What is CrowdStrike?
CrowdStrike is a cybersecurity company known for its Falcon endpoint protection platform. Material about it tracks how its endpoint agent and the telemetry it generates figure into both defensive analysis and attacker tradecraft.
Release history
- May 2026 - Analysts described pulling telemetry from CrowdStrike and other endpoint agents running on a device to identify vendor presence without querying users directly.
- Sep 2026 - A host noted a tool was documented in April 2026 being used to disable CrowdStrike during an attack.
- Sep 2026 - The same host said the tool’s pairing with a ransomware family appeared to be a first.
In the discourse
Attributed discussion of CrowdStrike.
PoisonX, a Microsoft-signed driver that appears purpose-built for malicious use, has expanded from disabling CrowdStrike to enabling ransomware deployment, making it a growing BYOVD threat to watch.
“I this is this I believe is the first time we've seen it used alongside a ransomware family as well.”CyberWire Daily Host · 12 Sep 2026
PoisonX was first documented in April 2026, initially used to disable CrowdStrike, and has since been paired with the Godamn/Beast ransomware family for the first time.
“I think it was first seen earlier on this year where it was used in about April it was documented first and that's in that case it was used to disable crowd strike in an attack.”CyberWire Daily Host · 12 Sep 2026
AI can replace manual software inventory spreadsheets by ingesting device telemetry from endpoint agents like CrowdStrike and automatically surfacing all third-party software in the environment.
“They just look into telemetry from the device. Let's say they take like CrowdStrike telemetry, they take any other agent kind of running on your computer telemetry and then they analyze it and they're like, 'Oh, I found this 75 vendor here.' So you don't even need to like you know, like ask someone go over the spreadsheet and inventory all the software.”<UNKNOWN> · 27 May 2026
A real-world AI deployment was able to identify 75 vendors automatically by analyzing endpoint telemetry, without any manual spreadsheet review.
“They just look into telemetry from the device. Let's say they take like CrowdStrike telemetry, they take any other agent kind of running on your computer telemetry and then they analyze it and they're like, 'Oh, I found this 75 vendor here.'”<UNKNOWN> · 27 May 2026