Remote tasklist and CrowdStrike Falcon folder listing for sensor coverage discovery
Detects security software discovery behavior by identifying tasklist execution combined with directory listings of the CrowdStrike sensor folder on the same device within a short window, which can serve as a coverage check for hosts lacking the Falcon sensor.
Microsoft Sentinel (KQL)
