Overview
The Swif agent performs device management tasks, such as running scripts, installing apps, managing local users, and opening Live Terminal sessions. CrowdStrike Falcon watches for suspicious behavior, so some of these legitimate actions can trigger false-positive detections. This article explains how to exclude the Swif agent in Falcon.
If you're seeing a Reverse Shell alert, see Avoiding the "Reverse Shell" Warning with Swif Live Terminal.
Important: Each IOA detection type needs its own exclusion. IOA exclusions in Falcon apply to one IOA rule, not to a whole file or process. Because the Swif agent does several kinds of management work, it can trigger several different IOA rules, each with its own IOA name. If detections continue after you add an IOA exclusion, the new detections probably have a different IOA name. Create an exclusion for each one.
Which Falcon exclusion to use
Falcon has four types of exclusions. You manage them in Configuration > Detections Management > Exclusions.
Exclusion type | What it stops | How to create it | Use for Swif |
IOA exclusion | Behavior-based detections, such as "Remote Command and Control" | Only from a detection, or by duplicating an existing IOA exclusion | Yes. This is the fix for most Swif detections. |
Machine learning (file path) exclusion | Detections based on Falcon's machine learning analysis of a file | Manually, by entering file paths | Yes, proactively, for the Swif paths listed below |
Machine learning (certificate) exclusion | Machine learning detections for files signed with a trusted certificate | Manually, from the file's signing certificate | Yes, on Windows. Covers all signed Swif binaries, and survives agent updates. See below. |
Sensor visibility exclusion | Everything. The sensor stops watching the path entirely. | Manually | No. CrowdStrike advises using these with extreme caution, and Swif doesn't need them. |
You can't create an IOA exclusion from scratch. The Falcon console creates IOA exclusions from a detection, or by duplicating and editing an existing IOA exclusion. If you're looking for an Add IOA exclusion button, that's why it isn't there.
Part 1: Create IOA exclusions from detections
Use this when Falcon has already raised a detection for the Swif agent.
Step 1: List every IOA name for the Swif agent
In the Falcon console, open your detections.
Filter or search for detections related to Swif, such as
swifteamorgorilla.Note each unique IOA name. Several detections may share one IOA name, and you need one exclusion for each name, not for each detection.
Step 2: Create an IOA exclusion from one detection of each IOA name
Open a detection with the IOA name.
Click Actions, then select Create IOA Exclusion.
Enter a Name, such as
Swif Agent – Remote Command and Control. Including the IOA name makes your exclusions easier to review later.Select the host groups the exclusion applies to.
Review the fields Falcon fills in from the detection. Keep them as filled in. If you change them, for example by adding wildcards, the exclusion may no longer match the detection.
Click Save.
Repeat for each IOA name from Step 1.
Step 3: Apply an exclusion to other host groups
To reuse an exclusion, for example for a new host group, duplicate the existing IOA exclusion and edit the copy. You don't need to wait for a new detection.
Part 2: Add machine learning exclusions before detections happen
To stop machine learning detections before they occur, add the Swif agent's files as machine learning (file path) exclusions.
In the Falcon console, go to Configuration > Detections Management > Exclusions.
Open the Machine Learning Exclusions tab, and create an exclusion.
Select the host groups.
Add the paths for each platform from the table below.
Enter a description, such as
Swif agent – management binaries.Save the exclusion.
Machine learning exclusions don't stop IOA detections. For those, use Part 1.
Swif agent paths
Windows
Path | What it is |
| The Swif agent. Runs as the STService service. It collects device information, applies policies, manages local users, and runs Live Terminal. |
| Swif's app management tool. Runs as the STGorilla service. |
| Copy of the agent, used for tasks that run with user permissions |
| Copy of the app management tool, used for tasks that run with user permissions |
| Swif system check tool. Runs as the STCheckService service. |
| Copy of the system check tool, used for tasks that run with user permissions |
| Swif agent uninstaller |
| App management working folder |
| App management working folder for each user |
The agent copies swifteam.exe, gorilla.exe, and systemcheck.exe to C:\ProgramData\Swifteam\, because some users can't access C:\Program Files. Swif runs these copies when a task needs a user's permissions.
macOS
Path | What it is |
| The Swif agent |
| Swif agent uninstaller |
Linux
Path | What it is |
| The Swif agent |
| Swif system check tool. Runs as the |
The paths differ on some distributions:
Distribution | Paths |
Universal Blue (Bazzite, Bluefin, Aurora) |
|
NixOS | Under |
Swif Agentic Security agent paths
If you use Swif Agentic Security, its agent is a separate install. Add these paths too:
Windows
Path | What it is |
| The Agentic Security agent. Runs as the STAgentSecurity service. |
| AI agent activity sensor |
macOS
Path | What it is |
| The Agentic Security agent |
| AI agent activity sensor |
| Agentic Security installer |
Linux
Path | What it is |
| The Agentic Security agent |
| AI agent activity sensor |
Use a certificate exclusion on Windows
Swif's Windows binaries are signed with an EV Authenticode certificate. A machine learning (certificate) exclusion based on it covers every signed Swif binary, and keeps working after agent updates, without listing paths:
swifteam.exe,gorilla.exe,systemcheck.exe, andswifteam_uninstall.exethe Swif MSI installer
the Agentic Security binaries
Use these certificate details:
Field | Value |
Subject |
|
Issuer |
|
Match on the subject and issuer, not the thumbprint. The certificate's thumbprint changes whenever the certificate is renewed, which would break a thumbprint-based exclusion. The current thumbprint, for reference, is F9E8FB079774FF8117A1FE30F8A763955E847D95, valid until July 19, 2027.
Certificate exclusions stop only machine learning detections. Create IOA exclusions for behavior-based detections, as in Part 1.
Swif's macOS signing details
Swif's macOS binaries, including the Agentic Security agent, are signed and notarized by Apple, with hardened runtime:
Field | Value |
Signed by | Developer ID Application: Swifteam Inc (86XZ7Y7Z47) |
Issuer | Apple Developer ID Certification Authority |
Team ID |
|
Use these details to identify Swif binaries when you review detections, or if your Falcon console supports exclusions based on them.
Linux signing details
Linux has no built-in code signing like Windows Authenticode or Apple notarization, and Falcon doesn't offer certificate-based exclusions on Linux. Use path-based exclusions on Linux, as listed above.
Swif's Linux binaries come with a detached GPG signature, so you can confirm that a binary is from Swif and hasn't been modified. The .deb and .rpm packages and the repository metadata are signed with the same key.
Field | Value |
Key | Swif Linux Repo |
Fingerprint |
|
Public key |
Each binary's signature is published next to it, with an .asc extension.
Verify the Swif agent:
curl -fsSLO https://swif-linux-package.s3.amazonaws.com/RPM-GPG-KEY-swifteam.pub
gpg --import RPM-GPG-KEY-swifteam.pub
V=$(swifteam -version 2>&1 | head -n 1 | awk '{print $NF}')
curl -fsSL -o swifteam.asc "https://cdn.swifteam.com/st-agent-linux/v$V/swifteam_x64.asc"
gpg --verify swifteam.asc /usr/bin/swifteam
The output should say Good signature from "Swif Linux Repo <dev@swif.ai>".
GPG may also warn that the key isn't certified with a trusted signature. That's expected. Check that the fingerprint in the output matches the one above.
ARM devices: use
swifteam_arm64.asc.System check tool: use
systemcheck_x64.asc, and verify/usr/bin/systemcheck.
Verify the Agentic Security agent. Import the public key first, as above. Then run:
V=$(/usr/bin/agentsecurity -version)
ENV=prod # use "eu" for EU customers
B="https://cdn.swifteam.com/agentic-security/$ENV/$V/linux"
curl -fsSL -o agentsecurity.asc "$B/agent-x64.asc"
curl -fsSL -o adr-sensor.asc "$B/adr-runtime/x64/adr-sensor.asc"
gpg --verify agentsecurity.asc /usr/bin/agentsecurity
gpg --verify adr-sensor.asc /var/lib/agentsecurity/adr-sensor/runtime/adr-sensor
Each should say Good signature from "Swif Linux Repo <dev@swif.ai>".
EU customers: set
ENV=eu. The EU agent is a separate build, so theprodsignature won't match it.ARM devices: use
agent-arm64.ascandadr-runtime/arm64/adr-sensor.asc.
Live Terminal on Linux
When you use Live Terminal on a Linux device, the Swif agent (/usr/bin/swifteam) starts a bash session. Falcon may report this as a reverse shell or similar behavior.
To stop the detection, create an IOA exclusion from that detection, as described in Part 1. Keep the fields Falcon fills in, so the exclusion matches bash only when the Swif agent starts it. Don't exclude /usr/bin/bash on its own, since that would hide real attacks that use bash.
Verify the exclusions
Wait a few minutes for the exclusions to reach your devices.
In the Falcon console, check the detections timeline for the Swif agent.
Confirm that no new detections appear for the IOA names you excluded.
If a new detection appears with a different IOA name, create an exclusion for it as in Part 1.
Best practices
Be specific. Keep the prefilled IOA exclusion fields, and use exact paths instead of broad wildcards.
Document each exclusion. Name exclusions after the IOA name, and note why each one exists.
Review regularly. Remove exclusions you no longer need, for example after a Swif agent update changes its behavior.
Avoid sensor visibility exclusions. They stop Falcon from watching the path at all.
Troubleshooting
Detections continue after I added an IOA exclusion
The new detections probably have a different IOA name. Each IOA exclusion covers only one IOA rule, and the Swif agent can trigger several. Check the IOA name of each new detection, and create an exclusion for each one that isn't covered yet.
I can't find a way to add an IOA exclusion manually
This is expected. Falcon creates IOA exclusions only from a detection, or by duplicating an existing IOA exclusion. To prepare in advance, add machine learning exclusions for the Swif paths (Part 2).
The IOA exclusion doesn't match the detection
The fields were probably changed after Falcon filled them in. Delete the exclusion, then create it again from the detection without changing the prefilled fields.
Detections continue after I created exclusions for every IOA name
Contact CrowdStrike Support with the detection links, screenshots of your exclusions, and the affected file's full path and hash. You can also contact Swif support.
Related resources
Swif
CrowdStrike (Customer Center login required)