CrowdStrike Falcon’s hidden surveillance: six kernel hooks, firewall‑grade network control
A deep reverse‑engineering teardown maps csagent.sys’s six kernel callbacks—process, thread, image, object, registry, and file—plus a WFP network engine that can inject TCP resets to kill C2. The reveal shows exactly how Falcon monitors endpoints and where attackers might slip past its detection.