Overview ✨
During some Liongard Agent updates, CrowdStrike may flag the installer process as suspicious. This can happen because the updater uses a standard Windows installer bootstrapper pattern that extracts to a temporary folder and relaunches itself with elevation. Some security tools may interpret that behavior as similar to techniques used by malicious software, even when the process is legitimate and signed.
Based on current investigation, this behavior does not indicate that the Liongard Agent is attempting to delete shadow copies or perform ransomware-like actions. It is more accurately treated as a behavioral or heuristic detection that may require review or allowlisting within CrowdStrike.
🦁 This article covers a CrowdStrike-specific detection scenario. For broader allowlisting guidance across antivirus and EDR platforms, see Allowlisting the Liongard Agent in Antivirus & EDR Platforms.
What partners may see
A CrowdStrike detection during Agent install or update
An alert referencing suspicious process behavior from a temporary path
A detection associated with an elevated installer process
A failed or interrupted update, depending on local security policy
Ref:
🗒️ The exact alert wording can vary by CrowdStrike configuration, policy mode, sensor version, and detection logic. Some environments may generate an alert without blocking the action, while others may interrupt the update workflow.
Why this happens
The Liongard Windows installer uses a standard bootstrapper mechanism to launch installation tasks with the permissions required to complete an update. As part of that process, the installer may extract into a temporary directory and relaunch itself in elevated mode.
This behavior is common for legitimate software installers, but it can resemble techniques monitored by EDR platforms. In particular, a signed executable starting from a temporary location and relaunching itself with elevation may match a heuristic pattern that security products associate with high-risk behavior.
The presence of a CrowdStrike alert in this scenario does not, by itself, mean the installer performed a malicious action.
What this does and does not mean
What it means | What it does not mean |
|
|
How to validate the event
Review the CrowdStrike detection details, including the full process path and command line.
Confirm whether the detected executable is a Liongard installer or updater component.
Check whether the file is digitally signed by Liongard, Inc..
Review whether CrowdStrike reports an actual prevention action or only a detection event.
Compare the timing of the alert with the Agent installation or update attempt.
✅ When reviewing the event, focus on the signer identity, parent-child process relationship, executable path, and whether the action was blocked or only observed.
Recommended response
If the detected file is a legitimate Liongard component and the timing matches a planned install or update, review your CrowdStrike policy for the most appropriate trust method.
Use the broad EDR allowlisting guidance in the main Liongard article as your baseline approach, especially where certificate or signer-based trust is supported. This helps keep the solution consistent across security platforms while still addressing CrowdStrike-specific detections separately.
Allowlisting guidance for CrowdStrike
Where your security policy permits it, prefer a trust method that is based on signer identity or another durable publisher-based control rather than file hashes alone.
⚠️ Avoid relying on hash-based exclusions as the primary long-term solution when signer-based trust is available. Hashes can change across updates, which increases operational overhead and may cause repeated update failures.
For Liongard components, the most durable reference point is the trusted signer identity:
Signer / Subject:
Liongard, Inc.
If your CrowdStrike configuration supports certificate, publisher, or trusted signer logic, use that approach whenever possible. If your policy design requires a more restrictive exclusion model, validate the scope carefully so it applies only to legitimate Liongard components involved in installation and updating.
Operational guidance
Test any exclusion or policy change on a limited set of systems first
Confirm that the update completes successfully after the change
Document the specific exclusion type used in your environment
Review whether similar detections occur for installer bootstrapper activity from other trusted vendors
Troubleshooting checklist
Check | What to verify |
Installer identity | Confirm the detected executable is part of the Liongard installation or update flow and is signed by Liongard, Inc.. |
Detection type | Review whether CrowdStrike logged a heuristic alert, an indicator of attack, or an actual prevention event. |
Execution context | Confirm the process launched from a temporary directory during an expected install or update and used elevation as part of normal installer behavior. |
Policy scope | Verify whether existing exclusions are hash-based, certificate-based, publisher-based, or path-based, and whether they still match current deployment behavior. |
Update outcome | Check whether the Agent update completed, partially completed, or failed and whether a retry succeeds after policy review. |
When to contact support
Contact support if any of the following apply:
You are unsure whether the detected file is a legitimate Liongard component
The update continues to fail after reviewing CrowdStrike policy
You need help validating the signer or expected installer behavior
You want assistance aligning CrowdStrike handling with the broader Liongard EDR allowlisting guidance
When reaching out, include the detection details, full process path, command line, screenshots if available, and whether the event was detection-only or actively blocked.