Suspicious DLL / Module loads
This query will show all the suspicious DLL/module loads that CrowdStrike has flagged as detections, where all the endpoint are involved, along with the process and parent process details
CQL · Falcon Next-Gen SIEMCopy query
| #Vendor = crowdstrike
| #repo = "base_sensor"
| "#event_simpleName" = "ModuleLoadV3DetectInfo"
| aid=?aid
//| ComputerName="XXXXX"//Enter computer name to check for specific endpoint
| groupBy([ComputerName,aid], function=[collect(FileName),collect(FilePath),collect(ImageFileName),collect(ParentCommandLine),count(as=total_module_loads)])
| sort(total_module_loads, order=desc)This query will show all the suspicious DLL/module loads that CrowdStrike has flagged as detections, where all the endpoint are involved, along with the process and parent process details
suspicious_dll_module_loads.yml
T1036
Kundan Kumar
Hunting
Endpoint
Insight
2026-06-05
2026-06-05
