MongoDB Processes on Windows & Linux Hosts (CVE-2025-14847)
This query identifies Windows and Linux Hosts running MongoDB processes.
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=ProcessRollup2
| (event_platform=Win AND ImageFileName=/mongod\.exe|mongos\.exe/i) OR (event_platform=Lin AND ImageFileName=/mongod|mongos/i)
| table([@timestamp, aid, ComputerName, UserName, ImageFileName])mongodb_processes_on_windows___linux_hosts__cve_2025_14847_.yml
ByteRay GmbH
Hunting
Endpoint
Insight
2025-08-26
2025-12-28
