CrowdStrike Falcon Exclusion Policy Modification Outside Management Channel

Arnold Chan@slaz

•updated 27 days ago•4•0•2

This rule detects unauthorized attempts to modify CrowdStrike Falcon sensor exclusion registry keys or commands involving DLL loading techniques that may indicate evasion preparation, specifically referencing potential FalconFlank-related activities. It filters out legitimate management activity from known service accounts, SCCM, and the CrowdStrike Falcon agent itself.