ByteRay CQL Hub
← All queries

Check Domain Controller for NSX Driver

This query helps to determine if NSX drivers are installed on Domain Controllers to investigate limited Identity Protection functionality.

CQL · Falcon Next-Gen SIEMCopy query
event_platform=/Win/i #event_simpleName=/DriverLoad/i 
| in(field=FileName,values=["vnetwfp.sys", "vnetflt.sys"],ignoreCase=true) 
| join({$falcon/investigate:aid_master()}, field=aid, key=aid, include=[ProductType]) 
| ProductType=2 
| "Domain Controller":=ComputerName 
| LocalIP:=LocalAddressIP4 
| Drivers:=FileName 
| groupBy([aid,"Domain Controller",LocalIP,Drivers],function=[])
check_domain_controller_for_nsx_driver.yml
ByteRay GmbH
Monitoring
Endpoint
Insight
2026-02-20
2026-02-20

Get this query running in your SIEM, with someone on call.

Our Managed SIEM team operates CrowdStrike Falcon Next-Gen SIEM in production, with over 350 battle-tested use cases and 24/7 incident response behind them.

Talk to the SIEM team