CrowdStrike

CrowdStrike

Install

Windows Install

WindowsSensor.exe /install /quiet /norestart CID=<your CID>

Linux Install

dpkg -i falcon-sensor_6.53.0-15003_amd64.deb
/opt/CrowdStrike/falconctl -s -f --cid="XXXX" 
/opt/CrowdStrike/falconctl -s --trace=warn
systemctl enable falcon-sensor
systemctl restart falcon-sensor

Check Version

Windows Check Version

Check Version: [1]

wmic path win32_product where (caption like '%crowdstrike sensor%') get version

Note: This take a few minutes to process

Examples

Installed:

C:\>wmic path win32_product where (caption like '%crowdstrike sensor%') get version
Version
5.36.11809.0

Not installed:

C:\>wmic path win32_product where (caption like '%crowdstrike sensor%') get version
No Instance(s) Available.

Linux Check Version

/opt/CrowdStrike/falconctl -g --version
version = 7.10.16303.0

Check File System Service

Check sensor is running:

sc query csagent

C:\>sc query csagent

SERVICE_NAME: csagent
        TYPE               : 2  FILE_SYSTEM_DRIVER
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

Note: This is a different service than what is in service manager

Linux

Dependency:

apt install libnl-3-200

cd /opt
dpkg -i falcon-sensor_6.53.0-15003_amd64.deb
# /opt/CrowdStrike/falconctl -s --cid="XXXX" 
# Note: need -f with the --cid, example:
#   "CID is set, but -f was not specified"
/opt/CrowdStrike/falconctl -s -f --cid="XXXX" 
/opt/CrowdStrike/falconctl -s --trace=warn
systemctl enable falcon-sensor
systemctl restart falcon-sensor

/opt/CrowdStrike/falconctl -s --trace=info

systemctl status falcon-sensor
/opt/CrowdStrike/falconctl -g --cid
/opt/CrowdStrike/falconctl -g --trace
service falcon-sensor status
service falcon-sensor restart
ps aux | grep sensor
ps aux | grep falcon

How to Install the CrowdStrike Falcon Sensor for Linux
https://www.crowdstrike.com/blog/tech-center/install-falcon-sensor-for-linux/

Pi Not Supported

Raspberry Pi is not supported

root@pitest:~# dpkg -i falcon-sensor_6.53.0-15003_amd64.deb
dpkg: error processing archive falcon-sensor_6.53.0-15003_amd64.deb (--install):
 package architecture (amd64) does not match system (armhf)
Errors were encountered while processing:
 falcon-sensor_6.53.0-15003_amd64.deb

root@pitest:~# uname -a
Linux pitest 5.15.74-v7l+ #1595 SMP Wed Oct 26 11:05:08 BST 2022 armv7l GNU/Linux

Installation Path

Windows Install Path

CS is installed in:

C:\Windows\System32\drivers\CrowdStrike

ref: [2]

Linux Install Path

/opt/CrowdStrike/

Uninstall

In order to uninstall current versions of CrowdStrike, you will need to obtain a maintenance token, which is unique to each system. To obtain this token, email YOUR IT ADMIN stating that you need a maintenance token to uninstall CrowdStrike. You will also need to provide your unique agent ID as described below. The Security Team may be able to find your host by a combination of hostname, IP address and/or MAC address.

You can retrieve the host's device ID or AID (agent ID) locally by running the following commands at a Command Prompt/Terminal.

Windows: reg query HKLM\System\CurrentControlSet\services\CSAgent\Sim\ /f AG

Mac sensor version 6.x: sudo /Applications/Falcon.app/Contents/Resources/falconctl stats | grep agentID

Once the Security Team provides this maintenance token, you may proceed with the below instructions.

Windows

• Go to the Control Panels, select Uninstall a Program, and select CrowdStrike Falcon Sensor

Mac OS

• This depends on the version of the sensor you are running. You can check using the sysctl cs command mentioned above, but unless you are still using Yosemite you should be on 6.x at this point. Note for those unfamiliar with sudo that you will be prompted for a password, which is the password for the account you are logged in as, to allow the command to run with elevated privilege. The Falcon Agent will also require Full Disk access for the uninstall. On macOS 13 and above, Terminal will need to be added to App Management.
  • Sensor version 6.x and above, navigate to the Terminal command line and type:

sudo /Applications/Falcon.app/Contents/Resources/falconctl uninstall --maintenance-token

• • Enter token-from-security-team when prompted
  • You can also unload/load the sensor if you think you are having problems:

sudo /Applications/Falcon.app/Contents/Resources/falconctl load sudo /Applications/Falcon.app/Contents/Resources/falconctl unload --maintenance-token

• • Enter token-from-security-team when prompted

Linux sudo service falcon-sensor stop

• Remove the package using the appropriate rpm or deb package command. The package name will be like falcon-sensor-4.18.0-6403.el7.x86_64

ref: [3]