Source: me, a developer who also codes in free time and notices how bad fs perf is especially.
I've had the CrowdStrike sensor, and my current company is using cyberhaven.
So.. while 2 data points don't technically make a pattern, it does begin to raise suspicion.