ByteRay CQL Hub
← All queries

Rare windows shell parent process

This hunting query is designed to detect rare shell parent processes.

CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=ProcessRollup2 event_platform=Win
| case { in(field=FileName, values=["powershell.exe", "cmd.exe", "pwsh.exe"]) | IsChild := "1"; * | IsChild := "0" }
| case { IsChild = "1" | ProcId := ParentProcessId | ChildProcess := FileName | ChildCommandLine := CommandLine;
IsChild = "0" | ProcId := TargetProcessId | ParentCommandLine := CommandLine | ParentFileName := FileName | ParentFilePath := FilePath | ParentSHA256HashData := SHA256HashData; }
| groupBy([ComputerName, ProcId], function=([count(ParentProcessId, distinct=true, as=EventCount), collect([ParentFileName, ParentSHA256HashData, ParentFilePath, ParentCommandLine, ChildProcess]), collect(ChildCommandLine, limit=4)]), limit=max)
| EventCount > 1
| groupBy([ParentSHA256HashData], function=([collect([aid, ParentFileName, ParentFilePath, ParentCommandLine, ChildProcess, ChildCommandLine]), count(ComputerName, as=HostCount)]))
| HostCount < 5
| sort([HostCount, ParentFileName], order=asc)

This hunting query is designed to detect rare shell parent processes:

  1. Filter for Windows Events: #event_simpleName=ProcessRollup2``event_platform=Win

  2. Classify Processes: (case { in(field=FileName, values=["powershell.exe", "cmd.exe", "pwsh.exe"]) | IsChild := "1";) - If the FileName matches a shell (powershell.exe, cmd.exe, pwsh.exe), the process is marked as a child process - Otherwise, it is marked as not a child process

  3. Assign Process Information: ParentImageFileName!=/\\(powershell|cmd)\.exe$/i - For child processes (IsChild = "1"), the ProcId is set to the ParentProcessId - For non-child processes (IsChild = "0"), the ProcId is set to the TargetProcessId

  4. Group by Computer and Process: - The query groups events by ComputerName and ProcId to analyze process relationships. - Calculation of the distinct count of ParentProcessId as EventCount

Rare_Windows_Shell_Parent.yml
ByteRay GmbH
Hunting
Endpoint
Insight
2025-08-06
2025-08-26

Get this query running in your SIEM, with someone on call.

Our Managed SIEM team operates CrowdStrike Falcon Next-Gen SIEM in production, with over 350 battle-tested use cases and 24/7 incident response behind them.

Talk to the SIEM team