Detect Critical Environment Variable Changes over SSH with Connection Details

The query identifies critical changes to critical environment variables, extracts connection details such as user, local and remote IPs and ports, and provides a direct link to the related process in Falcon Process Explorer.

CQL · Falcon Next-Gen SIEMCopy query

#event_simpleName=CriticalEnvironmentVariableChanged
| EnvironmentVariableName =/(SSH_CONNECTION|USER)/
| EnvironmentVariableValue=/(?<localIP>\d+\.\d+\.\d+\.\d+)\s+(?<localPort>\d+)\s+(?<remoteIP>\d+\.\d+\.\d+\.\d+)\s+(?<remotePort>\d+)$/i
| table([@timestamp, aid, userName, remoteIP, remotePort, localIP, localPort])
| "Process Explorer" := format("[Process Explorer](https://falcon.crowdstrike.com/investigate/process-explorer/%s/%s)", field=["aid", "ContextProcessId"])

Reference: GitHub CrowdStrike/logscale-community

Detect_Critical_Environment_Variable_Changes_over_SSH_with_Connection_Details.yml

TA0003

CrowdStrike

Hunting

Endpoint

Insight

2025-10-30

Detect Critical Environment Variable Changes over SSH with Connection Details

Get this query running in your SIEM, with someone on call.