CQL Hubby ByteRay
← All queries

Detect Critical Environment Variable Changes over SSH with Connection Details

The query identifies critical changes to critical environment variables, extracts connection details such as user, local and remote IPs and ports, and provides a direct link to the related process in Falcon Process Explorer.

CQL · Falcon Next-Gen SIEMCopy query
Loading query…
Detect_Critical_Environment_Variable_Changes_over_SSH_with_Connection_Details.yml
TA0003
CrowdStrike
Hunting
Endpoint
Insight

Want this running in your SIEM — with someone on call?

Our Managed SIEM team operates CrowdStrike Falcon Next-Gen SIEM in production, with over 350 battle-tested use cases and 24/7 incident response behind them.

Talk to the SIEM team