CrowdStrike 'FalconFlank' Unpatched Privilege Escalation: Detection and Mitigation Guide for Windows Defenders

---
title: Suspicious Child Process Spawned by CrowdStrike Falcon Sensor
id: 3f8a2c41-7b5e-4d19-a6c2-9e1f4b8d0a35
status: experimental
description: Detects command interpreters, script hosts, or LOLBins spawned as child processes of CrowdStrike Falcon sensor binaries, consistent with privilege escalation weaponization such as FalconFlank.
references:
  - https://www.bleepingcomputer.com/news/security/new-crowdstrike-falconflank-zero-day-grants-system-privileges/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\CSFalconService.exe'
      - '\CSFalconContainer.exe'
      - '\CSAgent.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\sc.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate sensor response actions (Real Time Response shells are typically launched under the RTR context — validate against Falcon console audit logs)
level: high
---
title: SYSTEM Process Executing from User-Writable Directory
id: 8b2d6f17-4c3a-4e81-b9d4-2f7a1c5e9038
status: experimental
description: Detects processes running as SYSTEM with executable images in user-writable locations, a common post-exploitation artifact of local privilege escalation including EDR sensor LPE abuse.
references:
  - https://www.bleepingcomputer.com/news/security/new-crowdstrike-falconflank-zero-day-grants-system-privileges/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_user:
    User: 'NT AUTHORITY\SYSTEM'
  selection_path:
    Image|contains:
      - '\Users\Public\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Windows\Temp\'
      - '\ProgramData\Microsoft\Crypto\'
  filter_legit:
    Image|startswith:
      - 'C:\Program Files\'
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
  condition: selection_user and selection_path and not filter_legit
falsepositives:
  - Software deployment tools staging binaries in ProgramData
  - Some installers running elevated from temp paths
level: high
---
title: New Local Administrator Account Created via Command Line
id: 5c1e9a74-2d8b-4f36-a7e0-6b3d2f9c4187
status: experimental
description: Detects creation of local accounts and addition to the administrators group via net.exe, a common immediate action after SYSTEM-level privilege escalation.
references:
  - https://attack.mitre.org/techniques/T1136/
  - https://attack.mitre.org/techniques/T1098/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.t1136.001
  - attack.t1098
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
  selection_cli:
    CommandLine|contains:
      - 'localgroup administrators'
      - 'user /add'
      - ' /add'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate provisioning scripts and helpdesk activity
level: medium

// Hunt: FalconFlank-style LPE — suspicious children of CrowdStrike sensor processes
// and SYSTEM execution from user-writable paths
let SensorBinaries = dynamic(["CSFalconService.exe", "CSFalconContainer.exe", "CSAgent.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "net.exe", "net1.exe", "sc.exe", "wmic.exe"]);
let UserWritablePaths = dynamic([@"\Users\Public\", @"\AppData\Local\Temp\", @"\AppData\Roaming\", @"\Windows\Temp\"]);
union
(
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName in~ (SensorBinaries)
    | where FileName in~ (SuspiciousChildren)
    | project TimeGenerated, DeviceName, AccountName,
              ParentProcess = InitiatingProcessFileName,
              ChildProcess = FileName,
              ProcessCommandLine, FolderPath, SHA256,
              Indicator = "Suspicious child of Falcon sensor"
),
(
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where AccountName =~ "system"
    | where FolderPath has_any (UserWritablePaths)
    | where not(FolderPath startswith @"C:\Program Files")
    | project TimeGenerated, DeviceName, AccountName,
              ParentProcess = InitiatingProcessFileName,
              ChildProcess = FileName,
              ProcessCommandLine, FolderPath, SHA256,
              Indicator = "SYSTEM execution from user-writable path"
)
| order by TimeGenerated desc

-- FalconFlank LPE Triage: SYSTEM processes from user-writable paths
-- and unexpected children of CrowdStrike Falcon sensor binaries
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       get_member(field='Exe', member='Authenticode') AS Signature
FROM pslist()
WHERE (
        -- SYSTEM processes executing from user-writable locations
        Username =~ 'SYSTEM'
        AND (Exe =~ '(?i)Users\\\\Public|AppData\\\\Local\\\\Temp|AppData\\\\Roaming|Windows\\\\Temp')
        AND NOT Exe =~ '(?i)^C:\\\\Program Files'
      )
   OR (
        -- Suspicious interpreters whose parent lineage may trace to sensor abuse
        Name =~ '(?i)^(cmd|powershell|pwsh|mshta|rundll32|net|net1)\.exe$'
        AND CommandLine =~ '(?i)localgroup administrators|/add|encodedcommand|-enc'
      )
ORDER BY CreateTime DESC

#Requires -RunAsAdministrator
# FalconFlank Compensating Controls Audit — Security Arsenal
# Verifies Falcon sensor integrity and sweeps for LPE post-exploitation artifacts

$report = [ordered]@{}

# 1. Confirm sensor version and channel file currency
$sensorPath = "$env:ProgramFiles\CrowdStrike"
if (Test-Path $sensorPath) {
    $report['SensorBinaries'] = Get-ChildItem $sensorPath -Filter *.exe |
        Select-Object Name, @{N='Version';E={$_.VersionInfo.ProductVersion}}, LastWriteTime
} else {
    $report['SensorBinaries'] = 'Falcon sensor NOT FOUND at expected path'
}

# 2. Verify sensor service state and binary path integrity
$csService = Get-CimInstance Win32_Service -Filter "Name='CSFalconService'" -ErrorAction SilentlyContinue
$report['ServiceState']   = $csService.State
$report['ServicePath']    = $csService.PathName
$report['ServiceAccount'] = $csService.StartName
# ALERT if PathName does not point into C:\
Program Files\CrowdStrike
if ($csService.PathName -notmatch 'Program Files\\CrowdStrike') {
    Write-Warning "ANOMALY: CSFalconService binary path is unexpected: $($csService.PathName)"
}

# 3. Sweep: SYSTEM-owned processes executing from user-writable paths
$report['SuspiciousSystemProcs'] = Get-CimInstance Win32_Process |
    Where-Object {
        $_.ExecutablePath -match 'Users\\Public|AppData\\Local\\Temp|AppData\\Roaming|Windows\\Temp' -and
        $_.ExecutablePath -notmatch '^C:\\Program Files'
    } | ForEach-Object {
        $owner = Invoke-CimMethod -InputObject $_ -MethodName GetOwner
        if ($owner.User -match 'SYSTEM') {
            [PSCustomObject]@{ PID=$_.ProcessId; Path=$_.ExecutablePath; Cmd=$_.CommandLine }
        }
    }

# 4. Sweep: recent local admin group membership changes
$report['LocalAdmins'] = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue |
    Select-Object Name, ObjectClass, PrincipalSource

# 5. Check for unexpected child processes of sensor binaries (last 24h, Sysmon/4688 required)
$report['SensorChildProcs'] = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'CSFalconService\.exe|CSFalconContainer\.exe' -and
                   $_.Message -match 'cmd\.exe|powershell\.exe|mshta\.exe|rundll32\.exe|net\.exe' } |
    Select-Object TimeCreated, Message -First 20

$report | ConvertTo-Json -Depth 4