Uninstall Crowdstrike Falcon Sensor
This rule detects attempts to uninstall the Crowdstrike Falcon sensor by monitoring process creation events for specific command-line arguments. It looks for the execution of 'WindowsSensor.exe' with the '/uninstall' and '/quiet' flags, which are indicative of a silent uninstallation process. Adversaries often disable security tools like EDRs to evade detection of their malicious activities.
Sigma
