EXPLORE DETECTIONS
Check Domain Controller for NSX Driver
This query helps to determine if NSX drivers are installed on Domain Controllers to investigate limited Identity Protection functionality. ## Related CrowdStrike KBs 1. [Resolving Falcon Identity Protection conflicting with VMware tools and NSX Driver](https://supportportal.crowdstrike.com/s/article/ka16T000001Mle7QAC) 2. [Verify NSX driver installation on Domain Controllers](https://supportportal.crowdstrike.com/s/article/ka16T000001tkTHQAY)
Chromium-Based Browser Hunting via DLL Load
This query identifies Chromium-based browsers by detecting the loading of chrome.dll into running processes. Unlike simple process name checks, this method helps uncover browsers that may not be named chrome.exe but still rely on Chromium components. The query excludes known chrome.exe processes to highlight less obvious Chromium-based browsers, although it’s important to note that not all Chromium-based browsers necessarily load chrome.dll.
Chromium-Based Browser Hunting via DLL Load
This query identifies Chromium-based browsers by detecting the loading of chrome.dll into running processes. Unlike simple process name checks, this method helps uncover browsers that may not be named chrome.exe but still rely on Chromium components. The query excludes known chrome.exe processes to highlight less obvious Chromium-based browsers, although it’s important to note that not all Chromium-based browsers necessarily load chrome.dll.
Cisco Duo - Atypical Travel (Impossible Travel)
Cisco Duo Impossible Travel detects simultaneous logins from geographically distant locations, indicating potential credential compromise or unauthorized account usage leveraging valid credentials. Cisco Duo Impossible Travel detects simultaneous logins from geographically distant locations, indicating potential credential compromise or unauthorized account usage leveraging valid credentials.
Cisco Duo - Failed MFA Login within 5 mins
Cisco Duo Failed MFA Login within 5 minutes highlights repeated authentication failures that may indicate MFA fatigue attacks, credential abuse, or ongoing account takeover attempts. Cisco Duo Failed MFA Login within 5 minutes highlights repeated authentication failures that may indicate MFA fatigue attacks, credential abuse, or ongoing account takeover attempts.
Citrix NetScaler - CVE-2026-88771 Pitboss Command-Injection String in Logs
CVE-2026-88771 is a pre-auth command injection in ns_monuploadd_err.pl. The script greps logs for 'pitboss.*PPE.*(missed too many heartbeats|unexpectedly died)', extracts a core-file name with sed/awk without validation, and interpolates it into a backtick find command as root. Any attacker-controlled logged value (login field, User-Agent, parameters) can carry the payload, so every exploit attempt must leave a line matching that grep. This query applies the exact grep and scores lines that deviate from a legitimate pitboss crash record. Score >= 70 means an exploit string was logged; treat as probable compromise because the payload executes on the next ns_monuploadd_err.pl run (up to ~24h later) regardless of an observed crash. Space-free payloads (${IFS}, base64) are expected because awk splits on whitespace. Score 10 rows are well-formed PPE crash records - context for CVE-2026-88772 and the DoS CVEs, not exploitation. nsaaad lines often lack a client IP; pivot on timestamp to adjacent adc.sslvpn / adc.aaatm lines. Requires local0 and local1 syslog facilities forwarded. False positives: none expected at >= 85; 70 may catch unusual firmware log formats.
ClickFix Run Dialog Command Detection
Detects suspicious commands entered through the Windows Run dialog by monitoring RunMRU registry updates. The query requires both an interpreter or commonly abused system utility and a remote-resource, encoded-command, hidden-window, or inline-execution indicator. This targets ClickFix-style copy-and-paste social engineering while reducing alerts on ordinary Run dialog activity. ## Looks for The ClickFix delivery vector itself. Windows records every Run-dialog entry in `RunMRU`, so this fires *upstream of execution* — it catches the lure even when the payload fails, is blocked, or is a variant nobody has published yet. This is the Falcon translation of the exact pivot Microsoft's own detection query uses. The second filter is what keeps it clean: a user typing `cmd` is normal, a user pasting an interpreter *plus a remote resource or encoded blob* is not. **FP:** low as written; drop the second filter for a broader, noisier hunt. ## Required telemetry Requires Falcon endpoint registry-update telemetry with `RegObjectName`, `RegStringValue`, and host or user context. The query uses `RegGenericValueUpdate`, `AsepValueUpdate`, and `RegSystemConfigValueUpdate` events. ## False positives and tuning Administrators may paste legitimate troubleshooting, deployment, or remote-management commands into the Run dialog. Review the complete `RegStringValue`, the initiating user, and the affected host. After baselining, exclude only specifically approved commands, accounts, or management tools. Do not remove the two-condition requirement. ## Limitations A RunMRU match shows that the command was entered through the Run dialog; it does not prove that the command executed successfully. ClickFix variants that direct users to a terminal, command prompt, or PowerShell window without using the Run dialog will not be detected by this query.
Cloud Credential Violation IOMs
This query outputs all identified indicators of misconfigurations (IOMs) related to credentials.
Cloud Credential Violation IOMs
This query outputs all identified indicators of misconfigurations (IOMs) related to credentials.
Cloud Data Exfiltration IOMs
This query outputs all identified indicators of misconfigurations (IOMs) related to data exfiltration.
Cloud Data Exfiltration IOMs
This query outputs all identified indicators of misconfigurations (IOMs) related to data exfiltration.
Cloud Least Privilege IOMs
This query outputs all identified indicators of misconfigurations (IOMs) related to least privilege.
Cloud Least Privilege IOMs
This query outputs all identified indicators of misconfigurations (IOMs) related to least privilege.
Cloud MFA Violation IOMs
This query outputs all identified indicators of misconfigurations (IOMs) related to MFA violations.
Cloud MFA Violation IOMs
This query outputs all identified indicators of misconfigurations (IOMs) related to MFA violations.
Command History with Process Tree
Correlates CommandHistory events with ProcessRollup2 to show PowerShell command history together with the execution chain (parent → child process with PID). Provides context on how each PowerShell session was launched. ## How It Works 1. **Collects two event types** (Windows only): - CommandHistory: the console history of a PowerShell process, written when the process exits - ProcessRollup2: the process execution event, including parent process information 2. **Correlates via selfJoinFilter**: - Joins on aid + TargetProcessId - Keeps only processes for which both events are present 3. **Processes each event type**: - CommandHistory: splits the multi-command history field (separator: ¶) and reassembles it with newlines into CommandHistoryClean - ProcessRollup2: builds an ExecutionChain string, e.g. `cmd.exe → powershell.exe (PID: 1234)` 4. **Groups results**: - One row per PowerShell process (aid + TargetProcessId) - Each row shows the host, the execution chain, and the full cleaned command history ## Required Telemetry Falcon sensor endpoint telemetry on Windows hosts. CommandHistory is emitted at process termination, so long-running PowerShell consoles only appear after they close. ## Interpreting Results The ExecutionChain shows what spawned the PowerShell session. Unusual parents (Office applications, browsers, java.exe, wscript.exe) combined with suspicious commands in the history are the main hunting signal. ## False Positives and Tuning Most results will be legitimate administrator and automation activity. To reduce noise: - Filter on suspicious parents, e.g. add `ParentBaseFileName=/^(winword|excel|outlook|mshta|wscript)\.exe$/i` to the ProcessRollup2 case - Search the history for keywords, e.g. append `| CommandHistoryClean=/downloadstring|invoke-webrequest|frombase64string/i` - Exclude known management hosts or service accounts as needed
Connections to Tor Exit Nodes
Detects network connections to or from known Tor exit nodes by matching endpoint telemetry against a curated lookup file of Tor exit node IPs.
Connections to Tor Exit Nodes
Detects network connections to or from known Tor exit nodes by matching endpoint telemetry against a curated lookup file of Tor exit node IPs.
Count Windows Discovery Commands
This query counts the execution of discovery / reconnaissance commands.
Count Windows Discovery Commands
This query counts the execution of discovery / reconnaissance commands.
Created Local User Accounts
Table of all created local user accounts including UserName, ComputerName, aid, aip, and LocalIP.
Created Local User Accounts
Table of all created local user accounts including UserName, ComputerName, aid, aip, and LocalIP.
Credential Dumping Detection
This query detects potential credential dumping activities by monitoring process access to LSASS and suspicious memory operations. This query uses CrowdStrike Query Language (CQL) to detect credential dumping activities: 1. **Process Monitoring**: `#event_simpleName=ProcessRollup2` - Monitors process execution events across endpoints 2. **Suspicious Indicators**: `(CommandLine=/mimikatz|procdump|lsass|sekurlsa/i OR ImageFileName=/\\(mimikatz|procdump|pwdump)\.exe$/i)` - Detects known credential dumping tools and LSASS access patterns 3. **Parent Process Filter**: `ParentImageFileName!=/\\(powershell|cmd)\.exe$/i` - Excludes common legitimate parent processes to reduce noise 4. **User Context**: `join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])` - Adds user account information for attribution 5. **Process Hash**: `join({#event_simpleName=SyntheticProcessRollup2}, field=[aid, RawProcessId], include=[SHA256HashData], suffix="Parent")` - Includes file hash for threat intelligence correlation 6. **Output**: `table([aid, UserName, ImageFileName, CommandLine, ParentImageFileName, SHA256HashData])` - Displays process details, user context, and file hash information
Credential Dumping Detection
This query detects potential credential dumping activities by monitoring process access to LSASS and suspicious memory operations. This query uses CrowdStrike Query Language (CQL) to detect credential dumping activities: 1. **Process Monitoring**: `#event_simpleName=ProcessRollup2` - Monitors process execution events across endpoints 2. **Suspicious Indicators**: `(CommandLine=/mimikatz|procdump|lsass|sekurlsa/i OR ImageFileName=/\\(mimikatz|procdump|pwdump)\.exe$/i)` - Detects known credential dumping tools and LSASS access patterns 3. **Parent Process Filter**: `ParentImageFileName!=/\\(powershell|cmd)\.exe$/i` - Excludes common legitimate parent processes to reduce noise 4. **User Context**: `join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])` - Adds user account information for attribution 5. **Process Hash**: `join({#event_simpleName=SyntheticProcessRollup2}, field=[aid, RawProcessId], include=[SHA256HashData], suffix="Parent")` - Includes file hash for threat intelligence correlation 6. **Output**: `table([aid, UserName, ImageFileName, CommandLine, ParentImageFileName, SHA256HashData])` - Displays process details, user context, and file hash information