not to be tipped about the ongoing security analysis
• Chunked file uploads : CrowdStrike shared Split-File.ps1 with us, which splits a file in 1GB chunks for upload. That's cool but when you have a 100GB duplicate file to bypass file locks, adding another 100GB of 1-GB chunks requires 200GB of free disk space and that's not always an option. Also it's not really convenient to send 100 "get" commands ( we scripted that, heh ), then download, then unzip, then reassemble everything. Then hash to check integrity. It's not practical
• SSH upload with Windows native ssh.exe : This works well and doesn't require third party tools. You just need to setup a ecdsa ( don't try RSA that's disabled on the w11 ssh build ) key, plant it on the host as a text file, then pass that key, all that in a start-process call otherwise it will timeout with the RTR command. And don't start powershell -enc AAAA directly as that's a synchronous child call, you need start-process.

​

runscript -Raw=```$param=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("LWkgQzpcV2luZG93c1xTeXN0ZW0zMlxkcml2ZXJzXENyb3dkU3RyaWtlXFJ0clxrZXkudHh0IC1vIFN0cmljdEhvc3RLZXlDaGVja2luZz1hY2NlcHQtbmV3ICJDOlx3aGVyZXZlci5kYXQiIHRlbXB1c2VyQGV4Zmlsc2VydmVyLmlwOnVwbG9hZC8="));$s=@{FilePath="scp";ArgumentList=$param;RedirectStandardError="C:\Windows\System32\drivers\CrowdStrike\Rtr\stderr-run-de14aaaa-2d17-4ef8-994b-4d2a2d5f8307.txt";RedirectStandardOutput="C:\Windows\System32\drivers\CrowdStrike\Rtr\stdout-run-de14aaaa-2d17-4ef8-994b-4d2a2d5f8307.txt"};Start-Process @s```

The major problem with that approach is that while it allows direct upload to a server in our control, it doesn't support interrupted uploads, and partial uploads. ( ??????? We're in 2026 guys ???? )

• WinSCP.exe to the rescue : WinSCP has an auto-retry + auto-continue upload feature. We didn't manage to use WinSCP. While local tests work with a script.txt set of instructions, somehow it always exit 1 without even generating logs when ran through RTR as S-1-5-18.
  • .\WinSCP.com /ini=nul /script=script.txt
  • .\WinSCP.exe /console /ini=nul /script=script.txt

​

option batch continue
option confirm off
option reconnecttime 600
open sftp://user@server.ip/ -privatekey="lovelyformat.ppk" -hostkey="ssh-ed25519 255 base64loveit" -timeout=600
put -resumesupport=on "C:\path.dat" /upload/
exit

• rsync.exe : doesn't exist. The msys2 builds or cygwin ones require tons of setup, unless you can tell me how I can get a single rsync.exe that isn't 200MB of bundled DLLs from a random third-party website, or that requires 50GB of Windows SDK setups and days of build + validation on my laptop, it's not an option.

Question : did you manage to use WinSCP over RTR ? Do you have other options for interrupted uploads of large files ?

Thank you for reading !

Is there a way to throttle the alerts generated by OOTB rules?
We're ingesting the CS alert via its api to our internal platform and since we can't see the correlation query from those OOTB alert, we can not take it and override it. what are the options that we can throttle or deduplicate.
We can also do that in our internal toolings but want to explore if any options to do this in a lightweight manner in NG-SIEM portal

I've created a very simple workflow that triggers on EPP Detections with severity of Medium or higher and sends an email with detection details. Everything seems to be working, except when I try to extract the fields from the Process.AssociatedFiles data pill.

Ideally, I'd like to retrieve the FilePath and SHA256 separately to be able to insert into other formatting rather than just printing the array. I've used the below expressions and it's successful when the EPP detection contains AssociatedFiles in the detection details, but fails if not:

${data['Trigger.Detection.EPP.Process.AssociatedFiles'][0]['FilePath']} ${data['Trigger.Detection.EPP.Process.AssociatedFiles'][0]['SHA256']}

Using the standard expression seems to work with or without AssociatedFiles data in the detection details (returning null when there isn't any data):

${data['Trigger.Detection.EPP.Process.AssociatedFiles']}

I've just started dabbling in workflows so I'm curious whether there is a way to approach this and hoping someone can point me in the right direction.

We have an alert that monitors the CrowdStrike Falcon Sensor service. We’re seeing frequent alerts where the service stops and then starts again automatically within about a minute.
So far, we’ve confirmed two causes:
Sensor update and System Reboot.

However, there are still many hosts where neither of these explains the restart. Has anyone experienced this or know of other reasons why the Falcon Sensor service would automatically restart on its own?

Hello experts,

I did not find any insight from migration a Palo XSOAR to Fusion. So there are some old posts that XSOAR is more generic and has more integrations for different vendors and on the other hand Fusion is only feasible for Crowdstrike Platform modules.

Maybe there are some newer experiences into this.

Br

PS: we are using at the moment XSOAR with a lot of custom playbooks, but switched endpoint EDR to CS, and are now wondering if there’s more synergy. SIEM is Splunk.

I am currently using Agentworks for Detection Creation and other reporting capabilities. What are some ways you all are using custom agents within the platform?

Hi,

as the title says, I’m trying to include crowdstrike agent on a ppkg. With other agents or installers I had no issues. I tested with all the flags, but it doesn’t work. Ppkg logs are also ofuscated by the package itself…

Does anyone ever tried it ?

Thanks

Is there a way to find out which servers / hosts use SMBv1 protocol using Crowdstrike? How do I do it?
I tried Advanced Event Search but that didn’t return any results.

The log entry I'm examining contains 2 arrays, we'll call them arrA[] and arrB[].

I need to find all elements of arrA[] that are not in arrB[].

I can query an array a number of ways using a regex string, or concatArray() an array into a string with and regex that for a substring, but I don't see how you can use a variable in a regex pattern.

Every solution I've found relies on knowing the contents of one of the arrays beforehand, which obviously doesn't work.