CSAgent.sys

CrowdStrike Falcon Sensor Driver file version info

Driver on Windows LOLDrivers malicious

A known malicious driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entrieshttps://www.loldrivers.io/drivers/0144dbef-1da8-406c-8e35-7afee57dc471/
https://www.loldrivers.io/drivers/636d30fd-2b95-4dc2-a413-be0e43d1482c/
https://www.loldrivers.io/drivers/6c84d133-c619-4deb-a91a-5cf05e4cb7c2/

7 known samples

6.34.14806.0 · its entry

06eccd102c9105957773b32538943531d9c39d0a504ceb3b9b155e97e3b0b134

6.34.14806.0 · its entry

1e42c8cb410a7ed653cfe62bbd8cf191f31a47337fe1ffcc35232d03f2da05ef

6.34.14806.0 · its entry

6a2a0f9c56ee9bf7b62e1d4e1929d13046cd78a93d8c607fe4728cc5b1e8d050

6.34.14806.0 · its entry

94b87b1cdaf1d86c2bc4eacef45608d0f16fdd3b981b88cdddc16b6bc64fe25d

6.34.14806.0 · its entry

b2ff9ef50ae037bb003d7157ea8da008a48f715a78c644b5f027b070bf5eb049

6.34.14806.0 · its entry

b7703a59c39a0d2f7ef6422945aaeaaf061431af0533557246397551b8eed505

6.34.14806.0 · its entry

efb642ad3fab4a2e6cb4de829b60e04dd0d9ae7c2b4cf544de28c38f978b4136

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real CSAgent.sys?

file version info and known copies

ProductCrowdStrike Falcon Sensor, CrowdStrike, Inc.

DescriptionCrowdStrike Falcon Sensor Driver

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.