5

I have an CrowdStrike EDR and it seems like the only way to disable this on all OS is to provide maintenance-token or ask CrowdStrike to disable the defences so you can uninstall it. I also have a Carbon Black laptop and this seems to be the case in that you cannot disable it even when loading Services through an administrator prompt. This is similar with many EDRs out there and the question also applies with any software you install.

As an example, I have a macOS in the admin group, but I am not able to unload this service with sudo, how is this possible? What kind of security mechanism is preventing me this even as local administrator. Are there mechanism in that I need to be the root user or SYSTEM user for Windows to allow unloading and removal of EDRs? If we need to provide a token, this sounds like a way to install an unremovable rootkit unless you were to reformat.

1
  • 1
    At least for Windows, there will be a driver responsible for implementing the endpoint defense/tamper protection feature. It is likely doing other things also. Chances are high that if you boot into safe mode, it will not be loaded. From there you could disable it for the next boot once you have identified it. If you look in \windows\system32\drivers\ I'm sure you will find one or many drivers from the vendor, the details might give it away. It is most likely to be a file system filter I would think, so would probably show up by running fltmc.exe. Sep 20, 2020 at 20:24

2 Answers 2

4

As previously mentioned most EDRs have use kernel-level hooks.

This text is from CrowdStrike's patent "Anomaly-based malicious-behavior detection"

In some examples, the kernel-level security agent can operate on computing device 104 as a virtual machine/shadow operating system. The kernel-level security agent loads before the operating system of the host computing device, e.g., very early in the boot-time of the host computing device, by some of the first few dozen instructions in some examples. Pre-boot components of detection module 226 can leverage hardware-provided security features, e.g., firmware signing, although this is not required. By loading early in boot-time, the kernel-level security agent significantly reduces the window in which malware can become active and interfere with operation of the host computing device or run unobserved on the host computing device. In some embodiments, by leveraging hardware-based security features, the agent can also validate the integrity of its computing operations and data and additionally enhance the level of security provided.

In order for an authorized user to bypasses this protection they need a one-time maintenance-token which is provided by CrowdStrike.

Carbon Black does not have a maintenance-token. They highly recommend uninstalling or disabling sensors using Carbon Black EDR console.

They do provide a path to uninstall the sensor without using the console. Here is the details on doing this on macOS:

Uninstalling Sensors on macOS

To manually uninstall macOS sensors:

On the macOS endpoint where the sensor is installed, run the following command: /Applications/CarbonBlack/sensoruninst.sh

After this process is complete, the endpoint stops reporting events and binaries to the Carbon Black EDR server and all the caching information for logs is deleted.

3
+25

Most EDRs (worth their salt) implement a driver which runs in the kernel, this driver performs a number of functions but one of the most notable functions can be categorised as "anti-tamper".

Anti tamper prevents things such as unloading, hooking, debugging, modification and in some cases exploitation. This is designed because:

  • If someone compromises your machine, the EDR solution can still run and assist.

  • It prevents the EDR itself from being compromised.

As suggested in the comments try booting in safe mode and checking if the driver for the EDR is loaded.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.