Detection Rules - killer_crowdstrike.dll (CrowdStrike Variant)

Overview

This detection guide focuses on CrowdStrike Falcon-specific indicators for the killer_crowdstrike.dll variant. This malware uses identical BYOVD techniques as killer.dll but with a kill list specifically targeting CrowdStrike Falcon processes.

Malware Family: Arsenal-237 BYOVD Defense Evasion Module (CrowdStrike Variant) Severity: CRITICAL (especially for CrowdStrike customers) Variant Relationship: Reconfigured killer.dll with CrowdStrike-specific targeting Attack Chain: lpe.exe -> killer_crowdstrike.dll -> ransomware deployment Last Updated: 2026-01-25

Detection Strategy

Priority 1: CrowdStrike-Specific Detections (CRITICAL for Falcon customers)

Focus on unexpected CrowdStrike process termination as highest-priority indicator.

Priority 2: Generic BYOVD Detections

Leverage all killer.dll detection patterns - same IOCTLs, same drivers, same service lifecycle.

Reference: See killer.dll Detection Rules for complete BYOVD detection coverage.

Table of Contents

1. CrowdStrike-Specific Detections
2. Sigma Detection Rules
3. CrowdStrike Falcon Custom IOAs
4. EDR Hunting Queries
5. SIEM Detection Rules
6. Implementation Guidance

CrowdStrike-Specific Detections

Critical Indicator: CrowdStrike Falcon Process Termination

The PRIMARY indicator for killer_crowdstrike.dll is unexpected termination of CrowdStrike Falcon processes.

Target Processes:

• CSFalconService.exe - CrowdStrike Falcon Service
• csagent.exe - CrowdStrike Falcon Agent
• CSFalconContainer.exe - CrowdStrike Falcon Container

Detection Logic:

IF (CrowdStrike process terminates unexpectedly)
  AND (parent process is non-standard: rundll32.exe, lpe.exe, or unknown)
  AND (service creation event within 60 seconds)
THEN CRITICAL ALERT - Possible killer_crowdstrike.dll execution

Sigma Detection Rules

Rule 1: CrowdStrike Falcon Process Termination

title: Critical - CrowdStrike Falcon Process Termination (killer_crowdstrike.dll)
id: 7aba482e-4b15-44ca-b9e3-c85733066ced
status: experimental
description: Detects unexpected termination of CrowdStrike Falcon processes (killer_crowdstrike.dll behavior)
author: The Hunters Ledger
date: '2026-01-25'
references:
    - killer_crowdstrike.dll analysis report
    - Arsenal-237 malware toolkit investigation
tags:
    - attack.defense-impairment
    - attack.t1685
    - detection.emerging-threats
logsource:
    product: windows
    category: process_termination
detection:
    selection:
        Image|endswith:
            - '\CSFalconService.exe'
            - '\csagent.exe'
            - '\CSFalconContainer.exe'
    filter_legitimate:
        # Exclude legitimate CrowdStrike updates/restarts
        ParentImage|startswith: 'C:\Program Files\CrowdStrike\'
        User: 'SYSTEM'
    condition: selection and not filter_legitimate
falsepositives:
    - Legitimate CrowdStrike Falcon updates or service restarts
    - Administrator manually stopping Falcon service (should be investigated)
level: critical

Rule 2: CrowdStrike Termination + Service Creation Correlation

title: CrowdStrike Termination with Suspicious Service Creation
id: bb877b05-3f32-4437-8365-35cd3b58f35f
status: experimental
description: Detects installation of a new kernel-mode driver service, a rare event on most endpoints and a hallmark of the BYOVD (Bring Your Own Vulnerable Driver) technique Arsenal-237 uses to disable EDR/AV. The original rule intent correlated this signal with a CrowdStrike process termination within 60 seconds; single-event Sigma rules cannot express cross-event correlation, so that narrowing has been dropped — this rule now fires on any kernel-driver service install and should be triaged alongside CrowdStrike Falcon status.
author: The Hunters Ledger
date: '2026-01-25'
logsource:
    product: windows
    service: system
detection:
    selection:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
        ServiceType: 'kernel mode driver'
    condition: selection
falsepositives:
    - Legitimate driver installation (new hardware, security/monitoring software updates)
level: high
tags:
    - attack.privilege-escalation
    - attack.t1068
    - detection.emerging-threats

Rule 3: CrowdStrike Sensor Offline + Driver Loading

title: CrowdStrike Sensor Offline with Vulnerable Driver Loading
id: fddb4e86-c31e-4ccd-86d3-788882ef3d20
status: experimental
description: Detects loading of a known-vulnerable driver from a temporary directory, the BYOVD (Bring Your Own Vulnerable Driver) pattern Arsenal-237 uses to disable EDR/AV kernel hooks. The original rule intent correlated this signal with CrowdStrike Falcon sensor-offline telemetry; that telemetry is sourced from the CrowdStrike Falcon console/API rather than a Windows/Sysmon event log and cannot be expressed in a Sigma rule against Windows logsources, so the correlation has been dropped — this rule now fires on the driver load alone and should be triaged alongside CrowdStrike Falcon sensor health.
author: The Hunters Ledger
date: '2026-01-25'
logsource:
    category: driver_load
    product: windows
detection:
    selection_name:
        ImageLoaded|contains:
            - 'BdApiUtil64.sys'
            - 'ProcExp'
            - '.sys'
    selection_path:
        ImageLoaded|contains: '\Temp\'
    condition: selection_name and selection_path
falsepositives:
    - Legitimate use of Process Explorer (ProcExp) from a temporary directory
level: high
tags:
    - attack.defense-impairment
    - attack.t1685
    - detection.emerging-threats

CrowdStrike Falcon Custom IOAs

Custom IOA 1: Suspicious Service Creation Targeting Falcon

Platform: CrowdStrike Falcon Type: Custom Indicator of Attack (IOA)

Pattern:

process_name:rundll32.exe AND
command_line:*killer* AND
(child_process_api:CreateServiceW OR child_process_api:StartServiceW) AND
service_type:kernel_mode_driver

Severity: CRITICAL Action: Block + Alert + Quarantine

Custom IOA 2: CrowdStrike Process Termination from Unusual Parent

Pattern:

parent_process:rundll32.exe AND
target_process:(CSFalconService.exe OR csagent.exe OR CSFalconContainer.exe) AND
api_call:TerminateProcess

Severity: CRITICAL Action: Block + Alert + Isolate Endpoint

Custom IOA 3: Vulnerable Driver Loading

Pattern:

file_name:(BdApiUtil64.sys OR ProcExpDriver.sys OR PROCEXP152.SYS) AND
file_path:*\\Temp\\* AND
process_name:services.exe

Severity: HIGH Action: Block Driver Load + Alert

EDR Hunting Queries

Microsoft Defender for Endpoint (KQL)

Query 1: Hunt for CrowdStrike Process Termination

// Hunt for unexpected CrowdStrike Falcon process termination
DeviceProcessEvents
| where Timestamp > ago(30d)
| where ProcessVersionInfoOriginalFileName in~ ("CSFalconService.exe", "csagent.exe", "CSFalconContainer.exe")
    or FileName in~ ("CSFalconService.exe", "csagent.exe", "CSFalconContainer.exe")
| where ActionType == "ProcessTerminated"
| where InitiatingProcessFileName !in~ ("CSFalconService.exe", "CrowdStrike.exe", "falcon-sensor.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine,
    InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessFolderPath
| sort by Timestamp desc

Query 2: CrowdStrike Termination + Service Creation Correlation

// Correlate CrowdStrike termination with kernel driver service creation
let FalconTermination =
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where FileName in~ ("CSFalconService.exe", "csagent.exe", "CSFalconContainer.exe")
    | where ActionType == "ProcessTerminated"
    | project TerminationTime=Timestamp, DeviceId, TerminatedProcess=FileName;
let ServiceCreation =
    DeviceRegistryEvents
    | where Timestamp > ago(7d)
    | where RegistryKey has @"\System\CurrentControlSet\Services\"
    | where RegistryValueData has "SERVICE_KERNEL_DRIVER"
    | project ServiceCreationTime=Timestamp, DeviceId, ServiceName=extract(@"Services\\([^\\]+)", 1, RegistryKey);
FalconTermination
| join kind=inner ServiceCreation on DeviceId
| where (ServiceCreationTime - TerminationTime) between (-60s .. 60s)
| project TerminationTime, ServiceCreationTime, DeviceId, TerminatedProcess, ServiceName
| sort by TerminationTime desc

CrowdStrike Falcon (Event Search)

// Hunt for killer_crowdstrike.dll indicators in Falcon
event_simpleName=ProcessRollup2 OR event_simpleName=ServiceInstalled OR event_simpleName=DriverLoad OR event_simpleName=SensorHeartbeat
| search (FileName IN ("CSFalconService.exe", "csagent.exe", "CSFalconContainer.exe") AND ContextProcessId_decimal!="")
   OR (ServiceType="KernelModeDriver" AND ImageFileName="*\\Temp\\*.sys")
   OR DriverFileName IN ("BdApiUtil64.sys", "ProcExpDriver.sys", "PROCEXP152.SYS")
   OR (ParentBaseFileName="lpe.exe" AND FileName="rundll32.exe" AND CommandLine="*killer*")
| table _time, ComputerName, FileName, CommandLine, ServiceName, DriverFileName, event_simpleName
| sort -_time

SIEM Detection Rules

Splunk SPL Queries

Query 1: CrowdStrike Process Termination Detection

index=endpoint sourcetype=process_termination
| search process_name IN ("CSFalconService.exe", "csagent.exe", "CSFalconContainer.exe")
| where NOT (parent_process_path="C:\\Program Files\\CrowdStrike\\*" AND user="NT AUTHORITY\\SYSTEM")
| eval severity=if(match(parent_process_name, "(rundll32|lpe)"), "CRITICAL", "HIGH")
| table _time, host, process_name, parent_process_name, parent_process_path, user, severity
| sort -_time

Query 2: CrowdStrike + Service Creation Correlation

index=windows (sourcetype=WinRegistry OR sourcetype=process_termination)
| transaction host maxspan=60s
| search (process_name IN ("CSFalconService.exe", "csagent.exe", "CSFalconContainer.exe") AND
          registry_path="*\\Services\\*" AND registry_value_data="*SERVICE_KERNEL_DRIVER*")
| table _time, host, process_name, registry_path, registry_value_data, parent_process_name
| sort -_time

Elastic Stack (EQL)

Query 1: CrowdStrike Termination Sequence

sequence by host.id with maxspan=60s
[process where event.action == "termination" and
 process.name in ("CSFalconService.exe", "csagent.exe", "CSFalconContainer.exe")]
[registry where event.action == "modification" and
 registry.path : "*\\System\\CurrentControlSet\\Services\\*" and
 registry.data.strings : "*SERVICE_KERNEL_DRIVER*"]

Implementation Guidance

For CrowdStrike Falcon Customers (PRIORITY 1)

1. Deploy CrowdStrike Custom IOAs (Day 1):
   • Create Custom IOAs for all three patterns above
   • Set action to: Block + Alert + Quarantine
   • Test in pilot group before enterprise deployment
2. Enable Falcon Behavioral Prevention:
   • Ensure “Suspicious Service Creation” prevention is enabled
   • Configure “Vulnerable Driver Loading” prevention (if available)
   • Enable “Unusual Process Termination” alerting
3. Integrate Falcon API with SIEM:
   • Export Falcon sensor offline events to SIEM
   • Correlate with network/system logs for comprehensive detection
   • Create alert for: Falcon sensor offline + service creation within 60 seconds
4. CrowdStrike-Specific Hunting:
   • Query Falcon API for historical process termination events
   • Hunt for csagent.exe/CSFalconService.exe unexpected exits in last 90 days
   • Review sensor offline events for correlation with other suspicious activity

For All Organizations (PRIORITY 2)

1. Deploy Generic BYOVD Detections:
   • Use all detection rules from killer.dll detection guide
   • Same IOCTLs (0x800024B4, 0x8335003C)
   • Same vulnerable drivers (BdApiUtil64.sys, ProcExpDriver.sys)
   • Same service lifecycle patterns
2. Network-Level Blocking:
   • Block Arsenal-237 infrastructure: 109.230.231.37
   • Deploy Suricata/Snort rules for C2 detection
   • Monitor for connections to 109.230.231.37:8888
3. Driver Blocklisting:
   • Implement WDAC deny policy for vulnerable drivers
   • Block BdApiUtil64.sys and ProcExpDriver.sys by hash
   • Deploy via Group Policy to all Windows endpoints

Related Resources

• killer_crowdstrike.dll Main Report
• killer_crowdstrike.dll IOC Feed
• killer.dll Detection Rules (Generic BYOVD patterns)
• killer.dll Main Report (Parent variant)
• MITRE ATT&CK: T1562.001 - Impair Defenses: Disable or Modify Tools
• CrowdStrike Falcon Documentation: Custom IOA Creation

Version: 1.0 Last Updated: 2026-01-25 Next Review: 2026-02-25

END OF DETECTION RULES

License

Detection rules are licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).
Free to use, including commercially, with attribution to The Hunters Ledger.