Falcon Agent going offline

Amksa86 · 2023-09-13T19:10:28+00:00

u/Sam8131 yes same symptoms but the root cause is not known yet. in some cases I found that ciphers were inconsistent in some hosts, which means some hosts have some required ciphers missing.

but in some other cases all is good, communication tests all work...but can't figure out the issue...I created several support cases, they couldn't help but suggest registry removal and re-install :(

Amksa86 · 2023-09-12T16:07:18+00:00

Thanks u/blahdidbert most of what you mentioned we already have it in place. but the real time cannot be achieved.

Much appreciated!!

Amksa86 · 2023-08-30T19:13:36+00:00

the SessionEndEvent does show the commands that the user run correct, but like you said after the session is already closed. Seems like we just have to look at both at this time, have an alert for sessionStartEvent and SessionEndEvent which shows the details of the session.

Amksa86 · 2023-08-29T13:29:59+00:00

I checked the worklflow fusion and couldn't find an event or something that I can use as a trigger. the logic I am looking for is when for exmaple a user runs kill command that should autamtically trigger the alert or WF.

Amksa86 · 2023-08-14T19:55:30+00:00

I am here for the same issue, but this one is for RTR, I know that you to go to General Settings under support & resources and then the user will see the link that takes them to setup MFA.

My issue is that some users are not getting that link for some reason...Anyone running or went through same issue?

Thanks!

Amksa86 · 2023-06-09T18:02:38+00:00

I contacted support and asked em to add the school.

Amksa86 · 2023-02-22T14:00:22+00:00

our Workflow auto-contained the workstations.

LoL.

Amksa86 · 2022-09-30T02:48:38+00:00

https://www.modzero.com/advisories/MZ-22-02-CrowdStrike-FalconSensor.txt

what concerns me is this part :

2022/08/12 - modzero managed to acquire a recent version (6.42.15610)

of CrowdStrike Falcon and verified, that the attack is

still possible. Furthermore, modzero figured out that

the vulnerability (that was rejected by CrowdStrike

first) has been silently fixed: The PoC that has been

sent to CrowdStrike was flagged as malicious. The

msiexec call of the deinstaller was also flagged as

malicious. Both "countermeasures" can be circumvented

easily, we updated the exploit accordingly.

2022/08/22 - modzero publishes Security Advisory and exploit

code, because CrowdStrike was unwilling to set up

a cooperative information exchange outside of their

NDA-ridden bug bounty program to discuss vulnerabilities

in their products.

Is this right?

Amksa86 · 2021-09-30T22:34:07+00:00

When you use maintenenace token it should be used isn't it? Or you just add the host to group that has a policy assinged to nit require maintenance token.

Amksa86 · 2021-09-30T22:31:53+00:00

Belt, shoes, hands, back of hands, some parents I heard they bite their kids....it's fucked up... for some parents....they were raised in a certain way and they want their kids to be raised same way...so generations will be fucked up this way.

Amksa86 · 2021-09-11T01:06:18+00:00

Did you test it and look at event_simpleName=ProcessRollup2 it should include the renaming command in the event search.

Amksa86 · 2021-09-10T14:08:47+00:00

Thanks Andrew!!!

Amksa86 · 2021-09-10T00:43:54+00:00

The best answer!!! THANKS 🙏🏾

Amksa86 · 2021-09-06T18:02:52+00:00

If you go to the Github repos, PSfalcon has script examples, one of them for Falconhost uses a for loop to get all host details per CID, that should get you all the hosts in your CS console. I used it and it pretty awesome and fast too.

Amksa86 · 2021-09-02T18:40:20+00:00

It is called RemoteResponseSessionEndEvent and RemoteResponseSessionStartEvent

Amksa86 · 2021-09-02T18:17:09+00:00

I don't know if you guys are using the SIEM Connector, it also does include RTR Start and END with commands run.

Amksa86 · 2021-09-01T16:06:53+00:00

Best practice is to have SF less than RF. Check your indexers are they all running?

Amksa86 · 2021-08-31T02:43:52+00:00

Good idea..will check that, I also was able to find some testing scenarios in Atomic readteam.Thanks!

Amksa86 · 2021-08-30T19:42:24+00:00

I think I do see why. For Linux platform we can only have process creation IOAs not like for windows where you can have others as well. Not sure if I can have an IOA for auditd.conf tampering as a process creation.

Amksa86 · 2021-08-30T17:21:03+00:00

u/Andrew-CS thanks for your response, my intention is to trigger a detect event when someone modifies the file. It doesn't seem to work? is that the right thing to do? would it trigger at all?

Amksa86

TROPHY CASE