EXPLORE DETECTIONS
Rust Build Toolchain Spawning Interpreter or Downloader
Detects Rust build tools spawning command interpreters or download utilities, a behavior associated with malicious dependency and build-script execution. This query hunts for unusual child processes created by the Rust build toolchain. It is behavior-based and does not depend on package names, file hashes, domains, or other campaign-specific indicators. Source: [Rust Build-Toolchain Supply-Chain HuntPack](https://slapopotamus.github.io/HuntPack/hunts/Arrayref-RustCrate-SupplyChain-Hunt.html). 1. **Select process creation telemetry**: `#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/` - Searches standard Falcon process events across supported endpoint platforms. 2. **Identify Rust build parents**: `in(ParentBaseFileName, values=["cargo.exe","cargo","rustc.exe","rustc"], ignoreCase=true)` - Restricts results to child processes launched directly by Cargo or the Rust compiler. 3. **Select interpreters and download utilities**: `in(FileName, values=[...], ignoreCase=true)` - Finds shells, scripting engines, and transfer utilities that can execute build scripts or retrieve additional content. 4. **Return investigation context**: `table(...)` and `sort(...)` - Presents the host, user, parent, child, and command lines with the newest events first. **False positives and tuning:** Rust projects can legitimately use `build.rs`, CI wrappers, or vendoring scripts that invoke shells and download tools. Baseline approved build hosts and exclude only known build wrappers, internal artifact mirrors, and reviewed command lines. **Limitations:** This query identifies suspicious build-tool behavior, not a confirmed supply-chain compromise. It only captures direct child processes; an additional wrapper process between the Rust tool and the interpreter may require a separate ancestry-based hunt.
SAMR Burst (BloodHound/PowerView)
Detects abnormal or high‑volume Security Account Manager (SAMR) queries against Active Directory, often associated with tools like BloodHound or PowerView. This behavior typically indicates reconnaissance activity where an attacker is rapidly enumerating users, groups, and permissions to map the environment. This query detects potential Active Directory enumeration by identifying users and source addresses that perform a high volume of SAMR (Security Account Manager Remote) queries against multiple destinations. It flags accounts that exceed 100 SAMR queries within a 10-minute window, which is a common indicator of tools like BloodHound or net.exe being used to enumerate AD objects
Search for oldest devices
A query to get the age of devices that have the falcon sensor installed.
Search for oldest devices
A query to get the age of devices that have the falcon sensor installed.
Security Group Created (Microsoft Defender for Identity)
Detects the creation of a new security group in Active Directory as identified by Microsoft Defender for Identity. While often legitimate, this activity may indicate preparation for privilege escalation or unauthorized access management and should be reviewed. Detects the creation of a new security group in Active Directory as identified by Microsoft Defender for Identity. While often legitimate, this activity may indicate preparation for privilege escalation or unauthorized access management and should be reviewed.
Sensor Version Adoption Trend
Visualizes the daily distribution of Sensor versions across the environment. It groups versions by Major and Minor releases (e.g., 6.45) to monitor the rollout of updates and identify legacy versions.
Sensor Version Adoption Trend
Visualizes the daily distribution of Sensor versions across the environment. It groups versions by Major and Minor releases (e.g., 6.45) to monitor the rollout of updates and identify legacy versions.
Shadow MCP Server Activity via Common Runtime Interpreters
Identifies potential shadow Model Context Protocol (MCP) server activity by detecting common runtime interpreters (e.g., Node.js, Python, NPX, UV/UVX, Docker) executing MCP-related commands. This query helps uncover unauthorized or unapproved MCP server usage across endpoints. ## Overview This query is designed to identify potential **shadow MCP (Model Context Protocol) server activity** within an environment. It focuses on detecting execution patterns associated with MCP servers that are launched through common development runtimes rather than traditional installed services. ## Detection Strategy MCP servers are typically not deployed as standalone executables. Instead, they are often started dynamically using interpreters or package runners such as: - `node` / `npx` - `python` / `python3` - `uv` / `uvx` - `docker` To detect this behavior, the query: 1. Filters **process execution events** (`ProcessRollup2`) for known runtime binaries. 2. Inspects the **command line arguments** for MCP-related keywords and known server packages: - `modelcontext`, `mcp` - `server-filesystem`, `server-github`, `server-postgres`, `server-sqlite` - `server-puppeteer`, `server-brave` 3. Aggregates results by asset, user, and command line to provide visibility into: - Where MCP activity occurred - Who executed it - When it was first and last observed ## Security Relevance This detection is particularly useful for identifying: - **Shadow IT / Shadow AI usage** - Unauthorized MCP servers exposing internal data sources - Developer-driven tool usage outside approved architectures - Potential data exfiltration paths via AI tooling integrations Because MCP servers can run over `stdio` or ephemeral processes, they may not expose traditional network indicators. As a result, **process execution telemetry is the most reliable detection point**. ## MITRE ATT&CK Mapping - **T1059 – Command and Scripting Interpreter** - **T1059.006 – Command and Scripting Interpreter: Python (when applicable)** ## Limitations - May generate false positives from legitimate development activity - Does not confirm whether an MCP server is currently active (historical execution only) - Detection depends on visibility into process command line arguments ## Recommended Follow-Up - Validate the executing user and asset role (developer vs production system)
SMB Enumeration | Defender for Identity
This detection query will detect SMB Enumeration based on the Microsoft defender for Identity Module
SMB Enumeration | Defender for Identity
This detection query will detect SMB Enumeration based on the Microsoft defender for Identity Module
SMB File Copy to Multiple Devices (Microsoft Defender for Identity)
Detects instances where files are copied over SMB to multiple devices within a short timeframe, as identified by Microsoft Defender for Identity. This behavior may indicate lateral movement where an attacker distributes tools or payloads across systems to expand access and establish control. Detects instances where files are copied over SMB to multiple devices within a short timeframe, as identified by Microsoft Defender for Identity. This behavior may indicate lateral movement where an attacker distributes tools or payloads across systems to expand access and establish control.
Snowman
This query detects potential exploitation of the April 2026 Adobe Reader zero-day vulnerability by identifying suspicious network connections originating from Adobe Reader processes shortly after they start. The exploit abuses legitimate Adobe JavaScript APIs (util.readFileIntoStream() and RSS.addFeed()) to exfiltrate system information to attacker-controlled servers. # How it works The query operates in two stages, joined together: ## Stage 1 — Process Detection Searches for ProcessRollup2 events (process executions) where the image file name matches any of the three Adobe Reader binaries: Acrobat.exe (modern), AcroRd32.exe (legacy 32-bit), or AcroRd64.exe (64-bit). It captures the process ID and start time for correlation. ## Stage 2 — Network Connection Correlation Joins against NetworkConnectIP4 and NetworkConnectIP6 events to find outbound network connections made by Adobe Reader or its known helper processes (AdobeCollabSync.exe, Synchronizer.exe). The join matches on process ID so connections are attributed to the correct Adobe session. ## Filtering - Connections to ports 80 and 443 are excluded — these are normal Adobe update/cloud traffic and would generate excessive false positives. - Only connections occurring within 60 seconds of the process starting are retained, since the exploit initiates C2 communication shortly after the PDF is opened. ## Confidence Scoring Results are triaged into three tiers: #### HIGH: Connection to a known C2 IP (169.40.2.68 or 188.214.34.20) #### MEDIUM Connection to a known C2 port (45191 or 34123) on any IP #### LOW Any other non-HTTP/S outbound connection from Adobe within the time window
SOC Efficiency Metrics
Summarizes CrowdStrike Falcon detections across hosts, showing key lifecycle metrics such as tactic, technique, severity, detection state, and resolution time. Useful for SOC performance tracking, identifying detection patterns, and monitoring time-to-close for incidents.
SOC Efficiency Metrics
Summarizes CrowdStrike Falcon detections across hosts, showing key lifecycle metrics such as tactic, technique, severity, detection state, and resolution time. Useful for SOC performance tracking, identifying detection patterns, and monitoring time-to-close for incidents.
Suspicious DLL / Module loads
This query will show all the suspicious DLL/module loads that CrowdStrike has flagged as detections, where all the endpoint are involved, along with the process and parent process details This query will show all the suspicious DLL/module loads that CrowdStrike has flagged as detections, where all the endpoint are involved, along with the process and parent process details
Suspicious PowerShell Execution
This query identifies suspicious PowerShell execution patterns, including encoded commands and unusual parent processes, which could indicate malicious activity. This query uses CrowdStrike Query Language (CQL) to detect suspicious PowerShell activity: 1. **Event Filtering**: `#event_simpleName=ProcessRollup2 ImageFileName=/\\powershell\\.exe/i` - Searches ProcessRollup2 events for any PowerShell executable (case-insensitive) 2. **Command Line Analysis**: `CommandLine=/\s-[eE^]{1,2}[nN][cC][oO][dD][eE][mM][aA][nN][dD^]+\s/i` - Uses regex to find encoded command parameters (-EncodedCommand, -enc, etc.) 3. **User Context**: `join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])` - Enriches results with username information 4. **Output**: `table([aid, UserName, ParentImageFileName, ImageFileName, CommandLine])` - Displays key fields for analysis
Suspicious PowerShell Execution
This query identifies suspicious PowerShell execution patterns, including encoded commands and unusual parent processes, which could indicate malicious activity. This query uses CrowdStrike Query Language (CQL) to detect suspicious PowerShell activity: 1. **Event Filtering**: `#event_simpleName=ProcessRollup2 ImageFileName=/\\powershell\\.exe/i` - Searches ProcessRollup2 events for any PowerShell executable (case-insensitive) 2. **Command Line Analysis**: `CommandLine=/\s-[eE^]{1,2}[nN][cC][oO][dD][eE][mM][aA][nN][dD^]+\s/i` - Uses regex to find encoded command parameters (-EncodedCommand, -enc, etc.) 3. **User Context**: `join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])` - Enriches results with username information 4. **Output**: `table([aid, UserName, ParentImageFileName, ImageFileName, CommandLine])` - Displays key fields for analysis
Suspicious Registry Modifications
This query detects suspicious registry modifications that could indicate persistence mechanisms or system configuration tampering by attackers. This query uses CrowdStrike Query Language (CQL) to detect suspicious registry modifications: 1. **Event Filtering**: `#event_simpleName=RegGenericValue` - Searches for registry value modification events 2. **High-Risk Keys**: `RegObjectName=/\\(Run|RunOnce|Winlogon|AppInit_DLLs|Image File Execution Options)/i` - Focuses on common persistence and execution registry locations 3. **Exclude Legitimate**: `RegValueName!=/^(ctfmon|SecurityHealth|OneDrive)$/i` - Filters out known legitimate applications 4. **User Context**: `join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])` - Enriches results with username information 5. **Output**: `table([aid, UserName, RegObjectName, RegValueName, RegStringValue, ProcessImageFileName])` - Displays registry path, value, and modifying process
Suspicious Registry Modifications
This query detects suspicious registry modifications that could indicate persistence mechanisms or system configuration tampering by attackers. This query uses CrowdStrike Query Language (CQL) to detect suspicious registry modifications: 1. **Event Filtering**: `#event_simpleName=RegGenericValue` - Searches for registry value modification events 2. **High-Risk Keys**: `RegObjectName=/\\(Run|RunOnce|Winlogon|AppInit_DLLs|Image File Execution Options)/i` - Focuses on common persistence and execution registry locations 3. **Exclude Legitimate**: `RegValueName!=/^(ctfmon|SecurityHealth|OneDrive)$/i` - Filters out known legitimate applications 4. **User Context**: `join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])` - Enriches results with username information 5. **Output**: `table([aid, UserName, RegObjectName, RegValueName, RegStringValue, ProcessImageFileName])` - Displays registry path, value, and modifying process
Suspicious Scheduled Task Creation
Surfaces newly registered Windows scheduled tasks whose execution command or arguments match patterns commonly abused for persistence and remote code execution: encoded PowerShell combined with download/exec intent, LOLBin proxy execution, payloads launched from user-writable paths, embedded web URLs, and chained cmd one-liners. Tasks created remotely (RemoteAddressIP4/IP6 populated) are flagged as a higher-priority lateral-movement signal. A commented author filter lets analysts suppress their own validated software-deployment / RMM accounts after baselining. ## Detection Logic The query inspects every newly registered task (`ScheduledTaskRegistered`), combines `TaskExecCommand` and `TaskExecArguments` into one string, and classifies it against five high-signal patterns: | Reason | What it catches | | :--- | :--- | | Encoded PowerShell w/ download or exec intent | `-EncodedCommand` **combined with** a download cradle, `IEX`, `FromBase64String`, or hidden window | | LOLBin proxy execution | `mshta`, `rundll32`, `regsvr32`, `certutil`, `bitsadmin`, `installutil`, script hosts | | Payload in user-writable/temp path | Actions running from `AppData`, `Temp`, `Windows\Temp`, `Users\Public` | | Web URL in task action | HTTP/FTP URL embedded directly in the action | | Chained cmd one-liner | `cmd /c` with `&&` or pipe chaining | Tasks matching none of these are dropped. The encoded-PowerShell rule deliberately requires a **second** signal, because legitimate monitoring and management tools (e.g. update sensors) routinely use `-EncodedCommand` on its own; encoding alone is not an indicator. ## The Remote-Creation Signal When `RemoteAddressIP4` or `RemoteAddressIP6` is populated, the task was registered from another host rather than locally. Legitimate task creation is overwhelmingly local, so a **REMOTE** origin layered on top of any suspicious pattern should be triaged first. ## Tuning - To suppress recurring known-good automation after establishing your benign baseline, add an explicit author filter in the query body (see the commented line), e.g. `| TaskAuthor!=/sccm-svc|rmm-deploy/i`. ## Limitations & False Positives (read before relying on this) - **User-scope auto-updaters.** Consumer apps such as Zoom, Teams, and Slack legitimately register per-user tasks that run from `AppData`. Expect a thin, steady stream of these on the "user-writable/temp path" rule. Validate the binary's signer and the task author before dismissing - the *same* rule is what catches a malicious binary auto-running from `AppData`, so do not remove it to silence the updaters. - **TaskAuthor is spoofable.** `TaskAuthor` is a free-text field in the task XML and can be set to any value by whoever creates the task. Do not treat it as trustworthy, and be aware that any author-based exclusion you configure is an evasion path: an adversary who mimics an excluded author bypasses that filter. - **Evasion surface.** This detection inspects task *content at registration time*. An adversary who stages payloads outside the flagged paths, avoids the listed LOLBins, or splits encoding from execution intent can evade it. - **Coverage trade-off.** To keep noise low, bare `-EncodedCommand` (without a second signal) and UNC-path actions are intentionally **not** flagged. A real attack using only those techniques in isolation would not surface here.
Systems Initiating Connections to a High Number of Ports
Detects hosts that establish network connections across a large number of unique ports within a given period. This behavior may indicate port scanning, network reconnaissance, or potentially malicious enumeration activity originating from a compromised host or unauthorized tool. The query aggregates by host and process, listing associated filenames, command lines, and user context to assist with triage.
Systems Initiating Connections to a High Number of Ports
Detects hosts that establish network connections across a large number of unique ports within a given period. This behavior may indicate port scanning, network reconnaissance, or potentially malicious enumeration activity originating from a compromised host or unauthorized tool. The query aggregates by host and process, listing associated filenames, command lines, and user context to assist with triage.
The Gentlemen RaaS - Custom Backdoors and Evolving Tactics
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing. Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing. Reference: https://securelist.com/the-gentlemen-raas/120447/
Torrent Website Access Detected
Detects users successfully accessing peer-to-peer (P2P) or torrent websites through the network where the Palo Alto firewall generated an alert but did not block the traffic.