CloudStrike was installed with user consent, and still ended up being a fatal rootkit. Installing software in Ring 0 is always a bad idea.