Inside the Falcon How CrowdStrike Catches You 0xdbgman.github.io/posts/inside...
Inside the Falcon How CrowdStrike Catches You
A full reverse-engineering teardown of the CrowdStrike Falcon sensor: the six kernel callback sources, the WFP network engine, the file-system minifilter, the cspcm4 broker, the user-mode service…
0xdbgman.github.io