CQL Hub by ByteRay

CrowdStrike Query Library

The open CQL library for Falcon Next‑Gen SIEM.

173 community-maintained detection & hunting queries for CrowdStrike Falcon Next-Gen SIEM and LogScale. Search, filter, copy — free to use.

Queries Lookup files Dashboardssoon SOAR workflowssoon What's new

173 queriesReset filters

TypeHunting Monitoring Detection

Log sourceEndpoint Identity Network Cloud Other

ModuleInsight Identity CSPM / ASPM / DSPM

Windows Store Installs

windows-store-installs

Windows authentication traffic metrics

windows-authentication-traffic-metrics

Users creating Network Shares

users-creating-network-shares

User Logon Details (Time, Type, Location, Last Password Change)

Hunting, Monitoring

user-logon-details-time-type-location-last-password-change

User Logon Activity

user-logon-activity

User Logoff Activity

user-logoff-activity

Unauthorized RMM Tool Usage

unauthorized-rmm-tool-usage

Torrent Website Access Detected

torrent-website-access-detected

Find events triggered at a specific time

find-events-triggered-at-a-specific-time

The Gentlemen RaaS - Custom Backdoors and Evolving Tactics

Hunting, Monitoring, Detection

Endpoint, Network

the-gentlemen-raas-custom-backdoors-and-evolving-tactics

Find tasks scheduled with ComHandler

find-tasks-scheduled-with-comhandler

Find tasks scheduled by user ID

find-tasks-scheduled-by-user-id

Find tasks scheduled by run level

find-tasks-scheduled-by-run-level

Find tasks scheduled by logon type

find-tasks-scheduled-by-logon-type

Systems Initiating Connections to a High Number of Ports

systems-initiating-connections-to-a-high-number-of-ports

Suspicious Scheduled Task Creation

suspicious-scheduled-task-creation

Suspicious DLL / Module loads

suspicious-dll-module-loads

Find events triggered at startup

find-events-triggered-at-startup

SOC Efficiency Metrics

soc-efficiency-metrics

Hunting, Detection

SMB File Copy to Multiple Devices (Microsoft Defender for Identity)

smb-file-copy-to-multiple-devices-microsoft-defender-for-identity

SMB Enumeration | Defender for Identity

smb-enumeration-defender-for-identity

Shadow MCP Server Activity via Common Runtime Interpreters

shadow-mcp-server-activity-via-common-runtime-interpreters

Sensor Version Adoption Trend

sensor-version-adoption-trend

Security Group Created (Microsoft Defender for Identity)

security-group-created-microsoft-defender-for-identity

Find events that are scheduled

find-events-that-are-scheduled

SAMR Burst (BloodHound/PowerView)

samr-burst-bloodhound-powerview

Devices in RFM state

devices-in-rfm-state

Remote Port Forwarding via Plink - Unauthorized RDP Tunneling Detection

remote-port-forwarding-via-plink-unauthorized-rdp-tunneling-detection

Remote Interactive Logons (RDP)

Insight, Identity

remote-interactive-logons-rdp

Recent RTR Sessions

recent-rtr-sessions

Ransomware Precursors

ransomware-precursors

Find processes that only ran a few of times on a specific host

find-processes-that-only-ran-a-few-of-times-on-a-specific-host

Process Execution directly from SMB share or SMB-mapped path

process-execution-directly-from-smb-share-or-smb-mapped-path

Potential Lateral Movement through RDP

potential-lateral-movement-through-rdp

Possible DC Replication (DCSync)

possible-dc-replication-dcsync

Password Spray Many Users from Same IP Microsoft Defender for Identity

password-spray-many-users-from-same-ip-microsoft-defender-for-identity

Packed Binary Detected

packed-binary-detected

Packages in Container Images - Match Parameter

CSPM / ASPM / DSPM

packages-in-container-images-match-parameter

Packages in Container Images - Match Lookup File

CSPM / ASPM / DSPM

packages-in-container-images-match-lookup-file

OS Platform ratio

os-platform-ratio

OAuth2 Token Burst — Token Harvesting (Microsoft Defender for Identity)

oauth2-token-burst-token-harvesting-microsoft-defender-for-identity

NTLM authentication where Kerberos is expected (Baseline)

Hunting, Monitoring

ntlm-authentication-where-kerberos-is-expected-baseline

NPM Package Named Searches

Hunting, Detection

npm-package-named-searches

Notepad++ supply chain attack

notepad-supply-chain-attack

New installed Sensors

new-installed-sensors

MongoDB Processes on Windows & Linux Hosts (CVE-2025-14847)

mongodb-processes-on-windows-linux-hosts-cve-2025-14847

MFA Status Monitoring

mfa-status-monitoring

Find events triggered at logon

find-events-triggered-at-logon

List all Identity Protection Detections

list-all-identity-protection-detections

LeakNet Campaign: Deno Runtime & Klist Suspicious Execution Detection

Hunting, Detection

leaknet-campaign-deno-runtime-klist-suspicious-execution-detection

LDAP Enumeration

ldap-enumeration

JAR files executed from %AppData%

jar-files-executed-from-appdata

IOC search | PTC Windchill & FlexPLM vulnerability

ioc-search-ptc-windchill-flexplm-vulnerability

InstallFix on macOS

installfix-on-macos

Installed Browser Extensions (Hunt Extension Name)

installed-browser-extensions-hunt-extension-name

Installed Browser Extensions (Aggregate by Extension)

installed-browser-extensions-aggregate-by-extension

Inspected LDAP / Kerberos / DCE/RCP Traffic

inspected-ldap-kerberos-dce-rcp-traffic

Identity Protection - Average Cloud Response Time

identity-protection-average-cloud-response-time

Identify Shadow SaaS

identify-shadow-saas

Hunting EDR Freeze

hunting-edr-freeze

Hunting Bitsadmin usage

hunting-bitsadmin-usage

Hunt for a file name

hunt-for-a-file-name

Hunt for specific Command Line Activity

hunt-for-specific-command-line-activity

High Volume SMB File Copy (Data Exfiltration / Ransomware) – Microsoft Defender for Identity

high-volume-smb-file-copy-data-exfiltration-ransomware-microsoft-defender-for-identity

Find hidden scheduled tasks

find-hidden-scheduled-tasks

Get USB Devices

get-usb-devices

Get Host Zero Trust Assessment Scores

get-host-zero-trust-assessment-scores

Find OpenClaw on Endpoints

find-openclaw-on-endpoints

Falcon Sensor Version Drift Monitoring (MacOS)

falcon-sensor-version-drift-monitoring-macos

Falcon Sensor Version Drift Monitoring (Linux)

falcon-sensor-version-drift-monitoring-linux

Falcon Sensor Version Drift Monitoring (Windows)

falcon-sensor-version-drift-monitoring-windows

Falcon Sensor Support Status

falcon-sensor-support-status

Falcon Sensor Heartbeat Timechart

falcon-sensor-heartbeat-timechart

Exploitable Critical Vulnerabilities

exploitable-critical-vulnerabilities

Find events triggered on an event

find-events-triggered-on-an-event

EDRCHOKER - QoS Policy Abuse Targeting EDR/AV Processes

Hunting, Monitoring, Detection

edrchoker-qos-policy-abuse-targeting-edr-av-processes

Domain Controllers with high load

domain-controllers-with-high-load

Domain Admin Enumeration

domain-admin-enumeration

DNS Staging Detection: ClickFix-Inspired nslookup Execution

Hunting, Detection

dns-staging-detection-clickfix-inspired-nslookup-execution

Disable Strong Authentication (Microsoft Entra ID)

disable-strong-authentication-microsoft-entra-id

Device Code Sign-In

device-code-sign-in

Search for oldest devices

search-for-oldest-devices

Detection of Generic User Account Usage

detection-of-generic-user-account-usage

Detection of DNS Requests to AI-Related Domains

detection-of-dns-requests-to-ai-related-domains

Detect RTR High Risk Commands

detect-rtr-high-risk-commands

Detect Remote Monitoring and Management (RMM) Tools over DNS

detect-remote-monitoring-and-management-rmm-tools-over-dns

Detect NTLMv1 Authentications (Windows Event Logs)

detect-ntlmv1-authentications-windows-event-logs

Detect NTLMv1 Authentications

detect-ntlmv1-authentications

Detect locally disabled RTR

detect-locally-disabled-rtr

Deleted Local User Accounts

deleted-local-user-accounts

Detect Data Exfiltration via external storage devices

detect-data-exfiltration-via-external-storage-devices

CVE-2026-32202 - Windows Shell

Hunting, Monitoring, Detection

Endpoint, Network

cve-2026-32202-windows-shell

CVE-2025-59287 vulnerable WSUS servers identification

Hunting, Monitoring

Endpoint, Other

cve-2025-59287-vulnerable-wsus-servers-identification

CVE-2025-59287 - WSUS Identification+Vulnerability Query

cve-2025-59287-wsus-identification-vulnerability-query

CVE-2025-53770 - SharePoint ToolShell

cve-2025-53770-sharepoint-toolshell

CVE-2025-1146 - System Scoping using OsVersionInfo & Logon Data

cve-2025-1146-system-scoping-using-osversioninfo-logon-data

CVE-2025-1146 - System Scoping using OsVersionInfo

cve-2025-1146-system-scoping-using-osversioninfo

CVE-2025-1146 - System Scoping using aid_master

cve-2025-1146-system-scoping-using-aid-master

Credentials Validation Burst (Microsoft Defender for Identity)

credentials-validation-burst-microsoft-defender-for-identity

Created Local User Accounts

created-local-user-accounts

Count Windows Discovery Commands

count-windows-discovery-commands

Connections to Tor Exit Nodes

connections-to-tor-exit-nodes

Cloud MFA Violation IOMs

CSPM / ASPM / DSPM

cloud-mfa-violation-ioms

Cloud Least Privilege IOMs

CSPM / ASPM / DSPM

cloud-least-privilege-ioms

Cloud Data Exfiltration IOMs

CSPM / ASPM / DSPM

cloud-data-exfiltration-ioms

Cloud Credential Violation IOMs

CSPM / ASPM / DSPM

cloud-credential-violation-ioms

ClickFix Run Dialog Command Detection

Hunting, Detection

clickfix-run-dialog-command-detection

Cisco Duo - Failed MFA Login within 5 mins

cisco-duo-failed-mfa-login-within-5-mins

Cisco Duo - Atypical Travel (Impossible Travel)

cisco-duo-atypical-travel-impossible-travel

Chromium-Based Browser Hunting via DLL Load

chromium-based-browser-hunting-via-dll-load

Check Domain Controller for NSX Driver

check-domain-controller-for-nsx-driver

Calculate Next-Gen SIEM Ingestion Total

Network, Cloud, Other

calculate-next-gen-siem-ingestion-total

Calculate Last Windows Boot Time

calculate-last-windows-boot-time

C2 Beaconing Detection

c2-beaconing-detection

BYOVD Driver Load with EDR/AV Process Termination (Medusa Ransomware)

byovd-driver-load-with-edr-av-process-termination-medusa-ransomware

Brute Force based on Microsoft Defender for Identity

brute-force-based-on-microsoft-defender-for-identity

AWS S3 Bucket Policy Updates

aws-s3-bucket-policy-updates

List of attachments sent from Outlook

list-of-attachments-sent-from-outlook

Assigned Sensor Update Policy

assigned-sensor-update-policy

Applications with plaintext passwords

applications-with-plaintext-passwords

Applications Spawning CMD or Powershell

applications-spawning-cmd-or-powershell

Application Consent Grant (Microsoft Entra ID)

application-consent-grant-microsoft-entra-id

Active Directory Activity

active-directory-activity

Account Password Not Required Changed (UAC Bypass) – Microsoft Defender for Identity

account-password-not-required-changed-uac-bypass-microsoft-defender-for-identity

Account Enabled (Microsoft Defender for Identity)

account-enabled-microsoft-defender-for-identity

Suspicious Registry Modifications

Insight, Identity

suspicious-registry-modifications

Suspicious PowerShell Execution

suspicious-powershell-execution

Rare windows shell parent process

rare-windows-shell-parent-process

ROKRAT Malware APT 37

rokrat-malware-apt-37

Powershell Downloads

powershell-downloads

Malicious Chrome Extension FreeVPN-One Detection

malicious-chrome-extension-freevpn-one-detection

Lateral Movement Detection

lateral-movement-detection

LOLBin Rundll32

lolbin-rundll32

LOLBin Regsvr32

lolbin-regsvr32

LOLBin Certutil

lolbin-certutil

Inventory of Installed Browser Extensions Across Endpoints

inventory-of-installed-browser-extensions-across-endpoints

Impossible Travel Time Azure

Network, Identity

Identity, CSPM / ASPM / DSPM

impossible-travel-time-azure

Powershell Command Length Anomaly Detection

powershell-command-length-anomaly-detection

Phishing - List of links opened from Outlook

phishing-list-of-links-opened-from-outlook

Remediation - Host Contained

remediation-host-contained

Honeytoken Account Logon Activity

honeytoken-account-logon-activity

Frequency Analysis via Program Clustering

frequency-analysis-via-program-clustering

Firewall Rule Additions

firewall-rule-additions

Files Written to Removable Media

files-written-to-removable-media

File Write Events with Human-Readable File Sizes

file-write-events-with-human-readable-file-sizes

Failed logon attempt group by userName and unique Endpoint involved

failed-logon-attempt-group-by-username-and-unique-endpoint-involved

Failed and Successful User Logon Events

failed-and-successful-user-logon-events

Failed User Logon Thresholding

failed-user-logon-thresholding

External Connectons with Process

external-connectons-with-process

Evaluate Operating System Prevalence

evaluate-operating-system-prevalence

Enumerate Windows Driver Loads

enumerate-windows-driver-loads

Detection of DoH traffic to known DoH-providers

detection-of-doh-traffic-to-known-doh-providers

Dll-Side Loading Detection Query

dll-side-loading-detection-query

Detection of External Direct IP Usage in CommandLine Windows and Mac

Hunting, Detection

detection-of-external-direct-ip-usage-in-commandline-windows-and-mac

Detect and Decode Base64-Encoded PowerShell Commands

detect-and-decode-base64-encoded-powershell-commands

Detect and Decode Base64-Encoded PowerShell Commands - http

detect-and-decode-base64-encoded-powershell-commands-http

Detect Suspicious Windows Command-Line Activity Using System Utilities

detect-suspicious-windows-command-line-activity-using-system-utilities

Detect Critical Environment Variable Changes over SSH with Connection Details

detect-critical-environment-variable-changes-over-ssh-with-connection-details

Decode VolumeDeviceCharacteristics Bitmask

decode-volumedevicecharacteristics-bitmask

Decode SignInfoFlags

decode-signinfoflags

DNS Resolutions from Browser Processes

dns-resolutions-from-browser-processes

Credential Dumping Detection

credential-dumping-detection

Charon Ransomware Detection and Correlation

charon-ransomware-detection-and-correlation

Identify Linux Systems Vulnerable to CVE-2025-1146 with Last Logged-On User Information

identify-linux-systems-vulnerable-to-cve-2025-1146-with-last-logged-on-user-information

Rare Remote Ports in Network Connections

Endpoint, Network

rare-remote-ports-in-network-connections

Enriched Process Tree Association Events

enriched-process-tree-association-events

New API Keys within the Falcon Platform

new-api-keys-within-the-falcon-platform

No queries match your filters.

Have a query worth sharing?

Submit it directly — no GitHub account required — or open a pull request. Every query is reviewed and validated before it goes live, credited to you as the author.

Contribute a query →

These queries run in production.

We build, tune and operate CrowdStrike Falcon Next-Gen SIEM for companies across Europe, with more than 350 tested use cases and 24/7 incident response behind them.

Talk to the SIEM team