Hunt for specific Command Line Activity
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=ProcessRollup2 OR #event_simpleName=SyntheticProcessRollup2
| aid=?aid
| CommandLine like ?CommandLine
| ImageFileName=/(\/|\\)(?<FileName>\w*\.?\w*)$/
| table([aid, FileName, ImageFileName, CommandLine], limit=1000)hunt_command_line.yml
CrowdStrike
Hunting
Endpoint
Insight
2025-08-06
2025-08-28
