From cb59e924417fb1b18a8c2af5200c7359550ae92c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 18 Dec 2019 12:22:51 +0100
Subject: [PATCH] [MALW-3280] Added support for falcon-sensor by CrowdStrike

---
 include/tests_malware | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/include/tests_malware b/include/tests_malware
index 6718a10b..d983b17f 100644
--- a/include/tests_malware
+++ b/include/tests_malware
@@ -31,6 +31,7 @@
     BITDEFENDER_DAEMON_RUNNING=0
     CLAMD_RUNNING=0
     CLAMSCAN_INSTALLED=0
+    CROWDSTRIKE_FALCON_SENSOR_RUNNING=0
     ESET_DAEMON_RUNNING=0
     FRESHCLAM_DAEMON_RUNNING=0
     KASPERSKY_SCANNER_RUNNING=0
@@ -145,6 +146,17 @@
             Report "malware_scanner[]=avira"
         fi
 
+        # CrowdStrike falcon-sensor
+        LogText "Test: checking process falcon-sensor (CrowdStrike)"
+        if IsRunning "falcon-sensor"; then
+            FOUND=1
+            if IsVerbose; then Display --indent 2 --text "- ${GEN_CHECKING} falcon-sensor" --result "${STATUS_FOUND}" --color GREEN; fi
+            LogText "Result: found falcon-sensor service"
+            CROWDSTRIKE_FALCON_SENSOR_RUNNING=1
+            MALWARE_SCANNER_INSTALLED=1
+            Report "malware_scanner[]=falcon-sensor"
+        fi
+
         # Cylance (macOS)
         LogText "Test: checking process CylanceSvc"
         if IsRunning "CylanceSvc"; then