FalconFlank Exploit Artifacts (Named Pipe and Dropped DLL)
Detects on-host artifacts of the FalconFlank local privilege escalation exploit against the CrowdStrike Falcon sensor (the FALCONFLANK named pipe, the staged bcrypt.dll under Flanker_<GUID>, and a bcrypt.dll written into the System32 PowerShell directory) and returns the responsible process with user, command line and parent.
#Vendor = "crowdstrike"
| #repo = "base_sensor"
| event_platform = Win
| #event_simpleName = "ProcessRollup2"
| join(
{
#Vendor = "crowdstrike"
| #repo = "base_sensor"
| event_platform = Win
| in(#event_simpleName, values=["NamedPipeDetectInfo", "FileCreateInfo", "NewExecutableWritten"])
| TargetFileName = /\\NamedPipe\\FALCONFLANK$/i
OR TargetFileName = /\\Flanker_\{?[-0-9a-f]+\}?\\WindowsPowerShell\\v1\.0\\bcrypt\.dll$/i
OR TargetFileName = /\\Windows\\System32\\WindowsPowerShell\\v1\.0\\bcrypt\.dll$/i
| case {
#event_simpleName = "NamedPipeDetectInfo" | Indicator := "Named pipe FALCONFLANK";
TargetFileName = /\\System32\\WindowsPowerShell\\/i | Indicator := "bcrypt.dll written to System32 PowerShell directory (escalation succeeded)";
* | Indicator := "Staged document under %TEMP%\\Flanker_<GUID>";
}
| groupBy([aid, ContextProcessId, Indicator, TargetFileName], function=min(@timestamp, as=FirstArtifact))
| groupBy([aid, ContextProcessId], function=[min(FirstArtifact, as=FirstArtifact), collect([Indicator, TargetFileName])])
},
field=[aid, TargetProcessId], key=[aid, ContextProcessId],
include=[FirstArtifact, Indicator, TargetFileName])
| FirstArtifact := formatTime("%Y-%m-%d %H:%M:%S", field=FirstArtifact)
| table([FirstArtifact, aid, ComputerName, UserName, UserSid, ImageFileName, CommandLine, ParentBaseFileName, Indicator, TargetFileName])Background: FalconFlank (public PoC, September 2026) is a local privilege escalation that turns the Falcon sensor's macro remediation into a privileged file write. A standard user stages a Word macro document named bcrypt.dll inside a mirror of the PowerShell directory tree under %TEMP%\Flanker_<GUID>\WindowsPowerShell\v1.0\, freezes it with an oplock, replaces the v1.0 folder with a mount point to the real C:\Windows\System32\WindowsPowerShell\v1.0, and lets Falcon's remediation resolve the path. The file is then overwritten with a proxy DLL via a kernel transaction and loaded as SYSTEM by the stock MareBackup scheduled task. A named pipe called FALCONFLANK hands the SYSTEM console back to the user's session.
What it looks for: three on-host artifacts of that chain, then the process that produced them. Output is one row per process with all of its indicators collected in the Indicator column:
- Named pipe
FALCONFLANK: opened by the exploit at start. The name is fixed and does not change when the exploit binary is renamed. - Staged document: a file named
bcrypt.dllwritten to%TEMP%\Flanker_<GUID>\WindowsPowerShell\v1.0\. This is an OLE document, not a PE, so PE-write events do not fire for it;FileCreateInfodoes. This catches the exploit before the escalation completes. - Final DLL: a
bcrypt.dllwritten toC:\Windows\System32\WindowsPowerShell\v1.0\. This does not occur on a healthy system. Two processes touch this path in a successful run: the Falcon service (SYSTEM) during remediation, and the exploit process during the transacted overwrite. A row attributed to the Falcon service is therefore expected and means the exploit worked, not that the sensor misbehaved. The sensor may or may not record its own write.
How it works: the named pipe surfaces on NamedPipeDetectInfo as TargetFileName = \Device\NamedPipe\FALCONFLANK. File writes are taken from FileCreateInfo (any file) and NewExecutableWritten (PE files). Neither carries the user or command line, so hits are deduplicated per indicator and file, grouped by aid and ContextProcessId, and joined to ProcessRollup2 on TargetProcessId. That adds UserName, UserSid, ImageFileName, CommandLine and ParentBaseFileName. The artifact side sits inside join() because that side is materialised into a table with a row limit; ProcessRollup2 stays the streaming side.
Telemetry needed: Falcon Windows sensor with process, named pipe and file write events in base_sensor (ProcessRollup2, NamedPipeDetectInfo, FileCreateInfo, NewExecutableWritten).
False positives / tuning: none expected. Every row is a confirmed indicator. Indicators 1 or 2 mean the exploit was staged or run on the host; indicator 3 means the escalation likely succeeded and the host needs incident response, including removal of the planted DLL, a check of the Falcon sensor state and a look for a SYSTEM conhost.exe in the user's session.
Notes: the join is inner, so the ProcessRollup2 of the exploit process must fall inside the search window (the artifacts appear within seconds of process start, so any normal window covers it). If you only want the raw artifacts without process context, run the subquery inside join() on its own and replace the two groupBy lines with table([@timestamp, aid, ComputerName, #event_simpleName, Indicator, TargetFileName, ContextBaseFileName]).
Sources: - https://github.com/MSNightmare/FalconFlank - https://www.linkedin.com/pulse/falconflank-crowdstrikes-own-macro-remediation-just-became-k%C3%B6gler-j68ne/
