EXPLORE DETECTIONS
SMB Enumeration | Defender for Identity
This detection query will detect SMB Enumeration based on the Microsoft defender for Identity Module
SMB Enumeration | Defender for Identity
This detection query will detect SMB Enumeration based on the Microsoft defender for Identity Module
SMB File Copy to Multiple Devices (Microsoft Defender for Identity)
Detects instances where files are copied over SMB to multiple devices within a short timeframe, as identified by Microsoft Defender for Identity. This behavior may indicate lateral movement where an attacker distributes tools or payloads across systems to expand access and establish control. Detects instances where files are copied over SMB to multiple devices within a short timeframe, as identified by Microsoft Defender for Identity. This behavior may indicate lateral movement where an attacker distributes tools or payloads across systems to expand access and establish control.
Snowman
This query detects potential exploitation of the April 2026 Adobe Reader zero-day vulnerability by identifying suspicious network connections originating from Adobe Reader processes shortly after they start. The exploit abuses legitimate Adobe JavaScript APIs (util.readFileIntoStream() and RSS.addFeed()) to exfiltrate system information to attacker-controlled servers. # How it works The query operates in two stages, joined together: ## Stage 1 — Process Detection Searches for ProcessRollup2 events (process executions) where the image file name matches any of the three Adobe Reader binaries: Acrobat.exe (modern), AcroRd32.exe (legacy 32-bit), or AcroRd64.exe (64-bit). It captures the process ID and start time for correlation. ## Stage 2 — Network Connection Correlation Joins against NetworkConnectIP4 and NetworkConnectIP6 events to find outbound network connections made by Adobe Reader or its known helper processes (AdobeCollabSync.exe, Synchronizer.exe). The join matches on process ID so connections are attributed to the correct Adobe session. ## Filtering - Connections to ports 80 and 443 are excluded — these are normal Adobe update/cloud traffic and would generate excessive false positives. - Only connections occurring within 60 seconds of the process starting are retained, since the exploit initiates C2 communication shortly after the PDF is opened. ## Confidence Scoring Results are triaged into three tiers: #### HIGH: Connection to a known C2 IP (169.40.2.68 or 188.214.34.20) #### MEDIUM Connection to a known C2 port (45191 or 34123) on any IP #### LOW Any other non-HTTP/S outbound connection from Adobe within the time window
SOC Efficiency Metrics
Summarizes CrowdStrike Falcon detections across hosts, showing key lifecycle metrics such as tactic, technique, severity, detection state, and resolution time. Useful for SOC performance tracking, identifying detection patterns, and monitoring time-to-close for incidents.
SOC Efficiency Metrics
Summarizes CrowdStrike Falcon detections across hosts, showing key lifecycle metrics such as tactic, technique, severity, detection state, and resolution time. Useful for SOC performance tracking, identifying detection patterns, and monitoring time-to-close for incidents.
Suspicious DLL / Module loads
This query will show all the suspicious DLL/module loads that CrowdStrike has flagged as detections, where all the endpoint are involved, along with the process and parent process details This query will show all the suspicious DLL/module loads that CrowdStrike has flagged as detections, where all the endpoint are involved, along with the process and parent process details
Suspicious PowerShell Execution
This query identifies suspicious PowerShell execution patterns, including encoded commands and unusual parent processes, which could indicate malicious activity. This query uses CrowdStrike Query Language (CQL) to detect suspicious PowerShell activity: 1. **Event Filtering**: `#event_simpleName=ProcessRollup2 ImageFileName=/\\powershell\\.exe/i` - Searches ProcessRollup2 events for any PowerShell executable (case-insensitive) 2. **Command Line Analysis**: `CommandLine=/\s-[eE^]{1,2}[nN][cC][oO][dD][eE][mM][aA][nN][dD^]+\s/i` - Uses regex to find encoded command parameters (-EncodedCommand, -enc, etc.) 3. **User Context**: `join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])` - Enriches results with username information 4. **Output**: `table([aid, UserName, ParentImageFileName, ImageFileName, CommandLine])` - Displays key fields for analysis
Suspicious PowerShell Execution
This query identifies suspicious PowerShell execution patterns, including encoded commands and unusual parent processes, which could indicate malicious activity. This query uses CrowdStrike Query Language (CQL) to detect suspicious PowerShell activity: 1. **Event Filtering**: `#event_simpleName=ProcessRollup2 ImageFileName=/\\powershell\\.exe/i` - Searches ProcessRollup2 events for any PowerShell executable (case-insensitive) 2. **Command Line Analysis**: `CommandLine=/\s-[eE^]{1,2}[nN][cC][oO][dD][eE][mM][aA][nN][dD^]+\s/i` - Uses regex to find encoded command parameters (-EncodedCommand, -enc, etc.) 3. **User Context**: `join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])` - Enriches results with username information 4. **Output**: `table([aid, UserName, ParentImageFileName, ImageFileName, CommandLine])` - Displays key fields for analysis
Suspicious Registry Modifications
This query detects suspicious registry modifications that could indicate persistence mechanisms or system configuration tampering by attackers. This query uses CrowdStrike Query Language (CQL) to detect suspicious registry modifications: 1. **Event Filtering**: `#event_simpleName=RegGenericValue` - Searches for registry value modification events 2. **High-Risk Keys**: `RegObjectName=/\\(Run|RunOnce|Winlogon|AppInit_DLLs|Image File Execution Options)/i` - Focuses on common persistence and execution registry locations 3. **Exclude Legitimate**: `RegValueName!=/^(ctfmon|SecurityHealth|OneDrive)$/i` - Filters out known legitimate applications 4. **User Context**: `join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])` - Enriches results with username information 5. **Output**: `table([aid, UserName, RegObjectName, RegValueName, RegStringValue, ProcessImageFileName])` - Displays registry path, value, and modifying process
Suspicious Registry Modifications
This query detects suspicious registry modifications that could indicate persistence mechanisms or system configuration tampering by attackers. This query uses CrowdStrike Query Language (CQL) to detect suspicious registry modifications: 1. **Event Filtering**: `#event_simpleName=RegGenericValue` - Searches for registry value modification events 2. **High-Risk Keys**: `RegObjectName=/\\(Run|RunOnce|Winlogon|AppInit_DLLs|Image File Execution Options)/i` - Focuses on common persistence and execution registry locations 3. **Exclude Legitimate**: `RegValueName!=/^(ctfmon|SecurityHealth|OneDrive)$/i` - Filters out known legitimate applications 4. **User Context**: `join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])` - Enriches results with username information 5. **Output**: `table([aid, UserName, RegObjectName, RegValueName, RegStringValue, ProcessImageFileName])` - Displays registry path, value, and modifying process
Suspicious Scheduled Task Creation
Surfaces newly registered Windows scheduled tasks whose execution command or arguments match patterns commonly abused for persistence and remote code execution: encoded PowerShell combined with download/exec intent, LOLBin proxy execution, payloads launched from user-writable paths, embedded web URLs, and chained cmd one-liners. Tasks created remotely (RemoteAddressIP4/IP6 populated) are flagged as a higher-priority lateral-movement signal. A commented author filter lets analysts suppress their own validated software-deployment / RMM accounts after baselining. ## Detection Logic The query inspects every newly registered task (`ScheduledTaskRegistered`), combines `TaskExecCommand` and `TaskExecArguments` into one string, and classifies it against five high-signal patterns: | Reason | What it catches | | :--- | :--- | | Encoded PowerShell w/ download or exec intent | `-EncodedCommand` **combined with** a download cradle, `IEX`, `FromBase64String`, or hidden window | | LOLBin proxy execution | `mshta`, `rundll32`, `regsvr32`, `certutil`, `bitsadmin`, `installutil`, script hosts | | Payload in user-writable/temp path | Actions running from `AppData`, `Temp`, `Windows\Temp`, `Users\Public` | | Web URL in task action | HTTP/FTP URL embedded directly in the action | | Chained cmd one-liner | `cmd /c` with `&&` or pipe chaining | Tasks matching none of these are dropped. The encoded-PowerShell rule deliberately requires a **second** signal, because legitimate monitoring and management tools (e.g. update sensors) routinely use `-EncodedCommand` on its own; encoding alone is not an indicator. ## The Remote-Creation Signal When `RemoteAddressIP4` or `RemoteAddressIP6` is populated, the task was registered from another host rather than locally. Legitimate task creation is overwhelmingly local, so a **REMOTE** origin layered on top of any suspicious pattern should be triaged first. ## Tuning - To suppress recurring known-good automation after establishing your benign baseline, add an explicit author filter in the query body (see the commented line), e.g. `| TaskAuthor!=/sccm-svc|rmm-deploy/i`. ## Limitations & False Positives (read before relying on this) - **User-scope auto-updaters.** Consumer apps such as Zoom, Teams, and Slack legitimately register per-user tasks that run from `AppData`. Expect a thin, steady stream of these on the "user-writable/temp path" rule. Validate the binary's signer and the task author before dismissing - the *same* rule is what catches a malicious binary auto-running from `AppData`, so do not remove it to silence the updaters. - **TaskAuthor is spoofable.** `TaskAuthor` is a free-text field in the task XML and can be set to any value by whoever creates the task. Do not treat it as trustworthy, and be aware that any author-based exclusion you configure is an evasion path: an adversary who mimics an excluded author bypasses that filter. - **Evasion surface.** This detection inspects task *content at registration time*. An adversary who stages payloads outside the flagged paths, avoids the listed LOLBins, or splits encoding from execution intent can evade it. - **Coverage trade-off.** To keep noise low, bare `-EncodedCommand` (without a second signal) and UNC-path actions are intentionally **not** flagged. A real attack using only those techniques in isolation would not surface here.
Systems Initiating Connections to a High Number of Ports
Detects hosts that establish network connections across a large number of unique ports within a given period. This behavior may indicate port scanning, network reconnaissance, or potentially malicious enumeration activity originating from a compromised host or unauthorized tool. The query aggregates by host and process, listing associated filenames, command lines, and user context to assist with triage.
Systems Initiating Connections to a High Number of Ports
Detects hosts that establish network connections across a large number of unique ports within a given period. This behavior may indicate port scanning, network reconnaissance, or potentially malicious enumeration activity originating from a compromised host or unauthorized tool. The query aggregates by host and process, listing associated filenames, command lines, and user context to assist with triage.
The Gentlemen RaaS - Custom Backdoors and Evolving Tactics
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing. Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing. Reference: https://securelist.com/the-gentlemen-raas/120447/
Torrent Website Access Detected
Detects users successfully accessing peer-to-peer (P2P) or torrent websites through the network where the Palo Alto firewall generated an alert but did not block the traffic.
Unauthorized RMM Tool Usage
Detects the execution of Remote Monitoring & Management (RMM) and remote access tools such as AnyDesk, TeamViewer, ScreenConnect, Atera, Splashtop, RustDesk, and others. Threat actors increasingly abuse legitimate RMM software for initial access, persistence, and hands-on-keyboard activity because it blends in with normal IT operations.
User Logoff Activity
Table of all UserLogoff events including UserName, ComputerName, aip, LocalIP and Domain.
User Logoff Activity
Table of all UserLogoff events including UserName, ComputerName, aip, LocalIP and Domain.
User Logon Activity
Table of all user logons.
User Logon Activity
Table of all user logons.
User Logon Details (Time, Type, Location, Last Password Change)
This query will output a table including recent user logons with context information: - Timestamp - UserName - SID - LogonType - UserIsAdmin (Y/N) - PasswordLastSet - Location
User Logon Details (Time, Type, Location, Last Password Change)
This query will output a table including recent user logons with context information: - Timestamp - UserName - SID - LogonType - UserIsAdmin (Y/N) - PasswordLastSet - Location
Users creating Network Shares
The Query shows all new created Network Shares.