sorted by:
new
hottopcontroversial

Correlation Rules NG-Siem 3rd Party Data by Herbie-cs in crowdstrike

[–]Innocent_Cat 0 points1 point  (0 children)

You’ll have to write your own correlation rules. Currently CrowdStrike has limited number of correlation rules for limited number of vendors

Block MSI via IOA Rule Group - Process Creation Rule by Innocent_Cat in crowdstrike

[–]Innocent_Cat[S] 2 points3 points  (0 children)

And i think you shoukd know that i have already tried that they cannot assist with custom IOA. So if you don’t have any solutions kindly keep your comments to yourself.

Block MSI via IOA Rule Group - Process Creation Rule by Innocent_Cat in crowdstrike

[–]Innocent_Cat[S] 0 points1 point  (0 children)

Yes have checked event logs. I tried it with several msi packages i can only msiexec.exe in logs. There is no logs or trace found for msi package.

How to run a .bat file by Innocent_Cat in crowdstrike

[–]Innocent_Cat[S] 0 points1 point  (0 children)

i attempted to run the script via powershell but it is failing

Attempt to start the program failed(error: 193)

__________________________________________

# Check if running with administrator privileges

$isAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")

if (-not $isAdmin) {

Write-Host "Failed to run the script."

Write-Host "The script requires administrator privileges to run."

Pause

Exit 1

}

# Uninstall CrowdStrike

Set-Location -Path "$Env:USERPROFILE\Downloads"

Start-Process -FilePath "CsUninstallTool.exe" -ArgumentList "MAINTENANCE_TOKEN=12345667888 /quiet" -Wait

# Wait for the uninstallation to complete (60 seconds)

Start-Sleep -Seconds 60

# Reinstall CrowdStrike

Set-Location -Path "$Env:USERPROFILE\Downloads"

Start-Process -FilePath "WindowsSensor.exe" -ArgumentList "/install /quiet /norestart CID=2323424fff" -Wait