{"success":true,"data":{"id":"crowdstrike-falcon-impersonation","label":"Fake CrowdStrike Falcon sensor update / channel-file remediation / EDR incident alert from non-crowdstrike.com sender","description":"Fake CrowdStrike Falcon sensor update, channel-file remediation, or EDR incident alert from a non-crowdstrike.com sender. Following the July 2024 global CrowdStrike outage (8.5M Windows systems affected, $5.4B estimated damages), threat actors began mass-exploiting CrowdStrike brand trust — security teams who spent days responding to the outage are conditioned to immediately act on Falcon-related emails. Attackers send fake \"Your Falcon sensor is out of date — update required to maintain EDR coverage\" or \"CrowdStrike Falcon: active threat detected — re-authenticate to the Falcon console\" emails. Post-outage lures specifically reference \"channel file remediation\" or \"Falcon sensor content update\" to mimic the remediation workflow that affected IT teams had to follow manually. Enterprise security teams are high-value targets: a successfully phished SOC analyst may hand over SSO credentials to the entire security stack. The signal fires when: (1) body references CrowdStrike Falcon brand (crowdstrike, falcon sensor/agent/console/EDR) AND (2) sensor-update or incident-action urgency is present AND (3) sender is NOT crowdstrike.com AND (4) no List-Unsubscribe or In-Reply-To. Source: GC1 R14 council #1; FBI IC3 advisory 2024-CrowdStrike; Mandiant threat-actor TTPs post-outage.","tier":"warning","category":"phishing","isThin":false}}