Hunt for a file name
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=ProcessRollup2 OR #event_simpleName=SyntheticProcessRollup2
| aid=?aid
| ImageFileName like ?ImageFileName
| ImageFileName=/(\/|\\)(?<FileName>\w*\.?\w*)$/
| table([aid, FileName, ImageFileName, CommandLine], limit=1000)hunt_filename.yml
CrowdStrike
Hunting
Endpoint
Insight
2025-08-06
2025-08-28
