Overview
The Swif agent performs device management tasks, such as running scripts, installing apps, managing local users, and opening Live Terminal sessions. CrowdStrike Falcon watches for suspicious behavior, so some of these legitimate actions can trigger false-positive detections. This article explains how to exclude the Swif agent in Falcon.
If you're seeing a Reverse Shell alert, see Avoiding the "Reverse Shell" Warning with Swif Live Terminal.
Important: Each IOA detection type needs its own exclusion. IOA exclusions in Falcon apply to one IOA rule, not to a whole file or process. Because the Swif agent does several kinds of management work, it can trigger several different IOA rules, each with its own IOA name. If detections continue after you add an IOA exclusion, the new detections probably have a different IOA name. Create an exclusion for each one.
Which Falcon exclusion to use
Falcon has four types of exclusions. You manage them in Configuration > Detections Management > Exclusions.
Exclusion type | What it stops | How to create it | Use for Swif |
IOA exclusion | Behavior-based detections, such as "Remote Command and Control" | Only from a detection, or by duplicating an existing IOA exclusion | Yes. This is the fix for most Swif detections. |
Machine learning (file path) exclusion | Detections based on Falcon's machine learning analysis of a file | Manually, by entering file paths | Yes, proactively, for the Swif paths listed below |
Machine learning (certificate) exclusion | Machine learning detections for files signed with a trusted certificate | Manually, from the file's signing certificate | Optional |
Sensor visibility exclusion | Everything. The sensor stops watching the path entirely. | Manually | No. CrowdStrike advises using these with extreme caution, and Swif doesn't need them. |
You can't create an IOA exclusion from scratch. The Falcon console creates IOA exclusions from a detection, or by duplicating and editing an existing IOA exclusion. If you're looking for an Add IOA exclusion button, that's why it isn't there.
Part 1: Create IOA exclusions from detections
Use this when Falcon has already raised a detection for the Swif agent.
Step 1: List every IOA name for the Swif agent
In the Falcon console, open your detections.
Filter or search for detections related to Swif, such as
swifteamorgorilla.Note each unique IOA name. Several detections may share one IOA name, and you need one exclusion for each name, not for each detection.
Step 2: Create an IOA exclusion from one detection of each IOA name
Open a detection with the IOA name.
Click Actions, then select Create IOA Exclusion.
Enter a Name, such as
Swif Agent – Remote Command and Control. Including the IOA name makes your exclusions easier to review later.Select the host groups the exclusion applies to.
Review the fields Falcon fills in from the detection. Keep them as filled in. If you change them, for example by adding wildcards, the exclusion may no longer match the detection.
Click Save.
Repeat for each IOA name from Step 1.
Step 3: Apply an exclusion to other host groups
To reuse an exclusion, for example for a new host group, duplicate the existing IOA exclusion and edit the copy. You don't need to wait for a new detection.
Part 2: Add machine learning exclusions before detections happen
To stop machine learning detections before they occur, add the Swif agent's files as machine learning (file path) exclusions.
In the Falcon console, go to Configuration > Detections Management > Exclusions.
Open the Machine Learning Exclusions tab, and create an exclusion.
Select the host groups.
Add the paths for each platform from the table below.
Enter a description, such as
Swif agent – management binaries.Save the exclusion.
Machine learning exclusions don't stop IOA detections. For those, use Part 1.
Swif agent paths
Windows
Path | What it is |
| The Swif agent. Runs as the STService service. It collects device information, applies policies, manages local users, and runs Live Terminal. |
| Swif's app management tool. Runs as the STGorilla service. |
| Copy of the agent, used for tasks that run with user permissions |
| Copy of the app management tool, used for tasks that run with user permissions |
| App management working folder |
| App management working folder for each user |
The agent copies swifteam.exe and gorilla.exe to C:\ProgramData\Swifteam\, because some users can't access C:\Program Files. Swif runs these copies when a task needs a user's permissions.
macOS
Path | What it is |
| The Swif agent |
Linux
Path | What it is |
| The Swif agent |
| Swif system check tool |
Live Terminal on Linux
When you use Live Terminal on a Linux device, the Swif agent (/usr/bin/swifteam) starts a bash session. Falcon may report this as a reverse shell or similar behavior.
To stop the detection, create an IOA exclusion from that detection, as described in Part 1. Keep the fields Falcon fills in, so the exclusion matches bash only when the Swif agent starts it. Don't exclude /usr/bin/bash on its own, since that would hide real attacks that use bash.
Verify the exclusions
Wait a few minutes for the exclusions to reach your devices.
In the Falcon console, check the detections timeline for the Swif agent.
Confirm that no new detections appear for the IOA names you excluded.
If a new detection appears with a different IOA name, create an exclusion for it as in Part 1.
Best practices
Be specific. Keep the prefilled IOA exclusion fields, and use exact paths instead of broad wildcards.
Document each exclusion. Name exclusions after the IOA name, and note why each one exists.
Review regularly. Remove exclusions you no longer need, for example after a Swif agent update changes its behavior.
Avoid sensor visibility exclusions. They stop Falcon from watching the path at all.
Troubleshooting
Detections continue after I added an IOA exclusion
The new detections probably have a different IOA name. Each IOA exclusion covers only one IOA rule, and the Swif agent can trigger several. Check the IOA name of each new detection, and create an exclusion for each one that isn't covered yet.
I can't find a way to add an IOA exclusion manually
This is expected. Falcon creates IOA exclusions only from a detection, or by duplicating an existing IOA exclusion. To prepare in advance, add machine learning exclusions for the Swif paths (Part 2).
The IOA exclusion doesn't match the detection
The fields were probably changed after Falcon filled them in. Delete the exclusion, then create it again from the detection without changing the prefilled fields.
Detections continue after I created exclusions for every IOA name
Contact CrowdStrike Support with the detection links, screenshots of your exclusions, and the affected file's full path and hash. You can also contact Swif support.
Related resources
Swif
CrowdStrike (Customer Center login required)