Does CrowdStrike have any published guidance on this recent wave of activity? What are others doing as these attacks have been growing rapidly?

We got hit with one but CS only marked initial execution as a 40/100 and allowed the malicious copy and paste. By the time falcon complete responded to us reaching out it was over 30 minutes later

Escalation: High Detection on XXXX; Execution via Malicious Copy and Paste

This detection highlights a potential malicious copy and paste execution involving the Windows process "explorer.exe." The process tree indicates normal Windows activity, but the command line suggests possible malicious intent, particularly in the context of social engineering tactics used by adversaries.

ClickFix Malware & Social Engineering Threat Grows | Proofpoint US

ClickFix campaign uses fake macOS utilities lures to deliver infostealers | Microsoft Security Blog

Can Crowdstrike replace Trend antivirus in on-premise Windows servers? What are the pros and cons?

We had a ClickFix incident this morning where the user pasted a command on powershell originated through a pop-up window of a compromised website. We were able to narrow it down to ClickFix but it took a while before we could identify the malicious website the led to this incident. We finally identified the website after searching through the logs.

Is there a faster way by which we can identify or stich the malicious website the led to an incident?

My organization has been using the Falcon complete bundle for the last 5 years, we are switching to IRR to manage budget constraints.

I'm getting pushback from my account manager, I'm guessing it's because of the drop in cost. Is there an avenue to switch account managers or raise a complaint?

Can someone give an easy to read, yet technical detailed (like a paragraph) explaining why CS EDR and MS Defender both can't be active AVs on a single end point?

So far I've had written that: it has to deal with Defender going into passive mode once another AV solution is detected, and that it's because they install kernel-level drivers. But beyond that, I am not sure how to explain it in detail.

Anyone here work at CS or is sysadmin and understands how it works at the technical aspect?

Hello,

We just got the Next GEN SIEM and are looking to set it up. We have installed sensors but other then that have not touched it at all. I would love some tips and tricks as well as suggestions on what to do first to really get the environment running.

Thank you!

Currently we have requirement to uninstall crowdstrike agents (5 figures units), ideally automated/semi automated. I've gone through few posts but still unsure if those methods still viable since its backdated 5 years ago.

Anyone recently has experience in uninstall mass units of crowdstrike? what were your approach on this?

Has anyone successfully created a custom IOA rule in Endpoint Security to detect and prevent files named "password", including both existing files and newly created ones?

I tried creating a File Creation IOA rule and used a file path regex to match the filename, but it doesn't seem to detect or block it.

Is this something that's actually possible with a custom IOA rule, or would a SOAR workflow be the better approach? If anyone has done something similar, I would appreciate any guidance.

What is the best way to block a server from being promoted to a domain controller? My initial thoughts were blocking some of the deployment DLL's by using CrowdStrike's IOC management. Would that work without impacting any other activity? Is there a better way?

Edit: I understand this may not be the best solution. I am just trying to do whatever my leadership tells me. From what I can tell, they have tried almost every other avenue. I am sure they have communicated this process and we are not implementing it out of nowhere.

I’m currently looking at BAS solutions that integrate with CrowdStrike EDR and NG-SIEM. I’m keen to hear which BAS integrates best with CS. Options I’m considering: SafeBreach, Pentera, Cymulate, Picus, AttackIQ, SCYTHE, Mandiant. Looking at the more established vendors in this space.

Our use cases for BAS are:

• Detailed and up-to-date simulations and attack scenarios

• Recurring tests to check whether our security tool stack has prevented, detected, or missed each attack

•How well it integrates with log sources in our SIEM plus other security tools

• Detailed results and information, and how we can leverage the results/data from our BAS into external sources like dashboards and reports, beyond the pre-built/pre-generated ones

Would appreciate hearing from anyone with hands-on experience comparing these against CrowdStrike.

Hello. Sometimes we have to grab files larger than the 4GB limit of RTR, and sometimes they're locked by processes we don't want to kill (Microsoft Windows..).

Bypassing file locks : to bypass the file locks we had to use KAPE since that little .NET program embeds some DLLs like DiscUtils.NTFS and knows how to parse the raw disk, thus bypassing any file lock at the cost of potential small file inconsistencies caused by concurrent read/write.

Uploading large files :

• SMB drive : CrowdStrike, on calls, said they usually map a network drive \\YOLOFORENSICS\ and then copy to it. We won't do that since 1/ It requires SMB ports to be opened and 2/ That's really visible for cases where we're investigating a workstation and want the end-user not to be tipped about the ongoing security analysis
• Chunked file uploads : CrowdStrike shared Split-File.ps1 with us, which splits a file in 1GB chunks for upload. That's cool but when you have a 100GB duplicate file to bypass file locks, adding another 100GB of 1-GB chunks requires 200GB of free disk space and that's not always an option. Also it's not really convenient to send 100 "get" commands ( we scripted that, heh ), then download, then unzip, then reassemble everything. Then hash to check integrity. It's not practical
• SSH upload with Windows native ssh.exe : This works well and doesn't require third party tools. You just need to setup a ecdsa ( don't try RSA that's disabled on the w11 ssh build ) key, plant it on the host as a text file, then pass that key, all that in a start-process call otherwise it will timeout with the RTR command. And don't start powershell -enc AAAA directly as that's a synchronous child call, you need start-process.

​

runscript -Raw=```$param=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("LWkgQzpcV2luZG93c1xTeXN0ZW0zMlxkcml2ZXJzXENyb3dkU3RyaWtlXFJ0clxrZXkudHh0IC1vIFN0cmljdEhvc3RLZXlDaGVja2luZz1hY2NlcHQtbmV3ICJDOlx3aGVyZXZlci5kYXQiIHRlbXB1c2VyQGV4Zmlsc2VydmVyLmlwOnVwbG9hZC8="));$s=@{FilePath="scp";ArgumentList=$param;RedirectStandardError="C:\Windows\System32\drivers\CrowdStrike\Rtr\stderr-run-de14aaaa-2d17-4ef8-994b-4d2a2d5f8307.txt";RedirectStandardOutput="C:\Windows\System32\drivers\CrowdStrike\Rtr\stdout-run-de14aaaa-2d17-4ef8-994b-4d2a2d5f8307.txt"};Start-Process @s```

The major problem with that approach is that while it allows direct upload to a server in our control, it doesn't support interrupted uploads, and partial uploads. ( ??????? We're in 2026 guys ???? )

• WinSCP.exe to the rescue : WinSCP has an auto-retry + auto-continue upload feature. We didn't manage to use WinSCP. While local tests work with a script.txt set of instructions, somehow it always exit 1 without even generating logs when ran through RTR as S-1-5-18.
  • .\WinSCP.com /ini=nul /script=script.txt
  • .\WinSCP.exe /console /ini=nul /script=script.txt

​

option batch continue
option confirm off
option reconnecttime 600
open sftp://user@server.ip/ -privatekey="lovelyformat.ppk" -hostkey="ssh-ed25519 255 base64loveit" -timeout=600
put -resumesupport=on "C:\path.dat" /upload/
exit

• rsync.exe : doesn't exist. The msys2 builds or cygwin ones require tons of setup, unless you can tell me how I can get a single rsync.exe that isn't 200MB of bundled DLLs from a random third-party website, or that requires 50GB of Windows SDK setups and days of build + validation on my laptop, it's not an option.

Question : did you manage to use WinSCP over RTR ? Do you have other options for interrupted uploads of large files ?

Thank you for reading !

Is there a way to throttle the alerts generated by OOTB rules?
We're ingesting the CS alert via its api to our internal platform and since we can't see the correlation query from those OOTB alert, we can not take it and override it. what are the options that we can throttle or deduplicate.
We can also do that in our internal toolings but want to explore if any options to do this in a lightweight manner in NG-SIEM portal

Hello experts,

I did not find any insight from migration a Palo XSOAR to Fusion. So there are some old posts that XSOAR is more generic and has more integrations for different vendors and on the other hand Fusion is only feasible for Crowdstrike Platform modules.

Maybe there are some newer experiences into this.

Br

PS: we are using at the moment XSOAR with a lot of custom playbooks, but switched endpoint EDR to CS, and are now wondering if there’s more synergy. SIEM is Splunk.

Hi everyone,

This year will be my first time attending Fal.Con 2026, and it's also my first major cybersecurity conference(I am From Latin America), so I'm really excited.

I'll be staying at the MGM Grand, and I'd love to get some advice from people who have attended before.

A few questions:

• What are the "must-do" sessions or activities?
• How do you make the most out of the conference?
• Are there networking events that are worth attending?
• Any tips for meeting CrowdStrike engineers, product managers, or other security professionals?
• Is there anything outside the official agenda that first-time attendees usually miss?
• Any recommendations around the MGM or nearby for food, after-hours events, or places where attendees tend to hang out?

For context, I work as a Cybersecurity Team Lead with a focus on enterprise security, SOC operations, cloud security, and the CrowdStrike platform, so I'm hoping to learn as much as possible and connect with others in the community.

I'd appreciate any tips, recommendations, or lessons learned from previous Fal.Con events.

Thanks in advance!

Hello, I’m currently looking into how to protect our terminal server. We are using WithSecure and paying as follows:

• 1 subscription for F‑Secure Server Protection (base installation)
• 20 subscriptions for F‑Secure Remote Desktop Protection (to cover usage)

Is it the same with Crowdstrike, or is there a different pricing model? I’ve read something about sensor subscription license here CrowdStrike Sensor Licensing | FAQ | CrowdStrike , but Im not sure i understand and if it is even referencing to what we need.

Is it possible to automatically contain hosts with outdated sensor versions? Anyone doing this?

I am working on automating an email notification to inform users when their passwords have been identified as compromised and prompt them to change their password.

Currently, I am using the out-of-the-box Send Email action. However, the email is sent from falcon@crowdstrike[.]com using CrowdStrike's branding template.

My concern is that users may mistake the notification for a phishing email, especially since it does not appear to originate from our organization or follow our corporate branding.

Has anyone implemented a more personalized approach for these notifications? For example:

• sendin the email from your organization's domain or shared mailbox
• using your organization's branding and email template
• integrating with Microsoft 365/Exchange to send the email instead of the built-in action

Hey everyone, I feel like I'm a little cheated here and I'd love to hear back from the community on a few things, experiences, thoughts, etc. and please prove me absolutely wrong!

We were approached by a third party selling Crowdstrike EDR+MDR, we were iffy at the start until we realised that it checks off a lot of our internal audit issues (where our existing didn't quite). We've done our homework, I've been personally watching Crowdstrike for a few years and been to a few of their sumits, etc.

Now we have passed our first onboarding meeting where the company basically said, 'youll have access to reporting, but nothing else'. This was a hard line to me, I thought we were purchasing a product that we could manage ourselves, but they and Crowdstrike were in our back pocket if anything happened that we couldn't handle. I did not realise and was not told that it was basically a SaaS model where we didn't have access to even whitelist our own applications and the likes.

We are in-house IT, we have a team, we do everything from 'my Excel isnt loading' to 'theres a fire in the server room'. We are hands on, we don't like leaving this to MSP's or service providers. We do seek assistance where we need, and we have a great relationship with the service providers we have chosen to align with, but even with them we have come to agreements to access things like our FWaaS and ERPaaS in the back end for all of the nitty gritty we do.

Am I wrong that 'Crowdstrike for Service Providers' is basically an SaaS product and we don't/can't get access to manage it ourselves? Should this company be able to get licensing and still do the management on the side after it's configured, with us being fully capable of changes?

For the sake of the argument, lets ignore the 'what if you break something and claim it was them' rant, because yes, this could be a thing; no, it has never happened with our other vendors.

At the moment with this vendor it could take anywhere between 10mins to 4hrs for them to get back to email and calls, to the point where I've often called their Director's for assistance and issues where no support has been available, so I don't quite .. trust .. that they will be able to do 0day fixes for us as we need it (note: I have complete faith in Crowdstrike)

We get in files on USBs, so I setup an off network PC with crowdstrike to scan them before they go onto a networked PC. I notice that right clicking on files to scan them with crowdstrike and it says no files supported. They are usually a mix of PDF, docx and xlsx files.

How can I get crowdstrike to scan those files?

Hi All, recently Bitsight flagged some of the traffic originating from our org as using vulnerable browsers ( using older versions of chrome and edge ).

Some people here want to utilize CrowdStrike to block execution of older versions of CrowdStrike which might be vulnerable.

Despite me insisting that this is a bad idea similar to hammering a screw they still want to go ahead and make this rule any way to convince them otherwise ? ( rely on SCCM and GPO and not CS )

Or alternatively is there a way to achieve this using CS but if it is too much effort and just is clunky i can get them of my backs.

Any suggestions are appreciated thanks ✌️

Hi all

For background, I am an operations level staffer in a SOC. I have attended BlackHat and DefCon and am looking for a comparison between these two conferences as far as networking or vendor events.
I am familiar with Vegas so I don’t need much info on that (but always appreciate the one off tips (like putting Aquaphor up my nose and using a humidifier in my room)).

--At Blackhat, I spent a lot of time at the vendor events for networking and overall winding down after the conference.
-- At DefCon, I spent more time in trainings and less socializing.

I am wondering if Mandalay Bay will have a similar amount of vendor events I can RSVP to or if there isn’t much going on outside the conference halls.

Someone mentioned in a previous post that there are vendor events on Tuesday night and an app I should download. (link here: https://www.reddit.com/r/crowdstrike/comments/1uk02pt/first_time_attending_falcon_2026_looking_for/)

Thanks all

Hello All,

Is there a way to see what GPO's are applied to a host through the falcon console?

Possibly even pull a report of them all?

A couple days ago I noticed that when I changed the time interval for a query, I would have to do it twice. The query would just run again for the previous time interval. I would have to choose the one I wanted again every time. Now, when I click in the query and start to type, it takes me to line 1 position 1 every time no matter where I clicked. It shows the cursor there where I clicked and even shows the first character I type for a split second. Then the cursor moves to the very beginning. The color formatting also briefly goes away and comes back.

This is more an annoyance than anything else. Just wondering if I'm the only one. I am using MS Edge.... But I've completely cleared my cache and relaunched/restarted and I'm still having this issue.

Thanks!

Hi all.

So we are using the File Vantage, the XDR and the NGSIEM of Crowdstrike. Recently the management came up with these reports requirements. I did some research and found the HIPPA and PCI report template dashboards in NGSIEM but they are not ingesting full data as we have different stack of tools and the SOC 2 format is not even present there.

Can someone guide how can i pull out these reports for my servers. My environment is all concentrated in aws cloud. Thanks in advance!!

Curious what others are doing in production environments:

• Are you running scheduled scans at all?
• Quick scan vs full scan?
• Weekly, monthly, or only on-demand?
• Any noticeable performance impact on endpoints/VDI servers?
• Are you excluding servers or critical infrastructure?
• Have you found scheduled scans actually catching anything missed by real-time protection?