Considering what Crowdstrike is intended to do, it's not really possible for it to work without running at the kernel level.