CrowdStrike Boss: 97 Percent of Windows Devices That Went Down Are Back Up

As this global tragedy unfolded, CrowdStrike issued a content configuration update for their software that was supposed to “collect telemetry on possible new threat techniques.”

These updates are delivered periodically, but this particular configuration update caused Windows to crash.

CrowdStrike itself usually issues configuration updates in two different ways. The first is called Sensor Content which directly updates CrowdStrike’s own Falcon sensor that runs at the kernel level in Windows.

Then there is Rapid Response Content which updates the way the sensor behaves to detect malware. In this case, the Rapid Response Content file, which is only 40KB in size, likely caused millions of Windows computers to fail to start and restart.

Updates to these sensors do not come from the cloud and typically include AI and machine learning models that allow CrowdStrike to improve its detection capabilities over the long term.

These capabilities include something like Template Types, which is code that enables new, configured detections based on a separate Quick Response Content type that shipped in last Friday’s update.

On the cloud side, CrowdStrike maintains its own systems that perform validation checks on content before it is released to prevent incidents like last Friday.

“Due to a bug in the Content Validator, one of the two Template Instances passed validation despite containing problematic content data,” CrowdStrike said.