Comment by tux3

Falcon has a feature called "Real Time Response". The sensor is in contact with a server with which it exchanges events serialized in protobuf.

One of the event you can get from the Crowdstrike server runs an arbitrary shell command.

https://www.crowdstrike.com/tech-hub/endpoint-security/the-p...