EXPLORE DETECTIONS
External Connectons with Process
Failed and Successful User Logon Events
This query correlates successful and failed logon attempts per user account to identify potential compromise patterns, focusing on accounts with 4+ failed logons. It provides a comprehensive view of each user's authentication activity including password age and last successful access.
Failed and Successful User Logon Events
This query correlates successful and failed logon attempts per user account to identify potential compromise patterns, focusing on accounts with 4+ failed logons. It provides a comprehensive view of each user's authentication activity including password age and last successful access.
Failed logon attempt group by userName and unique Endpoint involved
Failed logon attempt group by userName and unique Endpoint involved
Failed User Logon Thresholding
This query identifies Windows failed login attempts that exceed a threshold (5+ failures), helping detect potential brute force attacks or account compromise attempts
Failed User Logon Thresholding
This query identifies Windows failed login attempts that exceed a threshold (5+ failures), helping detect potential brute force attacks or account compromise attempts
Falcon Sensor Heartbeat Timechart
This query plots a timechart showing the frequency of Falcon sensor heartbeat events across the environment.
Falcon Sensor Heartbeat Timechart
This query plots a timechart showing the frequency of Falcon sensor heartbeat events across the environment.
Falcon Sensor Support Status
This query lists all active falcon sensors including their release date and support end date.
Falcon Sensor Support Status
This query lists all active falcon sensors including their release date and support end date.
Falcon Sensor Version Drift Monitoring (Linux)
Compares CrowdStrike Falcon sensor major/minor versions (x.xx) over time for each host. The query detects version changes, classifies them as upgrades or downgrades, and outputs the timestamp of the change along with the previous and current version values.
Falcon Sensor Version Drift Monitoring (Linux)
Compares CrowdStrike Falcon sensor major/minor versions (x.xx) over time for each host. The query detects version changes, classifies them as upgrades or downgrades, and outputs the timestamp of the change along with the previous and current version values.
Falcon Sensor Version Drift Monitoring (MacOS)
Compares CrowdStrike Falcon sensor major/minor versions (x.xx) over time for each host. The query detects version changes, classifies them as upgrades or downgrades, and outputs the timestamp of the change along with the previous and current version values.
Falcon Sensor Version Drift Monitoring (MacOS)
Compares CrowdStrike Falcon sensor major/minor versions (x.xx) over time for each host. The query detects version changes, classifies them as upgrades or downgrades, and outputs the timestamp of the change along with the previous and current version values.
Falcon Sensor Version Drift Monitoring (Windows)
Compares CrowdStrike Falcon sensor major/minor versions (x.xx) over time for each host. The query detects version changes, classifies them as upgrades or downgrades, and outputs the timestamp of the change along with the previous and current version values.
Falcon Sensor Version Drift Monitoring (Windows)
Compares CrowdStrike Falcon sensor major/minor versions (x.xx) over time for each host. The query detects version changes, classifies them as upgrades or downgrades, and outputs the timestamp of the change along with the previous and current version values.
FalconFlank Exploit Artifacts (Named Pipe and Dropped DLL)
Detects on-host artifacts of the FalconFlank local privilege escalation exploit against the CrowdStrike Falcon sensor (the FALCONFLANK named pipe, the staged bcrypt.dll under Flanker_<GUID>, and a bcrypt.dll written into the System32 PowerShell directory) and returns the responsible process with user, command line and parent. **Background:** FalconFlank (public PoC, September 2026) is a local privilege escalation that turns the Falcon sensor's macro remediation into a privileged file write. A standard user stages a Word macro document named `bcrypt.dll` inside a mirror of the PowerShell directory tree under `%TEMP%\Flanker_<GUID>\WindowsPowerShell\v1.0\`, freezes it with an oplock, replaces the `v1.0` folder with a mount point to the real `C:\Windows\System32\WindowsPowerShell\v1.0`, and lets Falcon's remediation resolve the path. The file is then overwritten with a proxy DLL via a kernel transaction and loaded as SYSTEM by the stock `MareBackup` scheduled task. A named pipe called `FALCONFLANK` hands the SYSTEM console back to the user's session. **What it looks for:** three on-host artifacts of that chain, then the process that produced them. Output is one row per process with all of its indicators collected in the `Indicator` column: 1. **Named pipe `FALCONFLANK`**: opened by the exploit at start. The name is fixed and does not change when the exploit binary is renamed. 2. **Staged document**: a file named `bcrypt.dll` written to `%TEMP%\Flanker_<GUID>\WindowsPowerShell\v1.0\`. This is an OLE document, not a PE, so PE-write events do not fire for it; `FileCreateInfo` does. This catches the exploit before the escalation completes. 3. **Final DLL**: a `bcrypt.dll` written to `C:\Windows\System32\WindowsPowerShell\v1.0\`. This does not occur on a healthy system. Two processes touch this path in a successful run: the Falcon service (SYSTEM) during remediation, and the exploit process during the transacted overwrite. A row attributed to the Falcon service is therefore expected and means the exploit worked, not that the sensor misbehaved. The sensor may or may not record its own write. **How it works:** the named pipe surfaces on `NamedPipeDetectInfo` as `TargetFileName = \Device\NamedPipe\FALCONFLANK`. File writes are taken from `FileCreateInfo` (any file) and `NewExecutableWritten` (PE files). Neither carries the user or command line, so hits are deduplicated per indicator and file, grouped by `aid` and `ContextProcessId`, and joined to `ProcessRollup2` on `TargetProcessId`. That adds `UserName`, `UserSid`, `ImageFileName`, `CommandLine` and `ParentBaseFileName`. The artifact side sits inside `join()` because that side is materialised into a table with a row limit; `ProcessRollup2` stays the streaming side. **Telemetry needed:** Falcon Windows sensor with process, named pipe and file write events in `base_sensor` (`ProcessRollup2`, `NamedPipeDetectInfo`, `FileCreateInfo`, `NewExecutableWritten`). **False positives / tuning:** none expected. Every row is a confirmed indicator. Indicators 1 or 2 mean the exploit was staged or run on the host; indicator 3 means the escalation likely succeeded and the host needs incident response, including removal of the planted DLL, a check of the Falcon sensor state and a look for a SYSTEM `conhost.exe` in the user's session. **Notes:** the join is inner, so the `ProcessRollup2` of the exploit process must fall inside the search window (the artifacts appear within seconds of process start, so any normal window covers it). If you only want the raw artifacts without process context, run the subquery inside `join()` on its own and replace the two `groupBy` lines with `table([@timestamp, aid, ComputerName, #event_simpleName, Indicator, TargetFileName, ContextBaseFileName])`. **Sources:** - https://github.com/MSNightmare/FalconFlank - https://www.linkedin.com/pulse/falconflank-crowdstrikes-own-macro-remediation-just-became-k%C3%B6gler-j68ne/
File Write Events with Human-Readable File Sizes
The query lists file write events and converts the file size into readable units (KB, MB, GB, or TB), displaying timestamps, host details, filenames, and both raw and formatted file sizes. Reference: [GitHub CrowdStrike/logscale-community](https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Case%20to%20convert%20Size%20to%20appropriate%20unit%20of%20measure.md)
File Write Events with Human-Readable File Sizes
The query lists file write events and converts the file size into readable units (KB, MB, GB, or TB), displaying timestamps, host details, filenames, and both raw and formatted file sizes. Reference: [GitHub CrowdStrike/logscale-community](https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Case%20to%20convert%20Size%20to%20appropriate%20unit%20of%20measure.md)
Files Written to Removable Media
This query tracks files written to removable media (USB drives, external drives) across all platforms, aggregating the total data volume and file count per computer. It's useful for detecting potential data exfiltration attempts or monitoring removable media usage for compliance.
Files Written to Removable Media
This query tracks files written to removable media (USB drives, external drives) across all platforms, aggregating the total data volume and file count per computer. It's useful for detecting potential data exfiltration attempts or monitoring removable media usage for compliance.