Skip to content
Threat Feed

Product

CrowdStrike Falcon Agent

1 brief RSS
medium advisory

Detection of Suspicious CrowdStrike Agent Registry Key Removal

This detection identifies delete events on CrowdStrike registry keys, which typically occur during agent uninstallation, so any unplanned or unexpected removal of these keys should be investigated for malicious activity such as defense evasion or exploits like CVE-2022-44721.

CrowdStrike Falcon Agent defense-evasion registry-modification endpoint
2r 1t 1c