Crowdstrike Falcon Sensor, Azure VM Repair paths

The procedures in this article describe methods you can use to attach an encrypted OS disk to a repair VM and then unlock that disk. After the disk is unlocked, you can repair it. As a final step, you can replae the OS disk on the original VM with this newly repaired version.

Microsoft has some path to recover your Azure VM from Crowstrike impact:

Attach an unmanaged disk to a VM for offline repair – Azure | Microsoft Learn

https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/windows/unmanaged-disk-offline-repair

Also read for AZURE VM with Bitlocker Disks:

Unlocking an encrypted disk for offline repair – Azure | Microsoft Learn

https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/windows/unlock-encrypted-disk-offline

Crowdstrike Falcon, BSOD, VMWARE Server Recovery DEU – www.butsch.ch

https://www.butsch.ch/post/crowdstrike-falcon-bsod-vmware-server-recovery-deu/

19.07.2024 BSOD Blue screen Crowdstrike – www.butsch.ch

https://www.butsch.ch/post/19-07-2024-bsod-blue-screen-crowdstrike/

AWS-specific documentation:

To attach an EBS volume to an instance: 

https://docs.aws.amazon.com/ebs/latest/userguide/ebs-attaching-volume.html#:~:text=To%20attach%20an%20EBS%20volume,and%20choose%20Actions%2C%20Attach%20volume

Detach an Amazon EBS volume from an instance: 

https://docs.aws.amazon.com/ebs/latest/userguide/ebs-detaching-volume.html

Bitlocker recovery
related KB‘s:

BitLocker recovery in Microsoft Azure: https://www.crowdstrike.com/wp-content/uploads/2024/07/BitLocker-recovery-in-Microsoft-Azure.pdf

BitLocker recovery in Microsoft environments using SCCM: https://www.crowdstrike.com/wp-content/uploads/2024/07/BitLocker-recovery-in-Microsoft-environments-using-SCCM.pdf

BitLocker recovery in Microsoft environments using Active Directory and GPOs: https://www.crowdstrike.com/wp-content/uploads/2024/07/BitLocker-recovery-in-Microsoft-environments-using-Active-Directory-and-GPOs.pdf

BitLocker recovery in Microsoft environments using Ivanti Endpoint Manager: https://www.crowdstrike.com/wp-content/uploads/2024/07/BitLocker-recovery-in-Microsoft-environments-using-Ivanti-Endpoint-Manager.pdf

BitLocker recovery: known issues – Windows Client | Microsoft Learn

https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-security/bitlocker-recovery-known-issues

https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-security/bitlocker-recovery-known-issues#tablet-devices-dont-support-using-manage-bdeexe–forcerecovery-to-test-recovery-mode