JAR files written to %AppData%

This query detects if a JAR file was written to the %AppData% folder

CQL · Falcon Next-Gen SIEMCopy query

#event_simpleName=JarFileWritten 
| TargetFileName=/\\AppData\\/i
| table([aid, @timestamp, TargetFileName, SHA256HashData], limit=1000)

jar_file_written_to_appdata.yaml

T1027

CrowdStrike

Hunting

Endpoint

Insight

2025-08-06

2025-10-27

Get this query running in your SIEM, with someone on call.

Our Managed SIEM team operates CrowdStrike Falcon Next-Gen SIEM in production, with over 350 battle-tested use cases and 24/7 incident response behind them.

Talk to the SIEM team