The open CQL library for Falcon Next‑Gen SIEM.

defineTable( query={ #repo="sensor_metadata" #data_source_name="policyinfo" #data_source_group="sensor-update" | groupBy(id, function=selectFromMax(field="@timestamp", include=[release_id])) | rename(field="id", as="sensor_update_policy_id") } , include=[sensor_update_policy_id, release_id] , name="policy_to_release" , start=1h // policyinfo is currently updated once an hour ) | defineTable(query={ createEvents([ "release_id=tagged|1 release.type=N-1", "release_id=tagged|2 release.type=N-2", "release_id=tagged|3 release.type=N-1", "release_id=tagged|4 release.type=N-2", "release_id=tagged|5 release.type=N-1", "release_id=tagged|6 release.type=N-2", "release_id=tagged|11 release.type=\"Auto Latest\"", "release_id=tagged|12 release.type=\"Auto Latest\"", "release_id=tagged|13 release.type=\"Auto Latest\"", "release_id=tagged|16 release.type=\"Auto EA\"", "release_id=tagged|17 release.type=\"Auto EA\"", "release_id=tagged|18 release.type=\"Auto EA\"" ]) | kvParse() }, include=[release_id, release.type], name="release_type_lookup") | defineTable( query={ #repo="sensor_metadata" #data_source_name="aid-policy" | groupBy(aid, limit=max, function=selectFromMax(field="@timestamp", include=[sensor_update_policy_id])) } , include=[aid, sensor_update_policy_id] , name="aid_to_policy" , start=1d //aid-policy is currently updated once per day ) | readFile("aid_master_main.csv") | in(field="ProductType", values=[1,2,3]) | match(file="aid_to_policy", field=aid, include=sensor_update_policy_id) | match(file="policy_to_release", field=sensor_update_policy_id, include=release_id, strict=false) | match(file="release_type_lookup", field=[release_id], include=release.type, strict=false) | groupBy([aid, ComputerName, event_platform, Version, release.type, sensor_update_policy_id, MachineDomain, OU, SiteName, SystemManufacturer, SystemProductName], function=[], limit=max) | default(value="-", field=[ProductType, MAC, sensor_update_policy_id, MachineDomain, OU, SiteName, SystemManufacturer, SystemProductName], replaceEmpty=true) | default(value="Auto-Update Disabled", field=[release.type])

ByteRay

// Exclude EDR logs, since these are in-platform and don't count against NG-SIEM ingest #Vendor != "crowdstrike" // Add up our fields that are counted for ingest (not 100% accurate, but very close to it) | total_event := concat([@timestamp, @rawstring, #event.dataset, #event.module]) | length(field=total_event, as=event_size) // Get our results by Vendor and translate to MB and GB | groupBy([#Vendor], function=[sum(event_size, as=SizeBytes)], limit=max) | SizeMB:=unit:convert("SizeBytes", binary=true, from=B, to=M, keepUnit=true) | SizeGB:=unit:convert("SizeBytes", binary=true, from=B, to=G, keepUnit=true) // Sort | sort(SizeBytes, limit=200) // Total for all vendors (uncomment for this) //| sum(SizeBytes, as=SizeBytes) //| SizeMB:=unit:convert("SizeBytes", binary=true, from=B, to=M, keepUnit=true) //| SizeGB:=unit:convert("SizeBytes", binary=true, from=B, to=G, keepUnit=true)

AAuraa

// Insert Discovery commands of interest here event_platform=Win #event_simpleName=ProcessRollup2 FileName=/(whoami|ping|net1?|systeminfo|quser|ipconfig)/iF // Restrict to non-system UserSid Values | UserSid=S-1-5-21-* // User case() to create discovery command counter | case { FileName=/whoami/iF | whoami:="1"; FileName=/ping/iF | ping:="1"; FileName=/net1?/iF | net:="1"; FileName=/systeminfo/iF | systeminfo:="1"; FileName=/quser/iF | quser:="1"; FileName=/ipconfig/iF | ipconfig:="1"; } // Aggregate results by duration used in time picker | groupBy([UserName, UserSid], function=([sum(whoami, as=whoami), sum(ping, as=ping), sum(net, as=net), sum(systeminfo, as=systeminfo), sum(quser, as=quser), sum(ipconfig, as=ipconfig), selectLast([CommandLine])]), limit=max) // Rename field for clarity | rename(field="CommandLine", as="LastCommandRun") // Get total number of discovery commands run per UserName/UserSid key pair | totalDiscovery:=whoami+ping+net+systeminfo+quser+ipconfig // Set threshold for commands runs (optional) | totalDiscovery>5 // Reorder using table for easier reading | table([UserName, UserSid, totalDiscovery, whoami, ping, net, systeminfo, quser, ipconfig, LastCommandRun])

CrowdStrike

// CVE-2025-53770 - WebShell Discovery from w3wp.exe correlate( cmd: { #event_simpleName=ProcessRollup2 event_platform=Win FileName="cmd.exe" ParentBaseFileName="w3wp.exe" } include: [aid, ComputerName, TargetProcessId, ParentBaseFileName, FileName, CommandLine], pwsh: { #event_simpleName=ProcessRollup2 event_platform=Win FileName="powershell.exe" | aid <=> cmd.aid | ParentProcessId <=> cmd.TargetProcessId } include: [aid, ComputerName, TargetProcessId, ParentBaseFileName, FileName, CommandLine], aspx: { #event_simpleName=/^(NewScriptWritten|WebScriptFileWritten)$/ event_platform=Win FileName=/\.aspx/i | aid <=> cmd.aid | ContextProcessId <=> pwsh.TargetProcessId } include: [aid, ComputerName, TargetFileName], sequence=true, within=5m)

T1190, T1620

CrowdStrike

// Make a bad attempt to locate WSUS-involved devices | defineTable(query={ #repo = "base_sensor" #event_simpleName="ProcessRollup2" and "WSUS" | groupBy([ComputerName]) }, include=[ComputerName], name="LocateAnythingWSUS", start=1d) // Get OsVersionInfo events; sent by sensor every 24-hours or at sensor start or update | #event_simpleName=OsVersionInfo // Narrow search to only include Windows systems | in(field="event_platform", values=[Win]) | in(field=ProductName, values=["*server*"], ignoreCase=true) | case { event_platform=Win MajorVersion=10 MinorVersion=0 BuildNumber=17763 SubBuildNumber<7922 | Status:="NEEDS PATCH"; event_platform=Win MajorVersion=10 MinorVersion=0 BuildNumber=20348 SubBuildNumber<4297 | Status:="NEEDS PATCH"; event_platform=Win MajorVersion=10 MinorVersion=0 BuildNumber=26100 SubBuildNumber<6905 | Status:="NEEDS PATCH"; event_platform=Win MajorVersion=10 MinorVersion=0 BuildNumber=25398 SubBuildNumber<1916 | Status:="NEEDS PATCH"; event_platform=Win MajorVersion=10 MinorVersion=0 BuildNumber=26100 SubBuildNumber<6905 | Status:="NEEDS PATCH"; event_platform=Win MajorVersion=10 MinorVersion=0 BuildNumber=14393 SubBuildNumber<8524 | Status:="NEEDS PATCH"; event_platform=Win MajorVersion=6 MinorVersion=2 BuildNumber=9200 SubBuildNumber<25728 | Status:="NEEDS PATCH"; event_platform=Win MajorVersion=6 MinorVersion=3 BuildNumber=9600 SubBuildNumber<22826 | Status:="NEEDS PATCH"; event_platform=Win | Status:="OK"; *; } | OSVersion := format(format="%s.%s.%s.%s", field=[MajorVersion, MinorVersion, BuildNumber, SubBuildNumber]) // Aggregate results into tabular format | groupBy([ComputerName], function=([selectLast([aid, ComputerName, event_platform, ProductName, OSVersion, Status, LocalAddressIP4, @timestamp])]), limit=max) // Move timestamps from epoch to human readable | formatTime(format="%F %T", as="LastUpdated", field=@timestamp) // Modify field names for easier reading | rename([[aid, "Agent ID"], [event_platform, Platform]]) // Aggregate results into tabular format with cleaner ordering | groupBy(["Agent ID", ComputerName, Platform, ProductName, OSVersion, Status, "External IP", LocalAddressIP4, LastUpdated], function=[], limit=max) // Set default values for easier reading | default(value="-", field=[ComputerName, OSVersion, Status, LocalAddressIP4, LastUpdated, WSUSDetected], replaceEmpty=true) | case { match(file="LocateAnythingWSUS", field=ComputerName, column=ComputerName) | WSUSDetected := "Potentially"; * | WSUSDetected := "No"; } | drop(@timestamp) | sort(WSUSDetected, ComputerName)

AAuraa

// Get UI Audit Events #repo="detections" ExternalApiType=/Remote/ // Check commands for "get", "put", "memdump", "xmemdump", "run", "put-and-run" | array:regex("Commands[]", regex="get|put|memdump|xmemdump|run|put-and-run") // Create unified "Commands" field | concatArray("Commands", separator="; ", as=Commands) // Check to make sure Commands is populated | Commands=* // Aggregate results | groupBy([UserName, AgentIdString], function=([collect([Commands])])) | groupBy([UserName], function=([count(AgentIdString, as=SystemsAccssed), collect([Commands])]))

ByteRay GmbH

// Get all process execution and DNS events on Windows (#event_simpleName=ProcessRollup2 OR #event_simpleName=DnsRequest) event_platform=Win | ComputerName=~wildcard(?ComputerName, ignoreCase=true) // Normalize file name value across both events | fileName:=concat([FileName, ContextBaseFileName]) // Make sure responsible process is a web browser | in(field="fileName", values=[chrome.exe, firefox.exe, msedge.exe], ignoreCase=true) // Normalize Falcon UPID | falconPID:=TargetProcessId | falconPID:=ContextProcessId // Use selfJoinFilter to make sure execution and DNS resolution occured under the same UPID value | selfJoinFilter(field=[aid, falconPID], where=[{#event_simpleName=ProcessRollup2}, {#event_simpleName=DnsRequest}]) // Aggregate results | groupBy([aid, falconPID], function=([collect([ComputerName, UserName, fileName, DomainName])]))

CrowdStrike

#event_simpleName=/UserLogon/ | case{ #event_simpleName=UserLogon | SuccessLogonTime:=ContextTimeStamp; #event_simpleName=UserLogonFailed2 | FailedLogonTime:=ContextTimeStamp; } | groupBy([UserSid, UserName], function=([min(FailedLogonTime, as=FirstFailedLogon), max(FailedLogonTime, as=LastFailedLogon), max(SuccessLogonTime, as=LastSuccessfulLogin), count(SuccessLogonTime, as=TotalSuccessfulLogins), count(FailedLogonTime, as=TotalFailedLogins), selectFromMax(field="@timestamp", include=[PasswordLastSet]), {#event_simpleName=UserLogon | selectFromMax(field="@timestamp", include=[ComputerName]) | rename(field="ComputerName", as="LastLoggedOnHost")}])) | TotalFailedLogins>3 | $falcon/helper:enrich(field=UserLogonFlags) | formatTime(format="%F %T", field=FirstFailedLogon, as="FirstFailedLogon", timezone="EST") | formatTime(format="%F %T", field=LastFailedLogon, as="LastFailedLogon", timezone="EST") | formatTime(format="%F %T", field=LastSuccessfulLogin, as="LastSuccessfulLogin", timezone="EST") | PasswordLastSet:=PasswordLastSet*1000 | formatTime(format="%F %T", field=PasswordLastSet, as="PasswordLastSet", timezone="EST") | default(value="-", field=[FirstFailedLogon, LastFailedLogon, LastSuccessfulLogin, TotalSuccessfulLogins, TotalFailedLogins, PasswordLastSet, LastLoggedOnHost]) | sort(order=desc, TotalFailedLogins, limit=20000)

CrowdStrike

// Get Windows UserLogonFailed events event_platform=Win #event_simpleName=UserLogonFailed2 // This line is completely optional, but converts SubStatus to hex | SubStatus_hex:=format(field=SubStatus, "%x") | SubStatus_hex:=upper(SubStatus_hex) | SubStatus_hex:=format(format="0x%s", field=[SubStatus_hex]) // Aggregate results | groupBy([aid, ComputerName, UserName, LogonType, SubStatus_hex, SubStatus], function=([count(aid, as=FailCount), min(ContextTimeStamp, as=FirstLogonAttempt), max(ContextTimeStamp, as=LastLogonAttempt), collect([LocalAddressIP4, aip])])) // Perform rate calculations | firstLastDeltaHours:=((LastLogonAttempt-FirstLogonAttempt)/60/60) | round("firstLastDeltaHours") | logonAttemptsPerHour:=(failCount/firstLastDeltaHours) | round("logonAttemptsPerHour") // Convert timestamps from epoch to human | FirstLogonAttempt:=formatTime(format="%F %T.%L", field="FirstLogonAttempt") | LastLogonAttempt:=formatTime(format="%F %T.%L", field="LastLogonAttempt") // Optional: set threshold for failed logins | FailCount> 5 // Sort descending | sort(FailCount, order=desc, limit=2000) // Convert fields from decimal to human readable | $falcon/helper:enrich(field=LogonType) | $falcon/helper:enrich(field=SubStatus)

CrowdStrike

// Get file names of interest event_platform=Win #event_simpleName=ProcessRollup2 FileName=/(whoami|arp|cmd|net|net1|ipconfig|route|netstat|nslookup|nltest|systeminfo|wmic|tasklist|tracert|ping|adfind|nbtstat|find|ldifde|netsh|wbadmin)\.exe/i // Aggregate in 10 minute buckets; set search to 24 hours | bucket(span=10min, field=[cid, aid, ComputerName,ParentBaseFileName,ParentProcessId], function=[count(FileName, distinct=true, as=fNameCount), collect([FileName, CommandLine])], limit=500) // Set threshold at three distinct file name values | test(fNameCount>=3)

CrowdStrike

// Look for process handles opening Falcon #event_simpleName=FalconProcessHandleOpDetectInfo FileName="WerFaultSecure.exe" // Check for command line switching signal | GrandparentCommandLine=/\.exe"?\s+\d+\s+\d+$/ OR ParentCommandLine=/\.exe"?\s+\d+\s+\d+$/ OR CommandLine=/\.exe"?\s+\d+\s+\d+$/ // Create process lineage tree for easier reading | ProcessLineage:=format(format="%s (%s)\n └ %s (%s)\n └ %s (%s)", field=[GrandparentImageFileName, GrandparentCommandLine, ParentImageFileName, ParentCommandLine, ImageFileName, CommandLine]) // Output deatils to table | table([@timestamp, aid, ComputerName, ContextProcessId, ProcessLineage]) // Create direct link to Process Explorer - Uncomment the rootURL value that matches your cloud | rootURL := "https://falcon.crowdstrike.com/" /* US-1 */ //| rootURL := "https://falcon.us-2.crowdstrike.com/" /* US-2 */ //| rootURL := "https://falcon.laggar.gcw.crowdstrike.com/" /* Gov */ //| rootURL := "https://falcon.eu-1.crowdstrike.com/" /* EU */ | format("[Responsible Process](%sgraphs/process-explorer/tree?id=pid:%s:%s)", field=["rootURL", "aid", "ContextProcessId"], as="Process Explorer") // Remove unnecessary fields | drop([rootURL, ContextProcessId])

CrowdStrike

// Get browser extension event #event_simpleName=InstalledBrowserExtension BrowserExtensionId!="no-extension-available" // Aggregate by event_platform, BrowserName, ExtensionID and ExtensionName | groupBy([event_platform, BrowserName, BrowserExtensionId, BrowserExtensionName], function=([count(aid, distinct=true, as=TotalEndpoints)])) // Check to see if the extension is installed on fewer than 50 systems | test(TotalEndpoints<50) // Create a link to the Chrome Extension Store | format("[See Extension](https://chromewebstore.google.com/detail/%s)", field=[BrowserExtensionId], as="Chrome Store Link") // Sort in descending order | sort(order=desc, TotalEndpoints, limit=1000) // Convert the browser name from decimal to human-readable | case{ BrowserName="3" | BrowserName:="Chrome"; BrowserName="4" | BrowserName:="Edge"; *; }

CrowdStrike

// Get browser extension event #event_simpleName=InstalledBrowserExtension BrowserExtensionId!="no-extension-available" // Look for string "vpn" in extension name | BrowserExtensionName=/vpn/i // Make a new field that includes the extension ID and Name | Extension:=format(format="%s (%s)", field=[BrowserExtensionId, BrowserExtensionName]) // Aggregate by endpoint and browser profile | groupBy([event_platform, aid, ComputerName, UserName, BrowserProfileId, BrowserName], function=([collect([Extension])])) // Get unnecessary field | drop([_count]) // Convert browser name from decimal to human readable | case{ BrowserName="3" | BrowserName:="Chrome"; BrowserName="4" | BrowserName:="Edge"; *; }

CrowdStrike

#event_simpleName=InstalledBrowserExtension BrowserExtensionId!="no-extension-available" | groupBy([event_platform, BrowserName, BrowserExtensionId, BrowserExtensionName], function=([count(aid, distinct=true, as=TotalEndpoints)])) | format("[See Extension](https://chromewebstore.google.com/detail/%s)", field=[BrowserExtensionId], as="Chrome Store Link") | sort(order=desc, TotalEndpoints, limit=1000) | case{ BrowserName="3" | BrowserName:="Chrome"; BrowserName="4" | BrowserName:="Edge"; *; }

CrowdStrike

#event.dataset = falcon.cloud | OperationName = CreateAPIClient | user.id = * | "Client Name" := rename(Attributes.name) | "Client ID" := rename(Attributes.APIClientID) | "Scope(s)" := rename("Attributes.scope(s)") | table([timestamp,"Client Name","Client ID", "Scope(s)",OperationName,Success,Source,SourceIp,UserId])

ByteRay

#event_simpleName=UserLogon UserSid=S-1-5-21-* | in(LogonType, values=["2","10"]) | ipLocation(aip) | case {UserIsAdmin = "1" | UserIsAdmin := "Yes" ; UserIsAdmin = "0" | UserIsAdmin := "No" ; * } | case { LogonType = "2" | LogonType := "Interactive" ; LogonType = "3" | LogonType := "Network" ; LogonType = "4" | LogonType := "Batch" ; LogonType = "5" | LogonType := "Service" ; LogonType = "7" | LogonType := "Unlock" ; LogonType = "8" | LogonType := "Network Cleartext" ; LogonType = "9" | LogonType := "New Credentials" ; LogonType = "10" | LogonType := "Remote Interactive" ; LogonType = "11" | LogonType := "Cached Interactive" ; * } | PasswordLastSet := PasswordLastSet*1000 | LogonTime := LogonTime*1000 | PasswordLastSet := formatTime("%Y-%m-%d %H:%M:%S", field=PasswordLastSet, locale=en_US, timezone=Z) | LogonTime := formatTime("%Y-%m-%d %H:%M:%S", field=LogonTime, locale=en_US, timezone=Z) | table(["LogonTime", "aid", "UserName", "UserSid", "LogonType", "UserIsAdmin", "PasswordLastSet", "aip.city", "aip.state", "aip.country"])

CrowdStrike

// Make table that contains Agent ID values of Windows systems with WSUS service discovered | defineTable(query={ #repo = "base_sensor" event_platform=Win #event_simpleName="ProcessRollup2" FileName="wsusservice.exe" | groupBy([aid], function=[] ) }, include=[aid], name="WsusServiceRunning", start=7d) // Get OsVersionInfo events; sent by sensor every 24-hours or at sensor start or update | #event_simpleName=OsVersionInfo event_platform=Win // Aggregate results to get latest information per Agent ID value | groupBy([aid], function=([selectLast([@timestamp, ComputerName, event_platform, ProductName, LocalAddressIP4])]), limit=max) // Merge details from AID Master | match(file="aid_master_main.csv", field=[aid], include=[ProductType]) // Restrict above results to servers or domain controllers | in(field="ProductType", values=[2,3]) // Evaluate Windows build numbers | case { event_platform=Win MajorVersion=10 MinorVersion=0 BuildNumber=17763 SubBuildNumber<7922 | Status:="NEEDS PATCH"; event_platform=Win MajorVersion=10 MinorVersion=0 BuildNumber=20348 SubBuildNumber<4297 | Status:="NEEDS PATCH"; event_platform=Win MajorVersion=10 MinorVersion=0 BuildNumber=26100 SubBuildNumber<6905 | Status:="NEEDS PATCH"; event_platform=Win MajorVersion=10 MinorVersion=0 BuildNumber=25398 SubBuildNumber<1916 | Status:="NEEDS PATCH"; event_platform=Win MajorVersion=10 MinorVersion=0 BuildNumber=26100 SubBuildNumber<6905 | Status:="NEEDS PATCH"; event_platform=Win MajorVersion=10 MinorVersion=0 BuildNumber=14393 SubBuildNumber<8524 | Status:="NEEDS PATCH"; event_platform=Win MajorVersion=6 MinorVersion=2 BuildNumber=9200 SubBuildNumber<25728 | Status:="NEEDS PATCH"; event_platform=Win MajorVersion=6 MinorVersion=3 BuildNumber=9600 SubBuildNumber<22826 | Status:="NEEDS PATCH"; * | Status:="OK"; } // Check to see if WSUS service was discovered on host | case { match(file="WsusServiceRunning", field=aid, column=aid) | WsusService := "YES"; * | WsusService := "NO"; } // Oragnize table | table([@timestamp, aid, ComputerName, WsusService, Status, ProductName, LocalAddressIP4], sortby=Status, order=asc, limit=50000) // Make ProductType field human readable | $falcon/helper:enrich(field=ProductType)

Crowdstrike

readfile("aid_master_main.csv") | test(FirstSeen > start()) | cid=?cid | ProductType match { 1 => ProductType := "Workstation"; 2 => ProductType := "Domain controller"; 3 => ProductType := "Server"; * => *; } | LastSeen := rename(Time) | match(file="aid_master_details.csv", field=aid, include=[HostHiddenStatus], strict=false) | $falcon/investigate:hideHiddenHosts() | default(field=[ComputerName], value="--", replaceEmpty=true) | LastSeen_UTC_readable := formatTime("%FT%T%z", field=LastSeen) | FirstSeen_UTC_readable := formatTime("%FT%T%z", field=FirstSeen) | table([ComputerName, MAC, LocalAddressIP4, AgentVersion, FirstSeen, FirstSeen_UTC_readable, LastSeen, LastSeen_UTC_readable, ProductType, Version, Timezone, MachineDomain, SiteName, OU, aid], sortby=ComputerName, order=asc, limit=20000) | default(field=[LocalAddressIP4, MAC, OU, MachineDomain, SiteName, ProductType, Version, FirstSeen, LastSeen, AgentVersion], value="--", replaceEmpty=true)

CrowdStrike

#repo=detections EventType = "Event_ExternalApiEvent" ExternalApiType = "Event_UserActivityAuditEvent" OperationName=containment_requested cid=?{cid="*"} | rename(field=AgentIdString,as=aid) | join({ $falcon/investigate:aid_base() | groupBy(aid, function=selectLast([MachineDomain, OU, SiteName, ComputerName]), limit=max) }, field=aid, include=[MachineDomain, OU, SiteName, ComputerName], mode=left, start=12h) | default(field=[ComputerName, MachineDomain, OU, SiteName],value="--",replaceEmpty=true) | field_temp:=?{ComputerName="*"} | case { field_temp != /^\*$/ | regex(field=field_temp,regex = "(?<field_matched>.*?)(,|$)", repeat="true") | test(ComputerName==field_matched) | drop([field_matched,field_temp]) ; field_temp = /\*$/ | ComputerName=* | drop([field_temp]) ; } | join({ #repo=sensor_metadata #data_source_name = managedassets-ds | GatewayMAC != "--" AND GatewayIP != "--" | groupBy(aid, function=collect([MAC, LocalAddressIP4]), limit=max) }, field=aid, include=[MAC,LocalAddressIP4], mode=left, start=5d) | default(field=[LocalAddressIP4, MAC],value="--",replaceEmpty=true) | timestamp_UTC_readable := formatTime("%FT%T%z", field=@timestamp) | groupBy([@timestamp, timestamp_UTC_readable, UserId, UserIp, ComputerName, LocalAddressIP4, MAC, aid, cid], limit=max)

CrowdStrike

// Get RTR Start events #repo=detections #event_simpleName=Event_RemoteResponseSessionStartEvent // Rename Agent ID value | rename(field="AgentIdString", as="aid") // Display results in table | table([StartTimestamp, UserName, aid], limit=20000) // Bring in data from AID Master lookup file | aid=~match(file="aid_master_main.csv", column=[aid], strict=false) // Convert timestamp to human-readable value | formatTime(format="%F %T %Z", as=StartTimestamp, field=StartTimestamp)

CrowdStrike

#event_simpleName = SensorHeartbeat | in(field=event_platform, values=[?Platform]) | ComputerName like ?ComputerName | aid = ?aid | groupBy([aid, ComputerName], function=session([max(@timestamp),min(@timestamp)])) | "Last seen" := formatTime("%d-%b-%Y %H:%M:%S", field=_max) | "First seen" := formatTime("%d-%b-%Y %H:%M:%S", field=_min) | "Age in h" := _duration/3600000 | age := formatDuration(_duration, precision=2) | "Age in h" := format(format="%.2f", field=["Age in h"]) | sort(field=_duration) | drop([@timestamp,_duration,_max,_min])

ByteRay

#event_simpleName=/FileWritten/i and IsOnRemovableDisk = 1 | VolumeSessionUUID=* | "Size (MB)" := Size/1024/1024 | format(format="%.2f", field=["Size (MB)"], as="Size (MB)") | join(query={#event_simpleName=DcUsbDeviceConnected | rename(DeviceInstanceId, as="DiskParentDeviceInstanceId")}, mode=left, field=[DiskParentDeviceInstanceId], include=[DeviceManufacturer, DeviceProduct]) | groupBy([ComputerName, UserName, DeviceManufacturer, DeviceProduct], function=[min(field=@timestamp, as=firstTime),max(field=@timestamp, as=lastTime),sum(Size, as="Size")]) | "Size (MB)" := Size/1024/1024 | format(format="%.2f", field=["Size (MB)"], as="Size (MB)")

T1052

ByteRay GmbH

#event_simpleName = DnsRequest | in(field="DomainName", values=["cloudflare-dns.com", "dns.google", "dns.quad9.net","mozilla.cloudflare-dns.com"]) | groupBy(["ComputerName","ContextBaseFileName"])

ByteRay GmbH

#event_simpleName=DnsRequest | DomainName=/anydesk\.com|action1\.com|beamyourscreen\.com|snapview\.de|rustdesk\.com|fleetdeck\.io|tailscale\.com|dwservice\.net|secure\.logmein\.com|teamviewer\.com|screenconnect\.com|fixme\.it|n-able\.com|domotz\.com|datto\.com|level\.io|itarian\.com|pulseway\.com|zoho\.com|manageengine\.com|bomgarcloud\.com|bomgar\.com|zabbix\.com/i | groupBy([DomainName],function=[collect(ContextBaseFileName), count(aid,distinct=true,as=HostCount)]) | sort(HostCount,order=asc)

T1219.002

ByteRay GmbH

name=ActiveDirectoryAudit* | setField(target="ActiveDirectoryAuditActionType", value=if(ActiveDirectoryAuditActionType == 4, then="GROUP_MEMBER_ADDED", else=(if(ActiveDirectoryAuditActionType == 0, then="CREATED", else=(if(ActiveDirectoryAuditActionType == 1, then="DELETED", else=(if(ActiveDirectoryAuditActionType == 2, then="MODIFIED", else=(if(ActiveDirectoryAuditActionType == 8, then="GROUP_MEMBER_REMOVED", else=(if(ActiveDirectoryAuditActionType == 16, then="PASSWORD_CHANGE", else=(if(ActiveDirectoryAuditActionType == 32, then="PASSWORD_RESET", else=(if(ActiveDirectoryAuditActionType == 64, then="ENABLED", else=(if(ActiveDirectoryAuditActionType == 128, then="DISABLED", else=(if(ActiveDirectoryAuditActionType == 256, then="LOCKED", else=(if(ActiveDirectoryAuditActionType == 512, then="UNLOCKED", else=(UNKNOWN))))))))))))))))))))))) | groupBy([@timestamp,ActiveDirectoryAuditActionType,ComputerName,TargetDomainControllerHostName,DetectName,Severity,AddedPrivileges,GroupMemberAccountName,PerformedOnAccountName,PerformedByAccountObjectName]) | sort(@timestamp, limit=20000)

T1078, T1098

ByteRay GmbH

"#event_simpleName" = ProcessRollup2 event_platform="Win" FileName=/(cmd.exe|powershell.exe)/i | wildcard(field=ComputerName, pattern=?ComputerName, ignoreCase=true) | groupBy([ParentBaseFileName], function=[count(aid, distinct=true, as="DistinctHosts")]) | sort(DistinctHosts) | rename(field="ParentBaseFileName", as="FileName")

T1059

ByteRay GmbH

"#event_simpleName" = ProcessRollup2 event_platform="Win" CommandLine=/REDACTED/ | wildcard(field=ComputerName, pattern=?ComputerName, ignoreCase=true) | groupBy([FileName], function=[count(aid, distinct=true, as="Hosts")]) | sort(Hosts)

T1552

ByteRay GmbH

#event_simpleName=AgentOnline event_platform=Win | groupBy([aid], function=([selectLast([BaseTime])])) | LastReboot_milli:=(BaseTime/1000*1024)+978307200 | round("LastReboot_milli") | LastRebootAgo:=now()-(LastReboot_milli*1000) | formatDuration("LastRebootAgo", precision=2) | LastReboot:=formatTime(format="%F %T %Z", field="LastReboot_milli")

CrowdStrike

CloudService="IAM" | in(field="policy_id", values=["576", "1", "466", "1006", "12", "15", "16", "18", "13", "17", "450", "577", "451", "8"]) | groupBy([PolicyStatement])

CrowdStrike

CloudService="IAM" | in(field="policy_id", values=["5", "612", "401", "461", "7", "611", "444", "190", "203", "6", "563", "610"]) | groupBy(["policy_statement"])

CrowdStrike

CloudService="IAM" | in(field="policy_id", values=["188", "10", "189", "602", "187", "539"]) | groupBy([PolicyStatement]) | #type != "KGHOST_Gametime"

CrowdStrike

#event_simpleName=UserAccountCreated | table([@timestamp, UserName, aid, aip, ComputerName, event_platform, LocalIP, name], limit=20000) | sort(@timestamp)

T1098

ByteRay GmbH

#event_simpleName=UserAccountDeleted | groupBy([UserName, aid, aip, ComputerName, event_platform, LocalIP, name], function=selectLast([@timestamp])) | table([@timestamp, UserName, ComputerName, aid, aip, event_platform, LocalIP, name]) | sort(@timestamp)

T1098

ByteRay GmbH

#event_simpleName=SensorHeartbeat | groupBy([aid], function=selectLast([@timestamp, ComputerName, SensorStateBitMap]), limit=max) | bitfield:extractFlags( field=SensorStateBitMap, output=[ [2, RTR_Locally_Disabled] ]) | RTR_Locally_Disabled="true"

CrowdStrike

#event.dataset="falcon.identity" | network.protocol="ntlm_v1" | groupBy([SourceAccountUserName, host.hostname, TargetServerHostName])

ByteRay GmbH

#event_simpleName=SensorHeartbeat | timeChart(span=30min, function=count(as=SensorHeartbeat))

ByteRay

#repo=sensor_metadata #data_source_name=aidmaster #data_source_group=aidmaster-api | groupBy([aid], function=([selectFromMax(field="@timestamp", include=[ComputerName, Time, Version, ConfigIDBuild, AgentVersion])])) | match(file="falcon/helper/sensors_support_info.csv", field=ConfigIDBuild, column=BUILD, ignoreCase=true, strict=true) | parseTimestamp("M/d/yy",field=SUPPORT_ENDS, as=SUPPORT_ENDS_EPOCH, timezone="UTC") | case{ test(now()>SUPPORT_ENDS_EPOCH) | SUPPORTED:="NO"; * | SUPPORTED:="YES"; } | groupBy([PLATFORM, VERSION_FAMILY, SUPPORTED], function=([count(aid, as=Count), collect([RELEASE_DATE, SUPPORT_ENDS])]))

CrowdStrike

event_type=ZeroTrustHostAssessment | groupBy([aid], function=([selectFromMax(field="@timestamp", include=[scores.os, scores.sensor, scores.overall])])) | join(query={#data_source_name=aidmaster }, field=[aid], include=[ComputerName, event_platform])

CrowdStrike

#event_simpleName=DcUsbDeviceConnected | DeviceTimeStamp :=parseTimeStamp(field=DeviceTimeStamp,format=seconds) | "Time Inserted" := formatTime("%Y-%m-%dT%H:%M:%S.%L", field=DeviceTimeStamp,timezone="Zulu") | rename([[ComputerName,"Host Name"],[DevicePropertyClassName,"Connection Type"],[DeviceManufacturer,Manufacturer],[DeviceProduct,"Product Name"], [DevicePropertyDeviceDescription,Description], [DevicePropertyClassGuid,GUID],[DeviceInstanceId,"Device ID"]]) | groupBy([aid, "Device ID"], function=([collect(["TimeInserted", ComputerName, "Connection Type",Manufacturer, "Product Name", Description, GUID])]))

CrowdStrike

#event_simpleName=DnsRequest DomainName=* | match(file="shadow-saas.csv", field=[DomainName], column=[Domains], strict=true,mode=glob) | Category=?Category | Vendor=?Vendor | Application=?Application | groupBy(ComputerName, Vendor, Application, Category)

T1526

ByteRay GmbH

#repo=base_sensor #event_simpleName=/^ActiveDirectory(?:(?!Audit|Account).)*$/i | aid=?SelectedAid | case { ActiveDirectoryDataProtocol=0 | Protocol:="LDAP"; ActiveDirectoryDataProtocol=1 | Protocol:="DCE/RPC"; ActiveDirectoryDataProtocol=2 | Protocol:="SMB"; ActiveDirectoryAuthenticationMethod=/[1,2,5]/F | Protocol:="NTLM"; ActiveDirectoryAuthenticationMethod=0 | Protocol:="Kerberos"; } | timeChart(span=15m, series=Protocol, function=sum("AggregationActivityCount"))

CrowdStrike

in(#event_simpleName, values=["ProcessRollup2","ProcessBlocked"]) | event_platform=Win | ImageFileName=/regsvr32.exe/i CommandLine=/scrobj.dll/i CommandLine=/i:/i

T1218.010

ByteRay GmbH

#repo=base_sensor #event_simpleName=IdpPolicy*RuleMatch | in(field=cid, values=[?SelectedCid]) | match(file="aid_master_main.csv", field=[cid, aid]) // Filters | in(field=MachineDomain, values=[?SelectedDomain]) | case { IdpPolicyMfaStatus=128 | MfaError:="User Not Enrolled"; IdpPolicyMfaStatus=256 | MfaError:="Service Error"; *; } | timeChart(series=MfaError)

CrowdStrike

#event_simpleName=ProcessRollup2 | (event_platform=Win AND ImageFileName=/mongod\.exe|mongos\.exe/i) OR (event_platform=Lin AND ImageFileName=/mongod|mongos/i) | table([@timestamp, aid, ComputerName, UserName, ImageFileName])

ByteRay GmbH

#event_simpleName = SensorHeartbeat | groupBy(aid,event_platform) | groupBy([event_platform])

ByteRay GmbH

ImageScanEventType = ImageVulnerabilityEvent | array:eval("CVEMapping[]", asArray="PackageName[]", function={PackageName := splitString(by="\|",field="CVEMapping",index=1)}) | array:drop("CVEMapping[]") | array:contains(array="PackageName[]", value=?Package) | groupBy([ImageInfo.Registry,ImageInfo.Repository])

ByteRay

#event_simpleName=OsVersionInfo | AgentVersion=/(?<ShortAgentVersion>\d+\.\d+\.)/ | timeChart(ShortAgentVersion,span="1d")

ByteRay GmbH

#event_simpleName=UserLogoff | groupBy([UserName, name, aid, aip, ComputerName, event_platform, LocalIP, LogonDomain, LogonServer, LogonType], function=[count(@timestamp), selectLast([@timestamp])]) | table([@timestamp, UserName, ComputerName, aid, aip, event_platform, LocalIP, LogonDomain, LogonType], limit=20000)

T1078

ByteRay GmbH

#event_simpleName=UserLogon | groupBy([UserName, name, aid, aip, ComputerName, event_platform, LocalIP, LogonDomain, LogonServer, LogonType], function=[count(@timestamp), selectLast([@timestamp])]) | table([@timestamp, UserName, ComputerName, aid, aip, event_platform, LocalIP, LogonDomain, LogonType], limit=20000)

T1078

ByteRay GmbH

#event_simpleName="NetShareAdd" | wildcard(field=UserName, pattern=?UserName, ignoreCase=true) | wildcard(field=ComputerName, pattern=?ComputerName, ignoreCase=true) | groupBy([ComputerName, UserName, ShareName, SharePath, ShareData, @timestamp])

CrowdStrike