Detect Critical Environment Variable Changes over SSH with Connection Details
The query identifies critical changes to critical environment variables, extracts connection details such as user, local and remote IPs and ports, and provides a direct link to the related process in Falcon Process Explorer.
CQL · Falcon Next-Gen SIEMCopy query
Loading query…Detect_Critical_Environment_Variable_Changes_over_SSH_with_Connection_Details.yml
TA0003
CrowdStrike
Hunting
Endpoint
Insight
