Disable or Modify Tools × CrowdStrike Falcon Sensor

CrowdStrike Falcon Sensor processes could be suspended by an attacker with SYSTEM privileges, allowing malicious applications to execute undetected.

An attacker with NT AUTHORITY\SYSTEM permissions uses Process Explorer to suspend CrowdStrike Falcon Sensor user-mode processes. Suspension is permitted while termination is blocked, creating a window where malicious applications execute without detection. Kernel components remain active, so some hooked actions (e.g., LSASS dumps) still trigger protection, but many malicious tools run freely.

Monitor for process suspension events targeting CrowdStrike Falcon Sensor processes (e.g., via Sysmon Event ID 5 or Windows Security Event 4688 with Process Explorer). Implement endpoint detection rules to alert on suspension of security product processes. Ensure Falcon Sensor is updated to the latest version that prevents suspension.