EXPLORE DETECTIONS
Identity Protection - Average Cloud Response Time
Average time (in seconds) the cloud service takes to resolve entity information (e.g., from SID/GUID). Latency above 3 seconds may cause intermittent issues; above 4 seconds can lead to recurring timeouts.
Identity Protection - Average Cloud Response Time
Average time (in seconds) the cloud service takes to resolve entity information (e.g., from SID/GUID). Latency above 3 seconds may cause intermittent issues; above 4 seconds can lead to recurring timeouts.
Impossible Travel Time Azure
Tracing Logins from two different countries with impossible travel times between consecutive logins per identity Reference: [GitHub Aamir-Muhammad/CrowdStrike-Queries](https://github.com/Aamir-Muhammad/CrowdStrike-Queries/blob/main/Hunting-Queries/Impossible-Travel-Time-Azure.md)
Impossible Travel Time Azure
Tracing Logins from two different countries with impossible travel times between consecutive logins per identity Reference: [GitHub Aamir-Muhammad/CrowdStrike-Queries](https://github.com/Aamir-Muhammad/CrowdStrike-Queries/blob/main/Hunting-Queries/Impossible-Travel-Time-Azure.md)
Inspected LDAP / Kerberos / DCE/RCP Traffic
Shows inspected traffic requests over time on the selected domain controller
Inspected LDAP / Kerberos / DCE/RCP Traffic
Shows inspected traffic requests over time on the selected domain controller
Installed Browser Extensions (Aggregate by Extension)
This query will output a table with all installed browser extensions.
Installed Browser Extensions (Aggregate by Extension)
This query will output a table with all installed browser extensions.
Installed Browser Extensions (Hunt Extension Name)
This query will output a table with all installed browser extensions. Replace "vpn" with the string you want to hunt for.
Installed Browser Extensions (Hunt Extension Name)
This query will output a table with all installed browser extensions. Replace "vpn" with the string you want to hunt for.
InstallFix on macOS
The InstallFix query is designed to catch the execution patterns of one-liner stagers or initial access scripts that often masquerade as legitimate system fixes or installers through a high-confidence sequence where a curl command - configured with flags typically used to bypass security or silence output - is executed in close temporal proximity (within 1 minute) to a command involving Base64 decoding.
InstallFix on macOS
The InstallFix query is designed to catch the execution patterns of one-liner stagers or initial access scripts that often masquerade as legitimate system fixes or installers through a high-confidence sequence where a curl command - configured with flags typically used to bypass security or silence output - is executed in close temporal proximity (within 1 minute) to a command involving Base64 decoding.
Internet-Exposed RDP - Inbound Accepts from Public IPs
Identifies hosts that accepted inbound RDP connections (port 3389) from public, non RFC1918 source addresses, indicating RDP exposure to the internet or brute force activity against it. **What it looks for:** NetworkReceiveAcceptIP4 events where a Windows host completed an inbound TCP connection on port 3389 and the source address is not in a private, loopback, link-local or carrier-grade NAT range. Results are aggregated per host: total accepted connections, number of unique public source IPs, a sample of those IPs and the last time it happened. A single host with many unique public sources is either exposed RDP under brute force or a port-forwarding rule someone forgot about. **Telemetry needed:** Falcon sensor network telemetry on Windows (NetworkReceiveAcceptIP4). **False positives / tuning:** jump hosts and bastion servers that legitimately serve RDP from the outside will appear; move them to an allowlist on ComputerName. Environments that route internal traffic through non RFC1918 addressing (some VPN or SD-WAN setups) need those ranges added to the cidr exclusion list. To hunt session hijacking instead of exposure, pivot from a hit into UserLogon events on the same host.
Inventory of Installed Browser Extensions Across Endpoints
The query lists installed browser (Chrome & Edge) extensions across endpoints, normalizes browser names, counts unique systems per extension, adds a Chrome Web Store link, and sorts results to highlight the most common extensions. Reference: [GitHub CrowdStrike/logscale-community](https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Enumerate%20Chrome%20%2B%20Edge%20Browser%20Extension%20on%20Win%20and%20Mac.md)
Inventory of Installed Browser Extensions Across Endpoints
The query lists installed browser (Chrome & Edge) extensions across endpoints, normalizes browser names, counts unique systems per extension, adds a Chrome Web Store link, and sorts results to highlight the most common extensions. Reference: [GitHub CrowdStrike/logscale-community](https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Enumerate%20Chrome%20%2B%20Edge%20Browser%20Extension%20on%20Win%20and%20Mac.md)
IOC search | PTC Windchill & FlexPLM vulnerability
This query checks for Indicators of Compromise (IOCs) related to a critical Remote Code Execution vulnerability in PTC Windchill and FlexPLM. The query tracks the creation or modification of specific Java source files that an attacker may use to intercept requests, manipulate data streaming, or execute unauthorized system updates. https://support.eacpds.com/hc/en-us/article_attachments/47430019070996 This CQL query is designed to catch an attacker at two different stages of the PTC Windchill/FlexPLM exploitation lifecycle. ### **1. The Two Detection "Stages"** The `case` block splits the search into two specific scenarios: * **Scenario A (Active Execution/Persistence):** Looks for compiled Java files (`.class`) and web shells (`.jsp`). If these appear, the attacker has likely already triggered the exploit and is attempting to run code or maintain a backdoor. * **Scenario B (Staging/Delivery):** Looks for specific Java source files (`.java`) provided by PTC as known Indicators of Compromise. These are "payloads" that an attacker drops to overwrite core system functions. ### **2. Key Commands Used** * **`#event_simpleName = /.*FileWritten/i`**: Monitors the exact moment a file is created or modified on the hard drive. * **`regex /.../i`**: Performs a case-insensitive search for file patterns (like the `dpr_` prefix often used for malicious web shells). * **`in(field="FileName", values=[...])`**: Efficiently checks a list of "Known Bad" filenames against your environment. * **`table`**: Displays the **Timestamp**, **Impacted Host**, and the **Specific File** involved to allow for immediate incident response.
IOC search | PTC Windchill & FlexPLM vulnerability
This query checks for Indicators of Compromise (IOCs) related to a critical Remote Code Execution vulnerability in PTC Windchill and FlexPLM. The query tracks the creation or modification of specific Java source files that an attacker may use to intercept requests, manipulate data streaming, or execute unauthorized system updates. https://support.eacpds.com/hc/en-us/article_attachments/47430019070996 This CQL query is designed to catch an attacker at two different stages of the PTC Windchill/FlexPLM exploitation lifecycle. ### **1. The Two Detection "Stages"** The `case` block splits the search into two specific scenarios: * **Scenario A (Active Execution/Persistence):** Looks for compiled Java files (`.class`) and web shells (`.jsp`). If these appear, the attacker has likely already triggered the exploit and is attempting to run code or maintain a backdoor. * **Scenario B (Staging/Delivery):** Looks for specific Java source files (`.java`) provided by PTC as known Indicators of Compromise. These are "payloads" that an attacker drops to overwrite core system functions. ### **2. Key Commands Used** * **`#event_simpleName = /.*FileWritten/i`**: Monitors the exact moment a file is created or modified on the hard drive. * **`regex /.../i`**: Performs a case-insensitive search for file patterns (like the `dpr_` prefix often used for malicious web shells). * **`in(field="FileName", values=[...])`**: Efficiently checks a list of "Known Bad" filenames against your environment. * **`table`**: Displays the **Timestamp**, **Impacted Host**, and the **Specific File** involved to allow for immediate incident response.
JAR files executed from %AppData%
This query detects if a JAR file was executed from the %AppData% folder
JAR files executed from %AppData%
This query detects if a JAR file was executed from the %AppData% folder
JAR files written to %AppData%
This query detects if a JAR file was written to the %AppData% folder
JAR files written to %AppData%
This query detects if a JAR file was written to the %AppData% folder
Lateral Movement Detection
This query identifies potential lateral movement activities by detecting remote connections and credential usage patterns across multiple hosts. This query uses CrowdStrike Query Language (CQL) to detect lateral movement activities: 1. **Network Connections**: `#event_simpleName=NetworkConnect` - Monitors outbound network connections from endpoints 2. **Target Ports**: `(RemotePort=445 OR RemotePort=3389 OR RemotePort=5985)` - Focuses on SMB (445), RDP (3389), and WinRM (5985) connections 3. **External Targets**: `!cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"])` - Excludes internal network ranges to focus on external connections 4. **Process Context**: `join({#event_simpleName=ProcessRollup2}, field=[aid, RawProcessId], include=[ImageFileName, CommandLine])` - Adds process information for the connecting application 5. **User Context**: `join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])` - Enriches with user account information 6. **Output**: `table([aid, UserName, ImageFileName, RemoteAddressIP4, RemotePort, CommandLine])` - Shows user, process, target IP, and connection details
Lateral Movement Detection
This query identifies potential lateral movement activities by detecting remote connections and credential usage patterns across multiple hosts. This query uses CrowdStrike Query Language (CQL) to detect lateral movement activities: 1. **Network Connections**: `#event_simpleName=NetworkConnect` - Monitors outbound network connections from endpoints 2. **Target Ports**: `(RemotePort=445 OR RemotePort=3389 OR RemotePort=5985)` - Focuses on SMB (445), RDP (3389), and WinRM (5985) connections 3. **External Targets**: `!cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"])` - Excludes internal network ranges to focus on external connections 4. **Process Context**: `join({#event_simpleName=ProcessRollup2}, field=[aid, RawProcessId], include=[ImageFileName, CommandLine])` - Adds process information for the connecting application 5. **User Context**: `join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])` - Enriches with user account information 6. **Output**: `table([aid, UserName, ImageFileName, RemoteAddressIP4, RemotePort, CommandLine])` - Shows user, process, target IP, and connection details
LDAP Enumeration
Detects suspicious or excessive LDAP queries performed against Active Directory, as identified by Microsoft Defender for Identity. This behavior may indicate reconnaissance activity where an attacker attempts to gather information about users, groups, and domain structure for further exploitation Detects suspicious or excessive LDAP queries performed against Active Directory, as identified by Microsoft Defender for Identity. This behavior may indicate reconnaissance activity where an attacker attempts to gather information about users, groups, and domain structure for further exploitation