crowdstrike_cql

Cloud Credential Violation IOMs

This query outputs all identified indicators of misconfigurations (IOMs) related to credentials.

Detection Query

CloudService="IAM" | in(field="policy_id", values=["576", "1", "466", "1006", "12", "15", "16", "18", "13", "17", "450", "577", "451", "8"])
| groupBy([PolicyStatement])

Author

CrowdStrike

Data Sources

Cloud

Platforms

cloud

Tags

Monitoringcs_module:CSPM / ASPM / DSPM

Raw Content

# --- Query Metadata ---
# Human-readable name for the query. Will be displayed as the title.
name: Cloud Credential Violation IOMs

# Description of what the query does and its purpose.
description: This query outputs all identified indicators of misconfigurations (IOMs) related to credentials.

# The author or team that created the query.
author: CrowdStrike

# The required log sources to run this query successfully in Next-Gen SIEM.
# This will be displayed in the UI to inform the user.
log_sources:
  - Cloud

# The CrowdStrike modules required to run this query.
cs_required_modules:
  - CSPM / ASPM / DSPM

# Tags for filtering and categorization.
# Include relevant techniques, tactics, or platforms.
tags:
  - Monitoring

# --- Query Content ---
# The actual CrowdStrike Query Language (CQL) code.
# Using the YAML block scalar `|` allows for multi-line strings.
cql: |
  CloudService="IAM" | in(field="policy_id", values=["576", "1", "466", "1006", "12", "15", "16", "18", "13", "17", "450", "577", "451", "8"])
  | groupBy([PolicyStatement])