Swif's agent software may occasionally trigger false-positive detections in CrowdStrike Falcon due to its security-related functionalities. To prevent these disruptions, configure exclusions in your CrowdStrike Falcon platform using the modern workflows detailed below.
If you are seeing a Reverse Shell alert, learn more at Avoiding the “Reverse Shell” Warning with Swif Live Terminal.
Recommended: Creating an IOA Exclusion Directly from a Detection
For modern versions of CrowdStrike Falcon, the most effective way to resolve active detections (such as "Remote Command and Control") is to create an Indicator of Attack (IOA) exclusion directly from the event.
Select the Detection
In the CrowdStrike Falcon Console, navigate to your detections and select the specific event related to swifteam.
Select Actions
Click on the Actions menu for that detection.
Create IOA Exclusion: Select Create IOA Exclusion from the dropdown.
Configure Exclusion
Name: Provide a descriptive name (e.g., "Swif Agent IOA Exclusion").
Target Host Group: Identify and select the appropriate host group(s) this exclusion should apply to.
Review Prefilled Fields
CrowdStrike will pre-fill the exclusion fields based on the detection details.
Note: While you can adjust these using wildcards, it is recommended to leave them as prefilled if you find that custom entries result in no detections matching the exclusion.
Save
Click Save to apply the exclusion.
Manual Exclusion Setup
If you need to proactively configure exclusions before a detection occurs, follow these steps.
Step 1: Navigate to Exclusion Settings
Log into the CrowdStrike Falcon Console.
From the left-hand navigation menu, select Configuration.
Click File Exclusions or IOA Exclusions.
Step 2: Configure Exclusion Parameters
Fill in the exclusion details with Swif's recommended settings:
Exclusion type: Choose File or Folder (typically "File").
Platform: Select Windows, macOS, or Linux.
Description: e.g., "Swif agent file exclusion to prevent false positives."
Step 3: Exclusion Patterns by Platform
Windows
C:\Program Files\Swifteam\swifteam.exe(Primary agent binary)C:\Program Files\Swifteam\gorilla.exe(Application management binary)C:\ProgramData\Swifteam\swifteam.exeC:\ProgramData\Swifteam\gorilla.exeC:\ProgramData\gorillaC:\Users\{{USER}}\AppData\Local\gorilla
C:\Program Files\Swifteam\swifteam.exe:
This is the Swif agent binary installed on the device. Most management operations are handled through the associated service called STService. The primary functions include:
Retrieving device information
Managing certain policies
Handling local user operations
Live Terminal
C:\Program Files\Swifteam\gorilla.exe:
This binary is used for Application Management operations on the device. It is associated with the STGorilla service. Cloned versions of these binaries are also available under the C:\ProgramData\Swifteam\ directory. Since the Program Files directory may have restricted access for some users, the agent automatically copies both swifteam.exe and gorilla.exe into ProgramData. Through Swif's task execution system, when operations require USER-level permissions, the binaries located under C:\ProgramData\Swifteam\ are invoked.
macOS
/usr/local/swifteam/swifteam
Linux
/usr/bin/swifteam/usr/bin/systemcheck
Special Considerations for Linux Live Terminal
If you use Swif's Live Terminal feature on Linux, CrowdStrike may trigger a warning that /usr/bin/swifteam spawns a bash session.
Action: Enable a child-process exclusion to silence this warning.
Rule: Create an exclusion for
/usr/bin/bashonly when the parent process is/usr/bin/swifteam.Location: In Falcon, this is found under Detection Exclusions → Process → Parent/Child Relationship.
Verification & Best Practices
Verify: After configuring, check the CrowdStrike Falcon console alerts to confirm the exclusions are working effectively.
Review: Regularly review your exclusion lists to ensure they remain accurate and secure.
Principle of Least Privilege: Limit exclusions to essential paths to maintain an optimal security posture.
If further assistance is required, contact Swif support or CrowdStrike support.