EXPLORE DETECTIONS
New installed Sensors
This query loads host inventory data from aid_master_main.csv, enriches it with details from aid_master_details.csv, and outputs a cleaned, formatted table of host information.
Notepad++ supply chain attack
This query detects a state-sponsored supply chain attack where the legitimate Notepad++ updater (gup.exe) is hijacked to download the Chrysalis backdoor. It identifies the attack by spotting unauthorized network connections from the updater, malicious DLL side-loading (e.g., BluetoothService.exe loading log.dll), and data exfiltration commands involving curl and temp.sh. https://notepad-plus-plus.org/news/hijacked-incident-info-update/ https://notepad-plus-plus.org/news/clarification-security-incident/ https://securelist.com/notepad-supply-chain-attack/118708/ https://notepad-plus-plus.org/assets/data/IoCFromFormerHostingProvider.txt https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
Notepad++ supply chain attack
This query detects a state-sponsored supply chain attack where the legitimate Notepad++ updater (gup.exe) is hijacked to download the Chrysalis backdoor. It identifies the attack by spotting unauthorized network connections from the updater, malicious DLL side-loading (e.g., BluetoothService.exe loading log.dll), and data exfiltration commands involving curl and temp.sh. https://notepad-plus-plus.org/news/hijacked-incident-info-update/ https://notepad-plus-plus.org/news/clarification-security-incident/ https://securelist.com/notepad-supply-chain-attack/118708/ https://notepad-plus-plus.org/assets/data/IoCFromFormerHostingProvider.txt https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
NPM Package Named Searches
These queries detect file write events (typically FileWritten or similar) involving specific npm-related package files on endpoints. They are designed for threat hunting, supply chain monitoring, and investigating the installation or dropping of particular Node.js packages. These queries detect file write events (typically FileWritten or similar) involving specific npm-related package files on endpoints. They are designed for threat hunting, supply chain monitoring, and investigating the installation or dropping of particular Node.js packages. ## How to adapt: - Replace jscrambler@ with any other scoped or unscoped package pattern. - Add or remove packages in the OR chain as needed. - Add | filter ... clauses for specific users, directories, or time windows.
NTLM authentication where Kerberos is expected (Baseline)
This query identifies NTLM authentications observed by Active Directory in service‑based authentication contexts where Kerberos is the default and normally preferred mechanism. It filters for NTLM (v1/v2) usage during access to domain services (such as SMB, LDAP, or RPC) by leveraging the presence of a service identifier, which indicates that Kerberos should typically be available. The query aggregates events to highlight recurring NTLM fallback patterns across users, machines, and servers, and is intended for baseline exposure tracking and hygiene monitoring, not direct incident alerting. This query is designed to identify NTLM authentications occurring in Active Directory service contexts where Kerberos is the default and normally preferred authentication mechanism. Important: This query does not prove malicious activity. It provides visibility into architectural exposure and authentication fallback behavior.
OAuth2 Token Burst — Token Harvesting (Microsoft Defender for Identity)
Detects a sudden surge in OAuth2 token requests or acquisitions within a short timeframe, as identified by Microsoft Defender for Identity. This behavior may indicate token harvesting activity, where an attacker attempts to obtain multiple access tokens to abuse authentication sessions and maintain unauthorized access. Detects a sudden surge in OAuth2 token requests or acquisitions within a short timeframe, as identified by Microsoft Defender for Identity. This behavior may indicate token harvesting activity, where an attacker attempts to obtain multiple access tokens to abuse authentication sessions and maintain unauthorized access.
OS Platform ratio
This query aggregates SensorHeartbeat events by operating system platform to show the relative distribution of endpoints per OS. It is well suited for visualization as a pie chart, providing a quick overview of platform coverage and identifying imbalances or unexpected OS presence in the environment.
OS Platform ratio
This query aggregates SensorHeartbeat events by operating system platform to show the relative distribution of endpoints per OS. It is well suited for visualization as a pie chart, providing a quick overview of platform coverage and identifying imbalances or unexpected OS presence in the environment.
Overnight Post-RDP Activity Detection
Correlates remote interactive logons (UserLogon, LogonType=10) occurring during overnight hours with suspicious process execution (ProcessRollup2) from the same logon session, within 30 minutes of the logon. Processes are matched on ImageFileName against a broad set of native tools and LOLBins (shells, script engines, recon utilities, transfer/archive tools, remote-exec binaries) and classified by CommandLine into signal categories: Enumeration, PowerShell Enumeration, Transfer or Archive Utility, PowerShell Transfer or Archive, and encoded Command Processor/PowerShell. Uncategorized processes are dropped. # Overnight Post-RDP Activity — Query Explanation ## Design Finds recon/staging commands run within 30 min of an overnight RDP logon. - **Primary:** `ProcessRollup2` (processes) • **Subquery:** `UserLogon` (logons) - **Join key:** `AuthenticationId` (constant per logon session) - **Gate:** process starts 0–30 min after logon `ProcessRollup2` is primary because `join()` returns only one subquery row per key. A session has one `AuthenticationId` but many processes, so a logon-primary join would collapse to one row. Process-primary = each process is its own row. ## Sections - **Event + image filter** — Windows `ProcessRollup2`, restricted to shells, script engines, LOLBins, recon and transfer/archive tools. Kept broad; the time window controls volume. - **Lineage denylist** (`ParentBaseFileName!=/^()\.exe$/i`, grandparent same) — fails open: blank/unknown parents pass. Positive allowlists were avoided (they silently drop real hits with blank lineage). Add benign off-hours job names inside `( )` to trim noise. - **Classification (`case`)** — tags each process by `CommandLine`: Enumeration, PowerShell Enumeration, Transfer/Archive, PowerShell Transfer/Archive, encoded PowerShell; else `Other`. `net1?(\.exe)?"?\s+` matches `net`/`net1` and both full-path-quoted and bare forms (PowerShell full-paths binaries, cmd passes them raw). - **Drop + timestamp** — `SignalType!="Other"` removes unclassified rows. `ProcessStartTime * 1000` (epoch sec → ms). - **Join** — subquery keeps `LogonType=10` (RDP) logons in 21:00–03:59 local via `formatTime` + `in()`; `LogonTime * 1000` → ms; matched on `AuthenticationId`. - **Window + output** — `TimeFromLogonMinutes = (Command - Logon) / 60000`, bounded `>= 0` and `<= 30`, tabled and sorted newest-first. Uses `LogonTime`/`ProcessStartTime` (real event times), NOT `@timestamp` (sensor report time — would skew the delta). ## Tuning - **Timezone** — set subquery TZ to endpoint location (`America/New_York` = Eastern). Mismatch silently drops logons. - **Hours** — edit `remoteHour` values. - **Window** — adjust `TimeFromLogonMinutes <= 30`. - **Noise** — add parent/grandparent names to the denylists.
Packages in Container Images - Match Lookup File
Parses packages from ImageVulnerabilityEvents and cross-references it with a lookup file to identify matching entries. A lookup file with a list of packages needs to be uploaded first. Example: |PackageName|Version| |---|---| |Package|1.0.0|
Packages in Container Images - Match Lookup File
Parses packages from ImageVulnerabilityEvents and cross-references it with a lookup file to identify matching entries. A lookup file with a list of packages needs to be uploaded first. Example: |PackageName|Version| |---|---| |Package|1.0.0|
Packages in Container Images - Match Parameter
Searches packages using the provided parameter and returns the corresponding image repository.
Packages in Container Images - Match Parameter
Searches packages using the provided parameter and returns the corresponding image repository.
Packed Binary Detected
This query hunts for packed executable files written to disk on CrowdStrike Falcon monitored endpoints, classifies them by risk based on write location, and groups results by computer to identify the most affected/suspicious hosts. This query hunts for packed executable files written to disk on CrowdStrike Falcon monitored endpoints, classifies them by risk based on write location, and groups results by computer to identify the most affected/suspicious hosts.
Password Spray Many Users from Same IP Microsoft Defender for Identity
Detects multiple authentication failures across several user accounts originating from a single IP address, as identified by Microsoft Defender for Identity. This pattern is indicative of a password spraying attack where an attacker attempts common passwords against multiple users to gain unauthorized access. Detects multiple authentication failures across several user accounts originating from a single IP address, as identified by Microsoft Defender for Identity. This pattern is indicative of a password spraying attack where an attacker attempts common passwords against multiple users to gain unauthorized access.
Phishing - List of links opened from Outlook
Phishing - List of links opened from Outlook
Possible DC Replication (DCSync)
Detects suspicious attempts to replicate Active Directory data from a Domain Controller using the DCSync technique based on the Defender for identity module. This behavior may indicate an attacker attempting to extract sensitive credentials (such as password hashes) by mimicking domain replication requests
Potential Lateral Movement through RDP
Detects when a user account initiates Remote Desktop Protocol (RDP) sessions across multiple systems within a short timeframe, as identified by Microsoft Defender for Identity. This behavior may indicate potential lateral movement by an attacker or unauthorized use of administrative access This query detects potential lateral movement activity by analyzing Kerberos/NTLM remote desktop logon events from Microsoft Defender for Identity. It groups authentication events by username and flags users who logged into more than one unique device within a 60-minute window.
Powershell Command Length Anomaly Detection
This query establishes a 7-day baseline of average PowerShell command lengths for each host. It then compares this baseline to the average command length of the last 24 hours. The query identifies hosts with a significant percentage increase in command length, which can be an indicator for obfuscation, fileless execution, or other malicious activities associated with "Living off the Land" techniques. ## Why Powershell is a Target for Attackers Powershell is an integral part of modern Windows systems and offers powerful automation capabilities through its .NET integration. These features also make it attractive to attackers: - **Pre-installed:** Available on every Windows system (no additional code needed). - **Powerful Access:** Direct access to Windows APIs and network resources. - **In-Memory Execution:** Capable of running code directly from memory (fileless execution). - **Often Under-Monitored:** Frequently lacks sufficient monitoring or restrictions. Attackers use **"Living off the Land"** tactics to leverage PowerShell for stealthy attacks without deploying additional tools. ## Why Command Length Deviations Indicate Threats Attackers often employ methods that result in unusually long command lines. Monitoring deviations from normal command length is a valuable approach for detecting suspicious activity. Unusually long commands can indicate: * **Obfuscation:** * **Encoding:** Using Base64 (`-EncodedCommand`), hexadecimal, or ASCII to hide commands. * **Escape Characters:** Using backticks (`) to impair readability. * **Embedding Payloads:** Inserting entire scripts or binary payloads directly into the command line. * **Fileless Execution & LotL:** Complex one-liners are used to download and execute payloads from remote sources, leading to longer commands. * **Offensive Frameworks:** Tools like Empire, PowerSploit, or Cobalt Strike often generate long, obfuscated commands for their payloads. Unusually long commands are a strong indicator because they directly correlate with common attacker techniques for evasion and execution (e.g., [T1027.010 Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027/010/)). Legitimate administrative tasks rarely require the extreme lengths produced by these methods. | Technique | Impact on Length | Description | | :--- | :--- | :--- | | Base64 (`-EncodedCommand`)| Significant Increase | Hides script content; very common for payload delivery. | | String Concatenation | Moderate/Variable Increase | Used to break up keywords and evade simple string matching. | | Remote Download Cradles | Variable (Often Long) | Commands like `IEX (New-Object Net.WebClient).DownloadString(...)` can be long. | | Embedded Scripts/Payloads | Significant Increase | Entire scripts or binaries are passed in the command line, nearing max length. | ## The Power of Baselining: Establishing "Normal" This query is based on the core idea of baselining "normal" activity for PowerShell command lengths and then identifying significant deviations from that norm. ### Creating the Baseline The query analyzes historical PowerShell executions over a defined period (7 days) to calculate statistical measures (the average) for command lengths. This establishes the expected range. By comparing the last day's average length against this historical baseline, the query can flag anomalous increases. A **7-day baseline** is chosen to: - Capture weekly operational cycles (e.g., weekend maintenance scripts). - Balance stability and adaptability, smoothing out daily fluctuations while remaining responsive to real changes.
Powershell Command Length Anomaly Detection
This query establishes a 7-day baseline of average PowerShell command lengths for each host. It then compares this baseline to the average command length of the last 24 hours. The query identifies hosts with a significant percentage increase in command length, which can be an indicator for obfuscation, fileless execution, or other malicious activities associated with "Living off the Land" techniques. ## Why Powershell is a Target for Attackers Powershell is an integral part of modern Windows systems and offers powerful automation capabilities through its .NET integration. These features also make it attractive to attackers: - **Pre-installed:** Available on every Windows system (no additional code needed). - **Powerful Access:** Direct access to Windows APIs and network resources. - **In-Memory Execution:** Capable of running code directly from memory (fileless execution). - **Often Under-Monitored:** Frequently lacks sufficient monitoring or restrictions. Attackers use **"Living off the Land"** tactics to leverage PowerShell for stealthy attacks without deploying additional tools. ## Why Command Length Deviations Indicate Threats Attackers often employ methods that result in unusually long command lines. Monitoring deviations from normal command length is a valuable approach for detecting suspicious activity. Unusually long commands can indicate: * **Obfuscation:** * **Encoding:** Using Base64 (`-EncodedCommand`), hexadecimal, or ASCII to hide commands. * **Escape Characters:** Using backticks (`) to impair readability. * **Embedding Payloads:** Inserting entire scripts or binary payloads directly into the command line. * **Fileless Execution & LotL:** Complex one-liners are used to download and execute payloads from remote sources, leading to longer commands. * **Offensive Frameworks:** Tools like Empire, PowerSploit, or Cobalt Strike often generate long, obfuscated commands for their payloads. Unusually long commands are a strong indicator because they directly correlate with common attacker techniques for evasion and execution (e.g., [T1027.010 Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027/010/)). Legitimate administrative tasks rarely require the extreme lengths produced by these methods. | Technique | Impact on Length | Description | | :--- | :--- | :--- | | Base64 (`-EncodedCommand`)| Significant Increase | Hides script content; very common for payload delivery. | | String Concatenation | Moderate/Variable Increase | Used to break up keywords and evade simple string matching. | | Remote Download Cradles | Variable (Often Long) | Commands like `IEX (New-Object Net.WebClient).DownloadString(...)` can be long. | | Embedded Scripts/Payloads | Significant Increase | Entire scripts or binaries are passed in the command line, nearing max length. | ## The Power of Baselining: Establishing "Normal" This query is based on the core idea of baselining "normal" activity for PowerShell command lengths and then identifying significant deviations from that norm. ### Creating the Baseline The query analyzes historical PowerShell executions over a defined period (7 days) to calculate statistical measures (the average) for command lengths. This establishes the expected range. By comparing the last day's average length against this historical baseline, the query can flag anomalous increases. A **7-day baseline** is chosen to: - Capture weekly operational cycles (e.g., weekend maintenance scripts). - Balance stability and adaptability, smoothing out daily fluctuations while remaining responsive to real changes.
Powershell Downloads
This query detects powershell downloads using `Start-BitsTransfer`, `Invoke-WebRequest`, or `System.Net.WebClient`.
Powershell Downloads
This query detects powershell downloads using `Start-BitsTransfer`, `Invoke-WebRequest`, or `System.Net.WebClient`.
Process Execution directly from SMB share or SMB-mapped path
This query detects remote process execution over SMB (Server Message Block) on CrowdStrike Falcon monitored endpoints — a strong indicator of lateral movement, remote code execution, or ransomware spreading across the network. This query detects remote process execution over SMB (Server Message Block) on CrowdStrike Falcon monitored endpoints — a strong indicator of lateral movement, remote code execution, or ransomware spreading across the network.