JAR files executed from %AppData%
This query detects if a JAR file was executed from the %AppData% folder
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=ProcessRollup2
| ImageFileName=/javaw.exe/i CommandLine=/appdata/i
| table([aid, @timestamp, #event_simpleName, ImageFileName, SHA256HashData], limit=1000)jar_file_executed_from_appdata.yml
T163
CrowdStrike
Hunting
Endpoint
Insight
2025-08-06
2025-10-27
