ByteRay CQL Hub
← All queries

Firewall Rule Additions

This query correlates processes with Windows Firewall rule modifications they triggered, identifying which executables are creating or modifying firewall rules.

CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=ProcessRollup2
| join({#event_simpleName=FirewallSetRule}, key=ContextProcessId, field=TargetProcessId, include=[FirewallRule, FirewallRuleId])
| ImageFileName=/.*\\(?<fileName>.*\..*)/
| table([aid, UserSid, fileName, FirewallRuleId, FirewallRule, ImageFileName, CommandLine])
Firewall_Rule_Additions.yml
CrowdStrike
Hunting
Endpoint
Insight
2025-08-06
2025-10-31

Get this query running in your SIEM, with someone on call.

Our Managed SIEM team operates CrowdStrike Falcon Next-Gen SIEM in production, with over 350 battle-tested use cases and 24/7 incident response behind them.

Talk to the SIEM team