Process Execution directly from SMB share or SMB-mapped path
This query detects remote process execution over SMB (Server Message Block) on CrowdStrike Falcon monitored endpoints — a strong indicator of lateral movement, remote code execution, or ransomware spreading across the network.
CQL · Falcon Next-Gen SIEMCopy query
| #Vendor = crowdstrike
| #repo = "base_sensor"
| "#event_simpleName"="ProcessExecOnSMBFile"
| table([@timestamp,UserName,ComputerName,ClientComputerName,LocalAddressIP4,RemoteAddressIP4])This query detects remote process execution over SMB (Server Message Block) on CrowdStrike Falcon monitored endpoints — a strong indicator of lateral movement, remote code execution, or ransomware spreading across the network.
process_execution_directly_from_smb_share_or_smb_mapped_path.yml
T1570
Kundan Kumar
Detection
Endpoint
Insight
2026-06-05
2026-06-05
