Site Search
Security business menu
Security business
HOME
Service
Handling Manufacturer
Examples/reports/
Blog/Glossary
Seminar/
video on demand
Event/Seminar
video on demand

CrowdStrike

CrowdStrike

July 2025 CrowdStrike Update

July 2025 CrowdStrike Update

We are pleased to present the CrowdStrike update information for June 2025.
All of these issues have been posted on our support site, so please check those articles as well.

Registration is required for our support site.

Please click on "CrowdStrike Falcon 'Support Site Viewing Request'" on the following page to request viewing.
https://www.macnica.co.jp/business/security/manufacturers/crowdstrike/support.html

*The maintenance contract number is required for application. The maintenance contract number is listed in the notification sent to you with the subject below.
Subject: [Notice regarding delivery of CrowdStrike notification]

* Responses usually take 1 to 3 business days.

Sensor Release

Falcon Sensor for Windows 7.26.19811 Hotfix Release [Released July 22, 2025]

  • Main New Features
    • This hotfix release does not include any new features.
  • Main fixes
    • In a Citrix environment, we fixed an issue where unloading the Windows user registry hive failed when adding or removing a user profile using Profile Manager. This issue only occurred on sensors version 7.26.19809.
    • Fixed a rare issue where the CsFalconService could hang while attempting to exit, causing the machine to require a long reboot or hard reset. This issue existed in sensors from 7.23 to 7.26.19809.
  • Please see our support site article for more information.

Falcon Sensor for Windows 7.27.19907 Release Announcement [Released July 24, 2025]

  • Main New Features
    • The sensor behavioral machine learning model (IOA-based ML) has been updated to collect behavioral data without generating detections, improving the machine learning's ability to analyze process behaviors, indicators, and patterns to identify threats.
  • Main changes
    • Fixed an issue where the installer was installing the same version multiple times.
    • To address an issue where error code 3 could occur when upgrading Windows sensors, a fix has been implemented that changes how Windows Restart Manager is configured, improving the reliability of upgrades.
      ・Detailed article: https://support.mnc.macnica.co.jp/hc/ja/articles/48631138993817
    • Falcon Data Protection fixed an issue where the text analyzer was removing white space from documents, causing inconsistent content classification.
    • We fixed an issue where DC information was not being sent correctly to the cloud, causing domain controllers to appear as unmonitored.
    • Fixed an issue where jobs launched using PowerShell in Falcon for IT would not terminate upon timeout.
    • Fixed an issue where Falcon Prevent lost security descriptors and file attributes when multiple malicious macros were detected in a quarantined Microsoft Office document.
  • Please see our support site article for more information.

Falcon Sensor for Mac 7.26.19707 Release Announcement [Released July 8, 2025]

  • Main New Features
    • A new Sensor Safe Mode feature has been introduced.
      ・Detailed article: https://support.mnc.macnica.co.jp/hc/ja/articles/48036383251481
    • Added support for Falcon Data Protection for Mac. This visibility-only feature monitors sensitive data exfiltration via web uploads, clipboard, and removable media. It also includes machine learning (ML)-based anomaly detection and similar source tracking.
  • Main changes
    • Fixed an issue where the installation complete popup screen was not displayed during manual installation on macOS Sequoia. This issue occurred in sensor versions 7.23 to 7.25.
    • Fixed an issue where the status indicator would temporarily show an incorrect state when requesting approval for a sensor system extension. This issue existed for all previous supported sensors.
    • A fix was first made in 7.22 to fix an issue where certain special character devices, such as TTY devices, were being evaluated unnecessarily, but this change adds improved checks to make it more robust.
  • Please see our support site article for more information.

Falcon Sensor for Mac 7.27.19806 Release Announcement [Released July 25, 2025]

  • Main New Features
    • Falcon Device Control now provides visibility and control over internal SD card readers and external Thunderbolt storage devices.
    • Existing on-sensor machine learning models have been enhanced to reduce known false positives.
  • Main changes
    • Fixed an issue where IP4Records, IP6Records, CNAMERecords, and RespondingDnsServer fields were being handled incorrectly in DnsRequestMac events.
    • Fixed an issue where the "agent_local_time" API response on Mac hosts returned an incorrect timestamp.
    • Fixed an issue where Falcon Firewall was unable to access SSID information on macOS Sonoma 14 and later.
    • Improved script analysis on macOS Sonoma 14 and later, resulting in fewer false positives and duplicate event data being reported.
  • Please see our support site article for more information.

Falcon Sensor for Linux 7.27.18003 Release [Released July 17, 2025]

  • Main New Features
    • Added Falcon Firewall support for Linux platforms.
    • Added support for Falcon Data Protection for cloud environments.
    • DaemonSet containers now use Red Hat Universal Base Image (UBI) 9.6-1749632992 Micro.
    • It is now possible to monitor systemd service creation and deletion events when the sensor is started, enhancing management of service activity. New events have been added: SystemdServiceCreated, SystemdServiceDeleted, and SyntheticSystemdServiceCreated.
    • Improved visibility into process environment variables at sensor startup, enhancing detection of existing backdoors and targeted attacks.
    • Added the ability to discover internet exposure of assets behind Layer 7 load balancers. Added InboundHttpHeader and InboundHttpParsingStatus events.
  • Main changes
    • Fixed an issue where container instance lifecycle events were not being sent to the CrowdStrike cloud for K3s version v1.30.11+k3s1 and later.
    • Fixed a file descriptor exhaustion issue, improving sensor reliability.
      ・Detailed article: https://support.mnc.macnica.co.jp/hc/ja/articles/48923257336729
    • Resolved an issue where Falcon for IT was mounting directories as read-only at the root level to expand file searches.
  • Kernel Support
    • Support has been added for new kernels, including previously unsupported versions of Amazon Linux, Debian, Oracle Linux, Red Hat Enterprise Linux, and Ubuntu.
  • Please see our support site article for more information.

Falcon Sensor for Linux 7.21.17406 Maintenance Release [Released July 24, 2025]

  • Main New Features
    • Falcon Sensor's SSL/TLS certificate support has been updated in preparation for the SSL/TLS certificate rotation in March 2026. Customers who have fixed policies related to sensor on Falcon sensor for Linux version 7.21.17405 should upgrade to 7.21.17406 in preparation for the SSL certificate rotation.
  • Main changes
    • This release does not contain any fixes.
  • Please see our support site article for more information.

Release Announcement

Regular updates to the Admin Console

  • CrowdStrike Falcon Console Regular Updates [As of the week of July 7, 2025]
    • New Features
      Fixed an issue where newly provisioned sensors would generate false notifications under certain circumstances.
      A new endpoint version /fem/queries/external-assets/v2 has been added to request external IDs.
      You can now quickly see which networks a scanner is assigned to within the Exposure Management settings.
    • For more information, please see our support site article.
      ・ https://support.mnc.macnica.co.jp/hc/ja/articles/48872961783705
  • CrowdStrike Falcon Console Regular Updates [As of the week of July 14, 2025]
    • New Features
      A new Response Policy Audit Log feature has been added that allows you to view the history of changes made to Real Time Response (RTR) policies.
      - In the Host Management and Devices API, the "Last Logged-In User Account" attribute is now updated immediately when a user logs in.
      ・For more information, please see the article on our support site.
      ・ https://support.mnc.macnica.co.jp/hc/ja/articles/48990914661401
  • CrowdStrike Falcon Console Regular Updates [As of the week of July 21, 2025]
    • New Features
      Falcon Exposure Management now enables you to check the configuration of your Windows and Windows Server assets against the latest CIS benchmarks.
      CrowdStrike Intelligence indicators of compromise (IOCs) for detections generated by third-party integrations and correlation rules are now available via the Falcon Console and /alerts API.
      Falcon Discover for IoT now allows you to add and manage tags when editing the attributes of ICS hosts and import hosts integrated with ICSC, making it easier to organize and search for hosts.
      XIoT now allows you to schedule cross-subnet collections in addition to local collections.
      Network Vulnerability Scan users can now monitor their license count in Exposer Management > Assets > Dashboards.
      Added the ability to quickly see which network a scanner is assigned to within Exposure Management settings.
    • For more information, please see our support site article.
      ・ https://support.mnc.macnica.co.jp/hc/ja/articles/49373773236761

Other Updates

Module-specific updates

Notes and Restrictions

  • [IMPORTANT] Active exploits targeting on-premise SharePoint servers (CVE-2025-53770 / CVE-2025-53771)
    • CrowdStrike has identified exploitation of CVE-2025-53770 (ToolShell) in Microsoft SharePoint.
    • This exploit, primarily used to upload malicious ASPX (.aspx) files (most commonly by attempting to access IIS MachineKeys), is already protected by Falcon.
      ・ https://support.mnc.macnica.co.jp/hc/ja/articles/49120503760281
  • Falcon Shield API migration to the Falcon Platform
    • The legacy Falcon Shield API endpoints are scheduled to be deprecated on January 11, 2026.
    • Creation of new API keys for legacy API endpoints will no longer be possible on the Falcon Shield portal.
    • API keys already created for the legacy API endpoints will continue to work until January 11, 2026.
    • This change only affects US-1, US-2, and EU-1 customers.
    • Legacy Adaptive Shield US and EU cloud customers are not impacted
      ・ https://support.mnc.macnica.co.jp/hc/ja/articles/48668344194201
  • Falcon EASM | Changes to DMARC configuration detection logic (after June 30, 2025)
    • Falcon Surface evaluates DMARC settings by making DNS requests to customer domains and checking TXT records, but accurate evaluation is difficult if the protected domain is not registered. With this change, customers can upload the domain information for which they want to evaluate DMARC settings to the Falcon Surface UI, minimizing DNS requests and enabling more accurate evaluation.
      ・ https://support.mnc.macnica.co.jp/hc/ja/articles/47490408134553
  • 180-Day Notice | Changes to MITRE ATT&CK Data in Alerts API, Detection Summary Events, Workflows, and Unified Detections [Scheduled for Deprecation on January 20, 2026]
    • To accommodate multiple MITRE ATT&CK tactics and techniques per alert, we've introduced a new mitre_attack array to the Alert API. As a result, the separate tactics and techniques fields will be deprecated by January 20, 2026, and API users are encouraged to update their code.
      ・ https://support.mnc.macnica.co.jp/hc/ja/articles/49306717772185
  • End of support for macOS Ventura Version 13
  • Falcon Firewall SSID Network Location Settings and User Permission Requirements on macOS Sonoma 14 and Later
  • Falcon Sensor for Linux | Coming soon, Falcon Sensor for Linux will no longer have Kernel Mode options when User Mode is compatible
    • In the Falcon Sensor for Linux, currently scheduled for release in October 2025, the option to force the Linux sensor to run in Kernel Mode if the host distribution and kernel support User Mode execution will be removed. More details will be announced in the release notes for the upcoming sensor release.
      ・ https://support.mnc.macnica.co.jp/hc/ja/articles/49260720814361

Maintenance and fault information

Inquiry/Document request

In charge of Macnica CrowdStrike Co., Ltd.

inquiry Document request

Weekdays: 9:00-17:00