EXPLORE DETECTIONS
Ransomware Precursors
Detects command patterns that ransomware operators execute immediately before encryption to prevent recovery: Volume Shadow Copy deletion (vssadmin, WMIC, PowerShell WMI/CIM), backup catalog destruction (wbadmin), Windows Recovery Environment tampering (bcdedit), USN journal deletion (fsutil), and mass shadow storage resizing. Each event is classified into a named hypothesis so analysts can triage by technique. These commands are rare in legitimate day-to-day operation and their appearance - especially several within a short window on the same host - is one of the strongest early-warning signals of an imminent ransomware detonation. ## Why this matters Before deploying an encryptor, virtually every major ransomware family (LockBit, BlackCat/ALPHV, Akira, Conti descendants, Ryuk, and others) runs a near-identical "recovery inhibition" playbook so victims cannot restore from local snapshots or backups. Because these commands are executed **minutes before encryption begins**, detecting them provides one of the last actionable intervention windows in a ransomware intrusion. ## Detection hypotheses | Hypothesis | Command pattern | Notes | | :--- | :--- | :--- | | H1 | `vssadmin delete shadows /all /quiet` | The single most common ransomware precursor | | H2 | `vssadmin resize shadowstorage /maxsize=401MB` | Forces Windows to silently purge shadow copies; used to evade "delete shadows" detections | | H3 | `wmic shadowcopy delete` | WMIC-based variant | | H4 | PowerShell `Win32_ShadowCopy` / `Get-CimInstance ... \| Remove` | Script-based variant | | H5 | `wbadmin delete catalog -quiet` | Destroys the Windows Backup catalog | | H6 | `bcdedit /set {default} recoveryenabled no` + `bootstatuspolicy ignoreallfailures` | Prevents booting into WinRE for repair/restore | | H7 | `fsutil usn deletejournal /D C:` | Anti-forensics; wipes the NTFS change journal | ## Triage guidance - **`Priority = CRITICAL`** (2+ distinct techniques on one host): treat as active ransomware staging. Network-contain the host immediately and pivot on `ParentBaseFileName` and sibling processes. - **Single H1/H3/H5/H6 events**: still high-signal. Legitimate occurrences are rare and usually tied to storage administration or imaging/backup software - check the parent process and the executing user. - **Known false-positive sources**: backup agents (Veeam, Commvault), disk-cloning tools, and some VDI provisioning workflows may resize shadow storage (H2) or manage snapshots. Baseline these and add an exclusion on `ParentBaseFileName` or `UserName` rather than removing the hypothesis.
Rare Remote Ports in Network Connections
The query analyzes IPv4 network connection events, counts occurrences per remote port, calculates their percentage of total connections, and lists only ports representing less than 10% of the traffic. Reference: [GitHub CrowdStrike/logscale-community](https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Bottom%2010%25%20of%20NetworkConnct%20Port%20Values.md)
Rare Remote Ports in Network Connections
The query analyzes IPv4 network connection events, counts occurrences per remote port, calculates their percentage of total connections, and lists only ports representing less than 10% of the traffic. Reference: [GitHub CrowdStrike/logscale-community](https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Bottom%2010%25%20of%20NetworkConnct%20Port%20Values.md)
Rare windows shell parent process
This hunting query is designed to detect rare shell parent processes. This hunting query is designed to detect rare shell parent processes: 1. **Filter for Windows Events**: `#event_simpleName=ProcessRollup2``event_platform=Win` 2. **Classify Processes**: `(case { in(field=FileName, values=["powershell.exe", "cmd.exe", "pwsh.exe"]) | IsChild := "1";)` - If the FileName matches a shell (powershell.exe, cmd.exe, pwsh.exe), the process is marked as a child process - Otherwise, it is marked as not a child process 3. **Assign Process Information**: `ParentImageFileName!=/\\(powershell|cmd)\.exe$/i` - For child processes (`IsChild = "1"`), the `ProcId` is set to the `ParentProcessId` - For non-child processes (`IsChild = "0"`), the `ProcId` is set to the `TargetProcessId` 4. **Group by Computer and Process**: - The query groups events by `ComputerName` and `ProcId` to analyze process relationships. - Calculation of the distinct count of `ParentProcessId` as `EventCount`
Rare windows shell parent process
This hunting query is designed to detect rare shell parent processes. This hunting query is designed to detect rare shell parent processes: 1. **Filter for Windows Events**: `#event_simpleName=ProcessRollup2``event_platform=Win` 2. **Classify Processes**: `(case { in(field=FileName, values=["powershell.exe", "cmd.exe", "pwsh.exe"]) | IsChild := "1";)` - If the FileName matches a shell (powershell.exe, cmd.exe, pwsh.exe), the process is marked as a child process - Otherwise, it is marked as not a child process 3. **Assign Process Information**: `ParentImageFileName!=/\\(powershell|cmd)\.exe$/i` - For child processes (`IsChild = "1"`), the `ProcId` is set to the `ParentProcessId` - For non-child processes (`IsChild = "0"`), the `ProcId` is set to the `TargetProcessId` 4. **Group by Computer and Process**: - The query groups events by `ComputerName` and `ProcId` to analyze process relationships. - Calculation of the distinct count of `ParentProcessId` as `EventCount`
Recent RTR Sessions
List of the recent Real Time Response sessions that were started.
Recent RTR Sessions
List of the recent Real Time Response sessions that were started.
Remediation - Host Contained
This query lists all isolated devices and identifies who initiated the isolation.
Remediation - Host Contained
This query lists all isolated devices and identifies who initiated the isolation.
Remote Interactive Logons (RDP)
Identifies remote interactive logons on a specific endpoint. The query filters UserIdentity events for LogonType=10, which typically indicates Remote Desktop or similar remote access sessions. Results are scoped by the provided aid and display up to 1,000 events, including timestamp, username, user principal, and the logon server. Useful for detecting and reviewing remote access activity during investigations or routine monitoring. **Use Cases** - Review RDP usage on a host - Investigate potential unauthorized remote access - Support incident response and access audits LogonType=10 corresponds to remote interactive logons. The aid parameter must be set to the target endpoint.
Remote Interactive Logons (RDP)
Identifies remote interactive logons on a specific endpoint. The query filters UserIdentity events for LogonType=10, which typically indicates Remote Desktop or similar remote access sessions. Results are scoped by the provided aid and display up to 1,000 events, including timestamp, username, user principal, and the logon server. Useful for detecting and reviewing remote access activity during investigations or routine monitoring. **Use Cases** - Review RDP usage on a host - Investigate potential unauthorized remote access - Support incident response and access audits LogonType=10 corresponds to remote interactive logons. The aid parameter must be set to the target endpoint.
Remote Port Forwarding via Plink - Unauthorized RDP Tunneling Detection
Detects the use of Plink (PuTTY Link) to establish remote port forwarding tunnels, specifically targeting traffic redirected to port 3389 (RDP). This technique is frequently used by threat actors for lateral movement or to bypass firewall restrictions by tunneling RDP over SSH. Attackers use `plink.exe` the command-line SSH client from PuTTY to create encrypted SSH tunnels that forward RDP traffic (port 3389) through firewall boundaries. This allows an attacker with an existing foothold to RDP into internal systems even when direct RDP is blocked. ## Forwarding Flags * **-R (Remote Forward):** Attacker binds a port on their server and pulls traffic back to an internal RDP target. * **-L (Local Forward):** Victim machine forwards a local port outbound to an RDP target via the SSH server. ## Why It's Dangerous Because the tunnel rides over SSH (typically port 22 or 443), it blends with legitimate encrypted traffic and often bypasses firewall and DLP controls. The resulting RDP session appears to originate from inside the network. ## Testing the Detection You can safely validate this detection on an enrolled endpoint without establishing an actual tunnel. The connection will fail immediately, but the EDR will still capture the `ProcessRollup2` event. ### 1. Download and Execute (PowerShell) ```powershell Invoke-WebRequest -Uri "[https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe](https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe)" -OutFile "$env:TEMP\plink.exe" # Test -R (remote forward) & "$env:TEMP\plink.exe" -R 4444:localhost:3389 user@192.168.1.1 # Test -L (local forward) & "$env:TEMP\plink.exe" -L 4444:localhost:3389 user@192.168.1.1
Remote Port Forwarding via Plink - Unauthorized RDP Tunneling Detection
Detects the use of Plink (PuTTY Link) to establish remote port forwarding tunnels, specifically targeting traffic redirected to port 3389 (RDP). This technique is frequently used by threat actors for lateral movement or to bypass firewall restrictions by tunneling RDP over SSH. Attackers use `plink.exe` the command-line SSH client from PuTTY to create encrypted SSH tunnels that forward RDP traffic (port 3389) through firewall boundaries. This allows an attacker with an existing foothold to RDP into internal systems even when direct RDP is blocked. ## Forwarding Flags * **-R (Remote Forward):** Attacker binds a port on their server and pulls traffic back to an internal RDP target. * **-L (Local Forward):** Victim machine forwards a local port outbound to an RDP target via the SSH server. ## Why It's Dangerous Because the tunnel rides over SSH (typically port 22 or 443), it blends with legitimate encrypted traffic and often bypasses firewall and DLP controls. The resulting RDP session appears to originate from inside the network. ## Testing the Detection You can safely validate this detection on an enrolled endpoint without establishing an actual tunnel. The connection will fail immediately, but the EDR will still capture the `ProcessRollup2` event. ### 1. Download and Execute (PowerShell) ```powershell Invoke-WebRequest -Uri "[https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe](https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe)" -OutFile "$env:TEMP\plink.exe" # Test -R (remote forward) & "$env:TEMP\plink.exe" -R 4444:localhost:3389 user@192.168.1.1 # Test -L (local forward) & "$env:TEMP\plink.exe" -L 4444:localhost:3389 user@192.168.1.1
ROKRAT Malware APT 37
RoKRAT Malware – Injection & Steganography 🛠 High‑Level TTPs - Initial Access: Malicious .lnk files within compressed archives. - Execution & Persistence: PowerShell/BAT‑driven staged loaders with XOR decryption. Defense Evasion: Process injection into trusted Windows binaries & payload concealment via steganography. - Command & Control: Abuse of pCloud, Yandex Disk, and Dropbox APIs with embedded tokens to blend with legitimate traffic. [Genians Blog - RoKRAT Shellcode and Steganographic Threats: Analysis and EDR Response Strategies](https://www.genians.co.kr/en/blog/threat_intelligence/rokrat_shellcode_steganographic) Reference: [GitHub Aamir-Muhammad/CrowdStrike-Queries](https://github.com/Aamir-Muhammad/CrowdStrike-Queries/blob/main/Hunting-Queries/ROKRAT-Malware-APT-37.md)
ROKRAT Malware APT 37
RoKRAT Malware – Injection & Steganography 🛠 High‑Level TTPs - Initial Access: Malicious .lnk files within compressed archives. - Execution & Persistence: PowerShell/BAT‑driven staged loaders with XOR decryption. Defense Evasion: Process injection into trusted Windows binaries & payload concealment via steganography. - Command & Control: Abuse of pCloud, Yandex Disk, and Dropbox APIs with embedded tokens to blend with legitimate traffic. [Genians Blog - RoKRAT Shellcode and Steganographic Threats: Analysis and EDR Response Strategies](https://www.genians.co.kr/en/blog/threat_intelligence/rokrat_shellcode_steganographic) Reference: [GitHub Aamir-Muhammad/CrowdStrike-Queries](https://github.com/Aamir-Muhammad/CrowdStrike-Queries/blob/main/Hunting-Queries/ROKRAT-Malware-APT-37.md)
Rundll32 Remote UNC DLL Ordinal Execution
Detects rundll32 loading a DLL from a remote UNC path and invoking an export by ordinal, a proxy-execution pattern used to run remote code. This query detects a low-frequency signed-binary proxy-execution pattern in which `rundll32.exe` loads a DLL from a remote UNC path and invokes an export by ordinal. Source: [EtherHiding ClickFix HuntPack](https://slapopotamus.github.io/HuntPack/hunts/EtherHiding-ClickFix-Hunt.html). 1. **Select process creation telemetry**: `#event_simpleName=ProcessRollup2` - Searches Falcon process events for executed programs and their command lines. 2. **Identify rundll32 execution**: `FileName=/^rundll32(\.exe)?$/i` - Restricts results to the Windows signed binary used to load and execute DLL exports. 3. **Require a remote UNC path**: `CommandLine=/\\\\[a-z0-9._\-]+(@[a-z0-9]+)*\\/i` - Finds command lines that reference a DLL or share hosted on a remote system. The optional `@…` group also matches WebDAV-style hosts such as `\\host@80\` and `\\host@SSL\`, which are how the ClickFix/GULoader variants deliver the DLL. 4. **Require ordinal-based invocation**: `CommandLine=/,#[0-9]+/i` - Selects rundll32 command lines that invoke an export by numeric ordinal rather than by name. 5. **Return investigation context**: `table(...)` and `sort(...)` - Presents the host, user, parent process, and complete command line with the newest events first. **False positives and tuning:** Some enterprise deployment systems legitimately load DLLs from network shares. Validate the remote host, share, parent process, file signature, and deployment change record before excluding activity. Limit exclusions to approved distribution hosts and reviewed command-line patterns. **Limitations:** The query identifies suspicious execution behavior, not a confirmed compromise. It requires command-line telemetry and only detects UNC paths written with a hostname or address after the leading double backslash (including WebDAV `@port` / `@SSL` forms). Paths built at runtime from environment variables or string concatenation are not visible in the command line and will not match.
Rust Build Toolchain Spawning Interpreter or Downloader
Detects Rust build tools spawning command interpreters or download utilities, a behavior associated with malicious dependency and build-script execution. This query hunts for unusual child processes created by the Rust build toolchain. It is behavior-based and does not depend on package names, file hashes, domains, or other campaign-specific indicators. Source: [Rust Build-Toolchain Supply-Chain HuntPack](https://slapopotamus.github.io/HuntPack/hunts/Arrayref-RustCrate-SupplyChain-Hunt.html). 1. **Select process creation telemetry**: `#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/` - Searches standard Falcon process events across supported endpoint platforms. 2. **Identify Rust build parents**: `in(ParentBaseFileName, values=["cargo.exe","cargo","rustc.exe","rustc"], ignoreCase=true)` - Restricts results to child processes launched directly by Cargo or the Rust compiler. 3. **Select interpreters and download utilities**: `in(FileName, values=[...], ignoreCase=true)` - Finds shells, scripting engines, and transfer utilities that can execute build scripts or retrieve additional content. 4. **Return investigation context**: `table(...)` and `sort(...)` - Presents the host, user, parent, child, and command lines with the newest events first. **False positives and tuning:** Rust projects can legitimately use `build.rs`, CI wrappers, or vendoring scripts that invoke shells and download tools. Baseline approved build hosts and exclude only known build wrappers, internal artifact mirrors, and reviewed command lines. **Limitations:** This query identifies suspicious build-tool behavior, not a confirmed supply-chain compromise. It only captures direct child processes; an additional wrapper process between the Rust tool and the interpreter may require a separate ancestry-based hunt.
SAMR Burst (BloodHound/PowerView)
Detects abnormal or high‑volume Security Account Manager (SAMR) queries against Active Directory, often associated with tools like BloodHound or PowerView. This behavior typically indicates reconnaissance activity where an attacker is rapidly enumerating users, groups, and permissions to map the environment. This query detects potential Active Directory enumeration by identifying users and source addresses that perform a high volume of SAMR (Security Account Manager Remote) queries against multiple destinations. It flags accounts that exceed 100 SAMR queries within a 10-minute window, which is a common indicator of tools like BloodHound or net.exe being used to enumerate AD objects
Search for oldest devices
A query to get the age of devices that have the falcon sensor installed.
Search for oldest devices
A query to get the age of devices that have the falcon sensor installed.
Security Group Created (Microsoft Defender for Identity)
Detects the creation of a new security group in Active Directory as identified by Microsoft Defender for Identity. While often legitimate, this activity may indicate preparation for privilege escalation or unauthorized access management and should be reviewed. Detects the creation of a new security group in Active Directory as identified by Microsoft Defender for Identity. While often legitimate, this activity may indicate preparation for privilege escalation or unauthorized access management and should be reviewed.
Sensor Version Adoption Trend
Visualizes the daily distribution of Sensor versions across the environment. It groups versions by Major and Minor releases (e.g., 6.45) to monitor the rollout of updates and identify legacy versions.
Sensor Version Adoption Trend
Visualizes the daily distribution of Sensor versions across the environment. It groups versions by Major and Minor releases (e.g., 6.45) to monitor the rollout of updates and identify legacy versions.
Shadow MCP Server Activity via Common Runtime Interpreters
Identifies potential shadow Model Context Protocol (MCP) server activity by detecting common runtime interpreters (e.g., Node.js, Python, NPX, UV/UVX, Docker) executing MCP-related commands. This query helps uncover unauthorized or unapproved MCP server usage across endpoints. ## Overview This query is designed to identify potential **shadow MCP (Model Context Protocol) server activity** within an environment. It focuses on detecting execution patterns associated with MCP servers that are launched through common development runtimes rather than traditional installed services. ## Detection Strategy MCP servers are typically not deployed as standalone executables. Instead, they are often started dynamically using interpreters or package runners such as: - `node` / `npx` - `python` / `python3` - `uv` / `uvx` - `docker` To detect this behavior, the query: 1. Filters **process execution events** (`ProcessRollup2`) for known runtime binaries. 2. Inspects the **command line arguments** for MCP-related keywords and known server packages: - `modelcontext`, `mcp` - `server-filesystem`, `server-github`, `server-postgres`, `server-sqlite` - `server-puppeteer`, `server-brave` 3. Aggregates results by asset, user, and command line to provide visibility into: - Where MCP activity occurred - Who executed it - When it was first and last observed ## Security Relevance This detection is particularly useful for identifying: - **Shadow IT / Shadow AI usage** - Unauthorized MCP servers exposing internal data sources - Developer-driven tool usage outside approved architectures - Potential data exfiltration paths via AI tooling integrations Because MCP servers can run over `stdio` or ephemeral processes, they may not expose traditional network indicators. As a result, **process execution telemetry is the most reliable detection point**. ## MITRE ATT&CK Mapping - **T1059 – Command and Scripting Interpreter** - **T1059.006 – Command and Scripting Interpreter: Python (when applicable)** ## Limitations - May generate false positives from legitimate development activity - Does not confirm whether an MCP server is currently active (historical execution only) - Detection depends on visibility into process command line arguments ## Recommended Follow-Up - Validate the executing user and asset role (developer vs production system)