Applications Spawning CMD or Powershell
Table listing processes that spawned cmd.exe or powershell.exe child processes.
CQL · Falcon Next-Gen SIEMCopy query
"#event_simpleName" = ProcessRollup2 event_platform="Win" FileName=/(cmd.exe|powershell.exe)/i
| wildcard(field=ComputerName, pattern=?ComputerName, ignoreCase=true)
| groupBy([ParentBaseFileName], function=[count(aid, distinct=true, as="DistinctHosts")])
| sort(DistinctHosts)
| rename(field="ParentBaseFileName", as="FileName")applications_spawning_cmd_or_powershell.yml
T1059
ByteRay GmbH
Hunting
Endpoint
Insight
2025-08-26
2025-08-26
