EXPLORE DETECTIONS
MFA Status Monitoring
Displays Multi-Factor Authentication (MFA) status events over time. Monitor for unexpected spikes in denials, errors, or timeouts that may indicate security threats, system issues, or user experience problems requiring investigation.
MFA Status Monitoring
Displays Multi-Factor Authentication (MFA) status events over time. Monitor for unexpected spikes in denials, errors, or timeouts that may indicate security threats, system issues, or user experience problems requiring investigation.
MongoDB Processes on Windows & Linux Hosts (CVE-2025-14847)
This query identifies Windows and Linux Hosts running MongoDB processes.
MongoDB Processes on Windows & Linux Hosts (CVE-2025-14847)
This query identifies Windows and Linux Hosts running MongoDB processes.
New API Keys within the Falcon Platform
This query provides a list of newly created API Keys, including relevant details such as Client Name and Client ID.
New API Keys within the Falcon Platform
This query provides a list of newly created API Keys, including relevant details such as Client Name and Client ID.
New installed Sensors
This query loads host inventory data from aid_master_main.csv, enriches it with details from aid_master_details.csv, and outputs a cleaned, formatted table of host information.
New installed Sensors
This query loads host inventory data from aid_master_main.csv, enriches it with details from aid_master_details.csv, and outputs a cleaned, formatted table of host information.
Notepad++ supply chain attack
This query detects a state-sponsored supply chain attack where the legitimate Notepad++ updater (gup.exe) is hijacked to download the Chrysalis backdoor. It identifies the attack by spotting unauthorized network connections from the updater, malicious DLL side-loading (e.g., BluetoothService.exe loading log.dll), and data exfiltration commands involving curl and temp.sh. https://notepad-plus-plus.org/news/hijacked-incident-info-update/ https://notepad-plus-plus.org/news/clarification-security-incident/ https://securelist.com/notepad-supply-chain-attack/118708/ https://notepad-plus-plus.org/assets/data/IoCFromFormerHostingProvider.txt https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
Notepad++ supply chain attack
This query detects a state-sponsored supply chain attack where the legitimate Notepad++ updater (gup.exe) is hijacked to download the Chrysalis backdoor. It identifies the attack by spotting unauthorized network connections from the updater, malicious DLL side-loading (e.g., BluetoothService.exe loading log.dll), and data exfiltration commands involving curl and temp.sh. https://notepad-plus-plus.org/news/hijacked-incident-info-update/ https://notepad-plus-plus.org/news/clarification-security-incident/ https://securelist.com/notepad-supply-chain-attack/118708/ https://notepad-plus-plus.org/assets/data/IoCFromFormerHostingProvider.txt https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
NPM Package Named Searches
These queries detect file write events (typically FileWritten or similar) involving specific npm-related package files on endpoints. They are designed for threat hunting, supply chain monitoring, and investigating the installation or dropping of particular Node.js packages. These queries detect file write events (typically FileWritten or similar) involving specific npm-related package files on endpoints. They are designed for threat hunting, supply chain monitoring, and investigating the installation or dropping of particular Node.js packages. ## How to adapt: - Replace jscrambler@ with any other scoped or unscoped package pattern. - Add or remove packages in the OR chain as needed. - Add | filter ... clauses for specific users, directories, or time windows.
NTLM authentication where Kerberos is expected (Baseline)
This query identifies NTLM authentications observed by Active Directory in service‑based authentication contexts where Kerberos is the default and normally preferred mechanism. It filters for NTLM (v1/v2) usage during access to domain services (such as SMB, LDAP, or RPC) by leveraging the presence of a service identifier, which indicates that Kerberos should typically be available. The query aggregates events to highlight recurring NTLM fallback patterns across users, machines, and servers, and is intended for baseline exposure tracking and hygiene monitoring, not direct incident alerting. This query is designed to identify NTLM authentications occurring in Active Directory service contexts where Kerberos is the default and normally preferred authentication mechanism. Important: This query does not prove malicious activity. It provides visibility into architectural exposure and authentication fallback behavior.
OAuth2 Token Burst — Token Harvesting (Microsoft Defender for Identity)
Detects a sudden surge in OAuth2 token requests or acquisitions within a short timeframe, as identified by Microsoft Defender for Identity. This behavior may indicate token harvesting activity, where an attacker attempts to obtain multiple access tokens to abuse authentication sessions and maintain unauthorized access. Detects a sudden surge in OAuth2 token requests or acquisitions within a short timeframe, as identified by Microsoft Defender for Identity. This behavior may indicate token harvesting activity, where an attacker attempts to obtain multiple access tokens to abuse authentication sessions and maintain unauthorized access.
OS Platform ratio
This query aggregates SensorHeartbeat events by operating system platform to show the relative distribution of endpoints per OS. It is well suited for visualization as a pie chart, providing a quick overview of platform coverage and identifying imbalances or unexpected OS presence in the environment.
OS Platform ratio
This query aggregates SensorHeartbeat events by operating system platform to show the relative distribution of endpoints per OS. It is well suited for visualization as a pie chart, providing a quick overview of platform coverage and identifying imbalances or unexpected OS presence in the environment.
Overnight Post-RDP Activity Detection
Correlates remote interactive logons (UserLogon, LogonType=10) occurring during overnight hours with suspicious process execution (ProcessRollup2) from the same logon session, within 30 minutes of the logon. Processes are matched on ImageFileName against a broad set of native tools and LOLBins (shells, script engines, recon utilities, transfer/archive tools, remote-exec binaries) and classified by CommandLine into signal categories: Enumeration, PowerShell Enumeration, Transfer or Archive Utility, PowerShell Transfer or Archive, and encoded Command Processor/PowerShell. Uncategorized processes are dropped. # Overnight Post-RDP Activity — Query Explanation ## Design Finds recon/staging commands run within 30 min of an overnight RDP logon. - **Primary:** `ProcessRollup2` (processes) • **Subquery:** `UserLogon` (logons) - **Join key:** `AuthenticationId` (constant per logon session) - **Gate:** process starts 0–30 min after logon `ProcessRollup2` is primary because `join()` returns only one subquery row per key. A session has one `AuthenticationId` but many processes, so a logon-primary join would collapse to one row. Process-primary = each process is its own row. ## Sections - **Event + image filter** — Windows `ProcessRollup2`, restricted to shells, script engines, LOLBins, recon and transfer/archive tools. Kept broad; the time window controls volume. - **Lineage denylist** (`ParentBaseFileName!=/^()\.exe$/i`, grandparent same) — fails open: blank/unknown parents pass. Positive allowlists were avoided (they silently drop real hits with blank lineage). Add benign off-hours job names inside `( )` to trim noise. - **Classification (`case`)** — tags each process by `CommandLine`: Enumeration, PowerShell Enumeration, Transfer/Archive, PowerShell Transfer/Archive, encoded PowerShell; else `Other`. `net1?(\.exe)?"?\s+` matches `net`/`net1` and both full-path-quoted and bare forms (PowerShell full-paths binaries, cmd passes them raw). - **Drop + timestamp** — `SignalType!="Other"` removes unclassified rows. `ProcessStartTime * 1000` (epoch sec → ms). - **Join** — subquery keeps `LogonType=10` (RDP) logons in 21:00–03:59 local via `formatTime` + `in()`; `LogonTime * 1000` → ms; matched on `AuthenticationId`. - **Window + output** — `TimeFromLogonMinutes = (Command - Logon) / 60000`, bounded `>= 0` and `<= 30`, tabled and sorted newest-first. Uses `LogonTime`/`ProcessStartTime` (real event times), NOT `@timestamp` (sensor report time — would skew the delta). ## Tuning - **Timezone** — set subquery TZ to endpoint location (`America/New_York` = Eastern). Mismatch silently drops logons. - **Hours** — edit `remoteHour` values. - **Window** — adjust `TimeFromLogonMinutes <= 30`. - **Noise** — add parent/grandparent names to the denylists.
Packages in Container Images - Match Lookup File
Parses packages from ImageVulnerabilityEvents and cross-references it with a lookup file to identify matching entries. A lookup file with a list of packages needs to be uploaded first. Example: |PackageName|Version| |---|---| |Package|1.0.0|
Packages in Container Images - Match Lookup File
Parses packages from ImageVulnerabilityEvents and cross-references it with a lookup file to identify matching entries. A lookup file with a list of packages needs to be uploaded first. Example: |PackageName|Version| |---|---| |Package|1.0.0|
Packages in Container Images - Match Parameter
Searches packages using the provided parameter and returns the corresponding image repository.
Packages in Container Images - Match Parameter
Searches packages using the provided parameter and returns the corresponding image repository.
Packed Binary Detected
This query hunts for packed executable files written to disk on CrowdStrike Falcon monitored endpoints, classifies them by risk based on write location, and groups results by computer to identify the most affected/suspicious hosts. This query hunts for packed executable files written to disk on CrowdStrike Falcon monitored endpoints, classifies them by risk based on write location, and groups results by computer to identify the most affected/suspicious hosts.
Password Spray Many Users from Same IP Microsoft Defender for Identity
Detects multiple authentication failures across several user accounts originating from a single IP address, as identified by Microsoft Defender for Identity. This pattern is indicative of a password spraying attack where an attacker attempts common passwords against multiple users to gain unauthorized access. Detects multiple authentication failures across several user accounts originating from a single IP address, as identified by Microsoft Defender for Identity. This pattern is indicative of a password spraying attack where an attacker attempts common passwords against multiple users to gain unauthorized access.