Security researchers at SEC Consult have discovered a significant vulnerability in CrowdStrike’s Falcon Sensor that allowed attackers to bypass detection mechanisms and execute malicious applications. The researchers at SEC Consult found that after an attacker gained NT AUTHORITY\SYSTEM permissions on a Windows machine, they could use Process Explorer to suspend CrowdStrike Falcon Sensor processes. When researcher resumed the suspended processes, CrowdStrike would immediately quarantine and remove the malicious tools, confirming that the suspension was indeed bypassing normal detection protocols. In their proof of concept, SEC Consult demonstrated how tools like winPEAS, Rubeus, and Certipy—typically blocked by CrowdStrike—could run unimpeded when the sensor processes were suspended. Process Explorer allowed for the suspension of these critical security processes without any resistance. When the Falcon Sensor processes were suspended, malicious applications that would normally be terminated or removed could execute freely and remain on the disk. While killing these processes was prohibited by the system, suspending them was surprisingly allowed, creating a significant security loophole. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The bypass technique involved suspending the EDR processes rather than attempting to terminate them, effectively creating a window of opportunity for malicious actors to operate undetected. However, by 2025, CrowdStrike silently implemented fixes that prevent process suspension, effectively acknowledging the security implications that they had previously dismissed. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Processes that were already hooked at the time of sensor suspension remained supervised by CrowdStrike’s kernel processes. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 06 Mar 2025 14:25:17 +0000