Windows Crashes Due to Crowdstrike Updates

Windows Crashes Due to Crowdstrike Updates

Date of Publish : July 20,2024

Severity-Critical

System Affected

• Windows hosts

Non Affected systems

• MacOS
• Linux system

Summary

Crowdstrike released an update that is causing widespread "blue screens of death" (BSOD) on Windows systems.

Description,

This situation occur may be by sending a phishing emails circulating claiming come from "Crowdstrike Support" or "Crowdstrike Security" to update the component. One domain possibly associated with these phishing attacks is : crowdfalcon-immed-update [ .] com .once copned and download it will cause BSOD attack.

Workaround steps for individual hosts:

• Reboot the host to give it an opportunity to download the reverted channel file. We strongly recommend putting the host on a wired network (as opposed to WiFi) prior to rebooting as the host will acquire internet connectivity considerably faster via ethernet.
• If the host crashes again, then:
• Boot Windows into Safe Mode or the Windows Recovery Environment
• NOTE: Putting the host on a wired network (as opposed to WiFi) and using Safe Mode with Networking can help remediation.
• Navigate to the %WINDIR%\System32\drivers\CrowdStrike directory
• Windows Recovery defaults to X:\windows\system32
• Navigate to the appropriate partition first (default is C:\), and navigate to the crowdstrike directory:
• C:
• cd windows\system32\drivers\crowdstrike
• Note: On WinRE/WinPE, navigate to the Windows\System32\drivers\CrowdStrike directory of the OS volume
• Locate the file matching “C-00000291*.sys” and delete it.
• Do not delete or change any other files or folders
• Cold Boot the host
• Shutdown the host.
• Start host from the off state.

Note: BitLocker-encrypted hosts may require a recovery key

References.

Vendor Reference.

https://www.crowdstrike.com/blog/statement-on-windows-sensor-update/.

NOTE : The information is provide is on “as is “ basis, without assurance of any kind .

Revision history

1. 19-Jun-24 - First advisory released. ---update -workaround available 

Read More

DLP- Data Leakage prevention -Explained

DLP- Data Leakage prevention -Explained

DLP provides cybersecurity solution that detects and prevents data breaches. implements a set of processes, procedures, and tools to prevent the loss, misuse of data from cyber threats.

Type of DLP

•        Network DLP
• Endpoint DLP
• Cloud DLP
• Storage /Data center DLP

 

DLP Tools:

•    Teramind
•     Safetica
•     Code42 Incydr
•     Check Point
•     Trend Micro IDLP
•     Sophos
•     Endpoint Protector
•     Symantec DLP
•     Digital Guardian
•     Trelix
•     Forcepoint DLP
•     Proofpoint DLP
•     Fidelis
•     Clumio
•     Microsoft Purview DLP
•     DTEX inTERCEPT

Network DLP is a Data Loss Prevention solution that monitors risky user behaviour on the network to detect and block potential data exfiltration.

 

·        Data Packet Inspection

·        Protocol Inspection

·        Data Filtering

·        User Activity Monitoring

 

Endpoint DLP: Focuses on securing data at the endpoint– individual devices such as individual employee computers. 

 

• Data Discovery and Classification
• Data Encryption
• Device Control
• User Behaviour Monitoring

Cloud data loss prevention (DLP) helps keep an organization’s sensitive or critical information safe from cyber-attacks, insider threats and accidental  exposure. Cloud DLP provides protection for sensitive data in SaaS and IaaS applications.

·       API Monitoring

·       Data Encryption

·       Cloud access control

·       Shadow IT detection

 

Storage /Data-center DLP- security strategy and focuses on detecting and preventing the loss, leakage, or misuse of data through breaches, exfiltration transmissions, and unauthorized use.

 

·       Data access control

·       Data activity Monitoring

·       Data anonymization

·       Data masking

 

 

NOTE : The information is provide is on “as is “ basis, without assurance of any kind .

 

Read More

Top 10 Cyber Security Tools You Must Know

Top 10 Cyber Security Tools You Must Know

Types of Cyber Security Tools

There are many tools in cyber security based upon specific domains/areas of interest.

• Security Information and Event Management Tools 
• Vulnerability Assessment Tools 
• Digital Forensic Tools 
• Penetration Testing Tools 
• Firewall Tools
• IDS / IPS Tools 
• Privileged Access Management Tools 
• Endpoint Detection and Response Tools 
• Network Detection and Response Tools 
• Email Security Tools 
• Data Loss Prevention Tools 

Top 10 Cyber Security Tools

Here is the cyber security tools list you should now.

• NMAP 
• Wireshark 
• Metasploit 
• Aircrack 
• Hashcat 
• Burpsuite
• Nessus Professional 
• Snort 
• Intruder 
• Kali Linux  

Read More

Resource Monitor for Diagnosing Malware

Window’s Resource Monitor is a hidden gem within the OS that can be very useful to an incident responder in a crunch.    It isn’t as comprehensive as SysInternals Process Monitor but it is built in to Windows so you can use it on a computer with no internet connection.   It lacks the depth of WMIC but it does have a very nice GUI (if you are into that sort of thing).    In short, resource monitor is a worthy addition to the incident responders toolkit.   Resource Monitor isn’t a separate program, but rather it is an operational mode for Performance Monitor (Perfmon.exe).    If you start Performance Monitor with the "/res" option you will see the Resource Monitor interface.    Click START->Run and type “Perfmon.exe /res” and press Enter

It has a series of Tabs across the top (Number 1) for Overview, CPU, Memory, Disk and Network.   Each of the tabs is broken down into sections that can be expanded or collapsed by clicking the arrow on each section's header (Number 2).   The top section on each tab allows you to check a box next to a process names that will apply a filter to the other sections of the tab.   So by checking the box next to “Firefox.exe” you will only see disk, memory and network resources associated with the Firefox process.    The disk section shows you files that are open by the process.   The networking section will show you the fully qualified DNS name for each of the TCP and UDP connections in use by that process.   The memory section gives you a quick look at how much memory is in use by the process.   That’s about it for the Overview tab.   If that didn't tell you everything you wanted you can refer to the CPU, Memory, Disk and Network tabs for more information.   Lets take a look at the CPU tab.

The CPU tab has some nice features. By selecting a process you can see all of the OS Handles in use by the process (number 4).  It even has a search feature that allows you search all of the open handles.  The Modules section (number 5) will show you all of the DLLs that are in use by the process.

I’ll leave the remaining tabs for you to explore on your own.  I think you will find that in a pinch resource monitor is a good way for a first responder to get a first look at what is happening on a computer.  

Performance monitor used Performance counters and Event Tracing for Windows to capture data from various sources.   The "/res" option is one of performance monitors way of displaying that information to you.  If you are curious what other modes Performance Monitor has give “perfmon.exe /report” a try. 

Reference:

http://dshield.org/diary.html?storyid=13735

Read More