Check Domain Controller for NSX Driver
This query helps to determine if NSX drivers are installed on Domain Controllers to investigate limited Identity Protection functionality.
CQL · Falcon Next-Gen SIEMCopy query
event_platform=/Win/i #event_simpleName=/DriverLoad/i
| in(field=FileName,values=["vnetwfp.sys", "vnetflt.sys"],ignoreCase=true)
| join({$falcon/investigate:aid_master()}, field=aid, key=aid, include=[ProductType])
| ProductType=2
| "Domain Controller":=ComputerName
| LocalIP:=LocalAddressIP4
| Drivers:=FileName
| groupBy([aid,"Domain Controller",LocalIP,Drivers],function=[])check_domain_controller_for_nsx_driver.yml
ByteRay GmbH
Monitoring
Endpoint
Insight
2026-02-20
2026-02-20
