All news with #crowdstrike falcon tag

🔒 CrowdStrike highlights how attackers increasingly weaponize trusted software—RMM tools, built-in Windows utilities, and admin binaries—to evade detection and operate within networks. The Falcon platform layers behavioral IOAs, custom controls, and Exposure Management and now adds APEX, a machine-learning model that analyzes command-line syntax, parameters, process lineage, timing, and context to detect LOLbin abuse. APEX is generally available for Windows and aims to raise detection while reducing false positives.

🔍 CrowdStrike Falcon Next‑Gen SIEM has been named a Visionary in the 2025 Gartner Magic Quadrant for Security Information and Event Management. The product is presented as an agentic SOC engine that combines AI-driven detections, real-time telemetry and a unified data foundation to accelerate detection and response. CrowdStrike cites metrics including 150x faster search, over 1PB/day ingestion and up to 80% cost savings, and highlights the acquisition of Onum to improve real-time pipelines and scale. New AI agents for workflow, data transformation, search analysis and correlation rule generation aim to simplify playbook creation, data prep and detection tuning.

🔒 CrowdStrike’s Fall 2025 release introduces the Falcon agentic security platform, redefining SOC operations by pairing analysts with AI agents that reason, act, and continuously learn. The release centers on the Enterprise Graph data layer and Charlotte AI AgentWorks for no-code agent creation, plus seven mission-ready agents and Threat AI for autonomous hunting and response. It also expands identity, data protection, patching, and MDR capabilities, integrates Pangea and Onum, and launches AI Detection and Response (AIDR) to secure AI workflows.

🔍 CrowdStrike has launched the Correlation Rule Template Discovery dashboard in Falcon Next-Gen SIEM to help SOC teams discover and operationalize high-value detection content more quickly. The centralized dashboard maps templates to onboarded telemetry, offers precision search and filtering by data source and MITRE ATT&CK tactics, and exposes quick actions to test and deploy templates as active correlation rules. It highlights new and updated templates, provides compatibility analysis, and surfaces curated research and enablement guidance to accelerate detection and reduce noise.

🔒 Falcon for IT introduces Risk-based Patching to unite security and IT teams within the CrowdStrike Falcon platform. By combining Falcon Exposure Management telemetry, AI-powered patch scheduling, Patch Safety Scores, and sensor intelligence, the feature prioritizes vulnerabilities by real-world exploitability and reduces time to remediation. Ring-based deployments, smart rollout coordination, and pre-deployment safety checks help avoid system-breaking updates while accelerating fixes. Delivered through the existing lightweight Falcon agent, it replaces manual handoffs with a single, unified workflow.

🚀 The CrowdStrike Falcon fall release reframes the platform as an Agentic Security Platform, introducing four core innovations: Enterprise Graph, Charlotte AI AgentWorks, the Agent Collaboration framework (powered by MCP), and an AI-native console. Enterprise Graph unifies telemetry into a real-time, AI-ready data layer to give humans and agents shared context. Charlotte AI AgentWorks delivers a no-code environment to design, test, deploy, and govern mission-specific security agents at scale, while MCP enables secure, orchestrated multi-agent collaboration.

🔒 CrowdStrike explains how widespread AI adoption expands the enterprise attack surface, exposing models, data pipelines, APIs, and autonomous agents to new adversary techniques. The post argues that legacy controls and fragmented tooling are insufficient and advocates for real-time, full‑stack protections. The Falcon platform is presented as a unified solution offering telemetry, lifecycle protection, GenAI-aware data loss prevention, and agent governance to detect, prevent, and remediate AI-related threats.

🔒 Since late 2024 CrowdStrike's Counter Adversary Operations has tracked MURKY PANDA, a China‑nexus actor targeting government, technology, academic, legal and professional services in North America. The group exploits internet‑facing appliances, rapidly weaponizes n‑day and zero‑day flaws, and deploys web shells (including Neo‑reGeorg) and the Golang RAT CloudedHope. CrowdStrike recommends auditing Entra ID service principals and activity, enabling Microsoft Graph logging, hunting for anomalous service principal sign‑ins, prioritizing patching of cloud and edge devices, and leveraging Falcon detection and SIEM capabilities.

🔒 Between June and August 2025, the CrowdStrike Falcon platform blocked a widespread malware campaign that attempted to compromise more than 300 customer environments. The campaign, operated by COOKIE SPIDER and renting the SHAMOS stealer (an AMOS variant), used malvertising and malicious one-line install commands to bypass Gatekeeper and drop a Mach-O executable. Falcon detections—machine learning, IOA behavior rules and threat prevention—prevented SHAMOS at download, execution and exfiltration stages. CrowdStrike published hunting queries, mitigation guidance and IOCs including domains, a spoofed GitHub repo and multiple script and Mach-O hashes.

🔒 CrowdStrike announced Falcon Next-Gen Identity Security, a unified solution to protect human, non-human, and AI agent identities across on-premises, cloud, and SaaS environments. It consolidates initial access prevention, modern secure privileged access, identity threat detection and response (ITDR), SaaS identity security, and agentic identity protection into a single sensor and management console. Delivered via the AI-native Falcon platform, the offering provides real-time visibility, dynamic access enforcement, and autonomous response to reduce identity-driven breaches and simplify hybrid identity security.

🔒 Falcon Next-Gen SIEM provides real-time, cross-domain detection to help organizations detect and respond to the identity-centric eCrime group SCATTERED SPIDER. The platform correlates identity, cloud, SaaS, network and email telemetry, offering out-of-the-box rule templates for phishing, MFA fatigue, suspicious SSO events and exfiltration. CrowdStrike recommends comprehensive log ingestion and tuning of these templates to improve detection and response across the full attack lifecycle.

🔒 CrowdStrike has been named the only Leader and Outperformer in the 2025 GigaOm Radar for SaaS Security Posture Management (SSPM). The recognition highlights the CrowdStrike Falcon platform's unified, AI-native approach—combining Falcon Shield, identity protection and cloud security—to detect and remediate misconfigurations, identity threats, and unauthorized SaaS access. Falcon Shield's extensive integrations, automated policy responses via Falcon Fusion SOAR, and GenAI-focused controls underpin its market-leading posture and support continuous visibility across human and non-human identities.