CrowdStrike Falcon Unpatched Privilege Escalation Flaw: Detection, Hardening, and Interim Mitigation Guide

---
title: CrowdStrike Falcon Sensor Spawning Shell or Scripting Engine
id: a4e7c2d1-9f38-4b6e-8c12-5d7f9a3e1b02
status: experimental
description: Detects CrowdStrike Falcon sensor processes spawning command shells or script interpreters, a strong indicator of successful exploitation of the published unpatched local privilege escalation vulnerability in the Falcon sensor.
references:
  - https://www.infosecurity-magazine.com/news/crowdstrike-privilege-escalation/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\CSFalconService.exe'
      - '\CSFalconContainer.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Authorized CrowdStrike support diagnostics performed under change control
level: high
---
title: CrowdStrike Falcon Service Tampering Attempt
id: c8b3f5a2-1e64-4d9c-b207-8a4f6c1d9e53
status: experimental
description: Detects attempts to stop, delete, disable, or reconfigure the CrowdStrike Falcon sensor service (CSFalconService) via service control or process termination utilities. Common attacker behavior following privilege escalation to blind endpoint telemetry.
references:
  - https://www.infosecurity-magazine.com/news/crowdstrike-privilege-escalation/
  - https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_cli:
    CommandLine|contains: 'CSFalconService'
  selection_tools:
    Image|endswith:
      - '\sc.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\taskkill.exe'
  condition: selection_cli and selection_tools
falsepositives:
  - Authorized sensor maintenance performed under change control
level: high
---
title: Unauthorized Write to CrowdStrike Installation Directory
id: e2d6a8c4-3b71-4f5a-9c38-6b2e7d4a8f15
status: experimental
description: Detects file creation or modification inside the CrowdStrike Falcon installation directory by any process other than the sensor or its installer, which may indicate tampering or exploitation staging against the unpatched sensor.
references:
  - https://www.infosecurity-magazine.com/news/crowdstrike-privilege-escalation/
  - https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains: '\Program Files\CrowdStrike\'
  filter_sensor:
    Image|endswith:
      - '\CSFalconService.exe'
      - '\CSFalconContainer.exe'
      - '\CSFalconUI.exe'
      - '\WindowsSensor.exe'
      - '\msiexec.exe'
  condition: selection_path and not filter_sensor
falsepositives:
  - CrowdStrike cloud-initiated sensor upgrades via the installer
level: medium

// Hunt 1: Falcon sensor spawning shells or script engines — direct exploitation artifact
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("CSFalconService.exe", "CSFalconContainer.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc

// Hunt 2: Service-control or termination attempts against the Falcon sensor
DeviceProcessEvents
| where ProcessCommandLine has "CSFalconService"
| where ProcessCommandLine has_any ("stop", "delete", "disable", "config", "/f")
| where FileName in~ ("sc.exe", "net.exe", "net1.exe", "taskkill.exe", "powershell.exe", "pwsh.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

// Hunt 3: Non-sensor processes writing into the CrowdStrike installation directory
DeviceFileEvents
| where FolderPath has @"C:\Program Files\CrowdStrike\"
| where InitiatingProcessFileName !in~ ("CSFalconService.exe", "CSFalconContainer.exe", "CSFalconUI.exe", "WindowsSensor.exe", "msiexec.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ActionType
| order by TimeGenerated desc

-- Hunt: live processes parented to CrowdStrike Falcon sensor processes (possible LPE artifact)
LET falcon <= SELECT Pid FROM pslist() WHERE Name =~ 'CSFalcon(Service|Container)'
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM falcon)

-- Hunt: active service-control commands referencing the Falcon sensor
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)CSFalconService'
  AND Name =~ '(?i)(sc|net|net1|taskkill|powershell|pwsh)\.exe'

#Requires -RunAsAdministrator
# CrowdStrike Falcon unpatched LPE — verify, harden, hunt
# Ref: https://www.infosecurity-magazine.com/news/crowdstrike-privilege-escalation/

# 1. Confirm the Falcon sensor service is present and running — a stopped or missing service is itself an alert
$svc = Get-Service -Name CSFalconService -ErrorAction SilentlyContinue
if (-not $svc -or $svc.Status -ne 'Running') {
    Write-Warning "CSFalconService missing or not running on $env:COMPUTERNAME — investigate for tampering."
} else {
    Write-Host "[OK] CSFalconService running (StartType: $($svc.StartType))"
}

# 2. Report the sensor build so the vendor fix can be verified the moment it ships
$exe = Join-Path $env:ProgramFiles 'CrowdStrike\CSFalconService.exe'
if (Test-Path $exe) {
    Write-Host "[INFO] Falcon sensor build: $((Get-Item $exe).VersionInfo.ProductVersion)"
}

# 3. Review the service DACL — only SYSTEM and Administrators should hold control rights
sc.exe sdshow CSFalconService

# 4. Sweep Sysmon for the sensor spawning shells (direct exploitation artifact)
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-Sysmon/Operational'; Id = 1 } -MaxEvents 10000 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'ParentImage: .*\\CSFalcon(Service|Container)\.exe' -and
                   $_.Message -match 'Image: .*\\(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32)\.exe' } |
    Select-Object TimeCreated, Message | Format-List

# 5. Sweep Security 4688 for service-control attempts against the sensor (requires command-line auditing)
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4688 } -MaxEvents 20000 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'CSFalconService' -and $_.Message -match '(stop|delete|disable|config)' } |
    Select-Object TimeCreated, Message | Format-List

# 6. Reduce blast radius — enumerate local administrators and flag anything not on the approved list
Get-LocalGroupMember -Group 'Administrators' | Select-Object Name, ObjectClass, PrincipalSource

# 7. Confirm application control is constraining standard-user code execution
if (Get-AppLockerPolicy -Effective -ErrorAction SilentlyContinue) {
    Write-Host "[OK] AppLocker effective policy present."
} else {
    Write-Warning "No AppLocker policy detected — an LPE plus unconstrained code execution is a ransomware staging ground."
}
Write-Host "Review output: sensor-spawned shells, service-control events, or unexpected admins require IR escalation."