CrowdStrike has kernel code meant to stop everything you mention minus the network part (and being offline should have minimal impact on the security of the sys

CrowdStrike has kernel code meant to stop everything you mention minus the network part (and being offline should have minimal impact on the security of the system), but in practice I'm sure you're right. It's easy enough to get attacks past them that frankly I haven't bothered trying to disable the agent.