The open CQL library for Falcon Next‑Gen SIEM.

#repo=base_sensor #event_simpleName="IdpDcPerfReport" | aid=?SelectedAid | IdpPerfCounterAvg:= IdpPerfCounterSum / IdpPerfSampleCount | timeChart(span=15m, function=[avg("IdpPerfCounterAvg")], series=IdpPerfCounterPath)

CrowdStrike

// Detects logins involving default administrator accounts #event_simpleName=/UserLogon.*/i // Adjust or extend this to match your custom honeytoken accounts | UserSid = /S-1-5-21-\d*-\d*-\d*-500/i

T1078

ByteRay GmbH

#event_simpleName=ProcessRollup2 | ImageFileName=/\\(powershell(_ise)?|pwsh)\.exe/i | CommandLength := length("CommandLine") | CommandLength>0 | aid=?AID // Classify Data into Historical and LastDay | case { test(@timestamp < (end() - duration(7d))) | DataSet:="Historical"; test(@timestamp > (end() - duration(1d))) | DataSet:="LastDay"; * } // Calculate Average Command Length | groupBy([DataSet, aid], function=avg(CommandLength)) | case { DataSet="Historical" | rename(field="_avg", as="historicalAvg"); DataSet="LastDay" | rename(field="_avg", as="todaysAvg"); * } // Aggregate Averages | groupBy([aid], function=[avg("historicalAvg", as=historicalAvg), avg("todaysAvg", as=todaysAvg)]) // Calculate Percentage Increase | PercentIncrease := (todaysAvg - historicalAvg) / historicalAvg * 100 | format("%d", field=PercentIncrease, as=PercentIncrease) | format(format="%.2f", field=[historicalAvg], as=historicalAvg) // Filter and Sort Results | PercentIncrease > 0 | sort(PercentIncrease, limit=10000)

T1059.001, T1027.010

ByteRay GmbH

#Vendor="aws" #event.dataset="cloudtrail.s3" #repo!="xdr*" | #event.kind="event" #event.outcome="success" | event.action="PutBucketPolicy" | cloud.Storage.bucket_name =~ in(values=[?BucketName]) | cloud.account.id =~ in(values=[?AwsAccount]) | UserARN := getField("Vendor.userIdentity.arn") | BucketName := getField("cloud.Storage.bucket_name") | select(["@timestamp","BucketName", "UserARN"])

ByteRay GmbH

#event_simpleName=OsVersionInfo | groupBy([aid, ComputerNam, RFMState], function=selectLast([@timestamp])) | RFMState = 1

ByteRay

#event_simpleName=OsVersionInfo event_platform=Win | groupby(aid, function=selectLast([ProductName])) | groupBy([ProductName], function=stats([count(aid, as="endpointCount")]))

CrowdStrike

#event_simpleName=NetworkConnectIP4 aid=?aid ComputerName=?Computername RemoteAddressIP4=?RemoteIP | !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8","192.168.0.0/16","172.16.0.0/12","127.0.0.0/8"]) | join({#event_simpleName=ProcessRollup2 FileName=?Processname }, field=[ContextProcessId],key=TargetProcessId, include=[FileName, UserName,ImageFileName, RemoteAddressIP4, RemotePort,CommandLine], mode=left) | groupBy(UserName, function=collect([FileName, UserName, ImageFileName, RemoteIP, RPort, CommandLine])) | sort([_count], order=asc)

CrowdStrike

#event_simpleName = UserLogonFailed | groupBy(UserName, function=([count(timestamp, distinct=true, as=uniqueFailedLogons), (count(aid, distinct=true, as=uniqueEP)), collect(fields = [ComputerName, aid], limit =10000)])) | default(field = "UserName", value="-", replaceEmpty=true) | uniqueFailedLogons >= 5 | uniqueEP >= 10 | sort(uniqueEP)

CrowdStrike

#event_simpleName=/Written/ IsOnRemovableDisk=1 | FileSizeMB:=unit:convert(Size, to=M) | groupBy([ComputerName], function=([sum(Size, as=SizeBytes), sum(FileSizeMB, as=FileSizeMB), count(TargetFileName, as="File Count"), collect([TargetFileName])]))

CrowdStrike

#event_simpleName=ScheduledTaskRegistered | parseXml(TaskXml) | Trigger:=rename(Task.Triggers.CalendarTrigger.Enabled) | Trigger=* // Remove this line if you don't care if it's empty | table([aid, Trigger, TaskXml], limit=1000)

T1053.005

CrowdStrike

#event_simpleName=ScheduledTaskRegistered | parseXml(TaskXml) | Trigger:=rename(Task.Triggers.TimeTrigger.Enabled) | Trigger=* // Remove this line if you don't care if it's empty | table([aid, Trigger, TaskXml], limit=1000)

T1053.005

CrowdStrike

#event_simpleName=ScheduledTaskRegistered | parseXml(TaskXml) | Trigger:=rename(Task.Triggers.LogonTrigger.Enabled) | Trigger=* // Remove this line if you don't care if it's empty | table([aid, Trigger, TaskXml], limit=1000)

T1053.005

CrowdStrike

#event_simpleName=ScheduledTaskRegistered | parseXml(TaskXml) | Trigger:=rename(Task.Triggers.BootTrigger.Enabled) | Trigger=* // Remove this line if you don't care if it's empty | table([aid, Trigger, TaskXml], limit=1000)

T1053.005

CrowdStrike

#event_simpleName=ScheduledTaskRegistered | parseXml(TaskXml) | Trigger:=rename(Task.Triggers.EventTrigger.Enabled) | Trigger=* // Remove this line if you don't care if it's empty | table([aid, Trigger, TaskXml], limit=1000)

T1053.005

CrowdStrike

#event_simpleName=ScheduledTaskRegistered | parseXml(TaskXml) | Hidden:=rename(Task.Settings.Hidden) | Hidden=/true/i | table([aid,Hidden,TaskXml],limit=1000)

T1053.005

CrowdStrike

#event_simpleName=ProcessRollup2 OR #event_simpleName=SyntheticProcessRollup2 | aid=?aid | groupBy([SHA256HashData, ImageFileName], limit=max) | _count <5 | sort(_count, limit=1000)

CrowdStrike

#event_simpleName=ScheduledTaskRegistered | parseXml(TaskXml) | LogonType:=rename(Task.Principals.Principal.LogonType) | LogonType=* // Remove this line if you don't care if it's empty | table([aid, LogonType, TaskXml], limit=1000)

T1053.005

CrowdStrike

#event_simpleName=ScheduledTaskRegistered | parseXml(TaskXml) | RunLevel:=rename(Task.Principals.Principal.RunLevel) | RunLevel=* // Remove this line if you don't care if it's empty | table([aid, RunLevel, TaskXml], limit=1000)

T1053.005

CrowdStrike

#event_simpleName=ScheduledTaskRegistered | parseXml(TaskXml) | UserId:=rename(Task.Principals.Principal.UserId) | table([aid, UserId, TaskXml], limit=1000)

T1053.005

CrowdStrike

#event_simpleName=ScheduledTaskRegistered | parseXml(TaskXml) | ComHandlerData:=rename(Task.Actions.ComHandler.Data) | ComHandlerData=* // Remove this line if you don't care if it's empty | table([aid, ComHandlerData, TaskXml], limit=1000)

T1053.005

CrowdStrike

#event_simpleName=ProcessRollup2 | join({#event_simpleName=FirewallSetRule}, key=ContextProcessId, field=TargetProcessId, include=[FirewallRule, FirewallRuleId]) | ImageFileName=/.*\\(?<fileName>.*\..*)/ | table([aid, UserSid, fileName, FirewallRuleId, FirewallRule, ImageFileName, CommandLine])

CrowdStrike

#event_simpleName=DnsRequest | in(field=DomainName, values=[".ai", ".ai21.com", ".aleph-alpha.com", ".anthropic.com", ".assemblyai.com", ".bolt.ai", ".bubble.io", ".character.ai", ".claude.ai", ".clickup.com", ".codeium.com", ".cohere.ai", ".copy.ai", ".cursor.so", ".deepmind.com", ".deepseek.ai", ".deepl.com", ".dalle.ai", ".elevenlabs.io", ".feedhive.io", ".forefront.ai", ".grok.x.ai", ".gpt3.com", ".huggingface.co", ".inflection.ai", ".jasper.ai", ".llama.ai", ".looka.com", ".lovable.ai", ".midjourney.com", ".mistral.ai", ".openai.com", ".opus.ai", ".perplexity.ai", ".pi.ai", ".poe.com", ".replicate.com", ".runwayml.com", ".rytr.me", ".scale.com", ".stability.ai", ".sudowrite.com", ".synthesia.io", ".tabnine.com", ".together.ai", ".v0.dev", ".vercel.ai", ".vista.social", ".wordtune.com", ".writesonic.com", ".x.ai", ".you.com", "ai21.com", "aleph-alpha.com", "anthropic.com", "api.anthropic.com", "api.openai.com", "assemblyai.com", "bard.google.com", "bedrock.aws.amazon.com", "bolt.ai", "bubble.io", "character.ai", "chat.openai.com", "chatgpt.com", "claude.ai", "clickup.com", "codeium.com", "cohere.ai", "console.anthropic.com", "copilot.github.com", "copilot.microsoft.com", "copy.ai", "cursor.so", "dalle.ai", "deepmind.com", "deepseek.ai", "deepl.com", "elevenlabs.io", "ernie.baidu.com", "feedhive.io", "forefront.ai", "gemini.google.com", "gigachat.sberbank.ru", "grok.x.ai", "gpt3.com", "huggingface.co", "inflection.ai", "jasper.ai", "labs.perplexity.ai", "llama.ai", "looka.com", "lovable.ai", "midjourney.com", "mistral.ai", "openai.com", "opus.ai", "perplexity.ai", "pi.ai", "platform.openai.com", "poe.com", "replicate.com", "runwayml.com", "rytr.me", "scale.com", "stability.ai", "sudowrite.com", "synthesia.io", "tabnine.com", "together.ai", "v0.dev", "vercel.ai", "vista.social", "wordtune.com", "writesonic.com", "x.ai", "you.com"]) | groupBy([DomainName, ComputerName, event_platform]) | sort(field=_count,type=number,order=desc)

ByteRay GmbH

#event_simpleName=ProcessRollup2 OR #event_simpleName=SyntheticProcessRollup2 | aid=?aid | ImageFileName like ?ImageFileName | ImageFileName=/(\/|\\)(?<FileName>\w*\.?\w*)$/ | table([aid, FileName, ImageFileName, CommandLine], limit=1000)

CrowdStrike

#event_simpleName=ProcessRollup2 OR #event_simpleName=SyntheticProcessRollup2 | aid=?aid | CommandLine like ?CommandLine | ImageFileName=/(\/|\\)(?<FileName>\w*\.?\w*)$/ | table([aid, FileName, ImageFileName, CommandLine], limit=1000)

CrowdStrike

#event_simpleName=ProcessRollup2 | ImageFileName=/javaw.exe/i CommandLine=/appdata/i | table([aid, @timestamp, #event_simpleName, ImageFileName, SHA256HashData], limit=1000)

T163

CrowdStrike

#event_simpleName=JarFileWritten | TargetFileName=/\\AppData\\/i | table([aid, @timestamp, TargetFileName, SHA256HashData], limit=1000)

T1027

CrowdStrike

#event_simpleName=ProcessRollup2 | CommandLine=/content.outlook/i | aid=?aid | ImageFileName=/(\/|\\)(?<FileName>\w*\.?\w*)$/ | FileName=/(winword|excel|powerpnt)\.exe/i | CommandLine=/Outlook\\(?<ShortFile>\w*\\.*)$/i | table([@timestamp, aid, TargetProcessId, ShortFile, CommandLine], limit=1000)

CrowdStrike

in(#event_simpleName, values=["ProcessRollup2","ProcessBlocked"]) | event_platform=Win and ImageFileName=/certutil.exe/i and CommandLine=/(https?:)/i

T1105, T1564.004, T1027.013, T1140

ByteRay GmbH

in(#event_simpleName, values=["ProcessRollup2","ProcessBlocked"]) | event_platform=Win and ImageFileName=/mshta.exe/i | CommandLine=/mshta(?:\.exe)?\"?\s+\"?(?<HtaPath>(?:.*?\.hta|(?=\").*?(?=\")|.*?(?=(?:\s|$))))/i | HtaPath=/(?<HtaFolder>.*)(\\\\|\/)/i | HtaPath=/(.*(\\\\|\/))?(?<HtaFile>.*)$/i

T1218.005, T1105

ByteRay GmbH

in(#event_simpleName, values=["ProcessRollup2","ProcessBlocked"]) | event_platform=Win and ImageFileName=/msiexec.exe/i and CommandLine=/http/i

T1218.007

ByteRay GmbH

in(#event_simpleName, values=["ProcessRollup2","ProcessBlocked"]) | event_platform=Win and ImageFileName=/rundll32.exe/i | in(ParentBaseFileName, values=["cmd.exe","winword.exe","powerpnt.exe","excel.exe","outlook.exe","mshta.exe","cscript.exe","wscript.exe"])

T1218.011, T1564.004

ByteRay GmbH

in(#event_simpleName, values=["ProcessRollup2","ProcessBlocked"]) | event_platform=Win and ImageFileName=/wmic.exe/i

T1218, T1105, T1564.004

ByteRay GmbH

#event_simpleName=ProcessRollup2 | aid=?aid ImageFileName=/\\outlook\.exe/i | regex("(?<FileName>[^\\/|\\\\]*)$", field=ImageFileName, strict=false) | join( { #event_simpleName=ProcessRollup2 ImageFileName=/(chrome|firefox|iexplore)\.exe/i | MD5:=MD5HashData | ImageFileName=/(\/|\\)(?<ChildFileName>\w*\.?\w*)$/ | ChildCLI:=CommandLine }, key=ParentProcessId, field=TargetProcessId, include=[MD5, ChildFileName, ChildCLI] ) | groupBy([aid, FileName, CommandLine, ChildFileName, ChildCLI, MD5], limit=max)

T1566

CrowdStrike

#event_simpleName=CommandHistory | CommandHistory=/Invoke\-WebRequest|Net\.WebClient|Start\-BitsTransfer/i | regex("(?<URL>https?://[^'\"]+)", field=CommandHistory) | replace("https://", with="", field=URL, as=ShortURL) | replace("\/.*", with="", field=ShortURL, as=otx_lookup) | UrlBase:="https://otx.alienvault.com/indicator/domain/" | format(format="[Alienvault](%s%s)", field=[UrlBase, otx_lookup], as=DomainLookup) | table([DomainLookup, URL, ComputerName, UserName, CommandHistory], limit=20000)

T1059

ByteRay GmbH

#event_simpleName=ProcessRollup2 event_platform=Win | case { in(field=FileName, values=["powershell.exe", "cmd.exe", "pwsh.exe"]) | IsChild := "1"; * | IsChild := "0" } | case { IsChild = "1" | ProcId := ParentProcessId | ChildProcess := FileName | ChildCommandLine := CommandLine; IsChild = "0" | ProcId := TargetProcessId | ParentCommandLine := CommandLine | ParentFileName := FileName | ParentFilePath := FilePath | ParentSHA256HashData := SHA256HashData; } | groupBy([ComputerName, ProcId], function=([count(ParentProcessId, distinct=true, as=EventCount), collect([ParentFileName, ParentSHA256HashData, ParentFilePath, ParentCommandLine, ChildProcess]), collect(ChildCommandLine, limit=4)]), limit=max) | EventCount > 1 | groupBy([ParentSHA256HashData], function=([collect([aid, ParentFileName, ParentFilePath, ParentCommandLine, ChildProcess, ChildCommandLine]), count(ComputerName, as=HostCount)])) | HostCount < 5 | sort([HostCount, ParentFileName], order=asc)

ByteRay GmbH

#event_simpleName=ProcessRollup2 | (CommandLine=/mimikatz|procdump|lsass|sekurlsa/i OR ImageFileName=/\\(mimikatz|procdump|pwdump)\.exe$/i) | ParentImageFileName!=/\\(powershell|cmd)\.exe$/i | join({#event_simpleName=UserIdentity}, field=[aid, AuthenticationId], include=[UserName], mode=left) | join({#event_simpleName=SyntheticProcessRollup2 | ParentSHA256HashData := SHA256HashData}, field=[aid, ParentProcessId], key=[aid, TargetProcessId], include=[ParentSHA256HashData], mode=left) | table([aid, UserName, ImageFileName, CommandLine, ParentImageFileName, SHA256HashData, ParentSHA256HashData])

T1003.001, T1003.002, T1558.003

ByteRay GmbH

#event_simpleName=NetworkConnect | (RemotePort=445 OR RemotePort=3389 OR RemotePort=5985) | !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]) | join({#event_simpleName=ProcessRollup2}, field=[aid, RawProcessId], include=[ImageFileName, CommandLine]) | join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName]) | table([aid, UserName, ImageFileName, RemoteAddressIP4, RemotePort, CommandLine])

T1021.001, T1021.002, T1135

ByteRay GmbH

#event_simpleName=RegGenericValue | RegObjectName=/\\(Run|RunOnce|Winlogon|AppInit_DLLs|Image File Execution Options)/i | RegValueName!=/^(ctfmon|SecurityHealth|OneDrive)$/i | join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName]) | table([aid, UserName, RegObjectName, RegValueName, RegStringValue, ProcessImageFileName])

T1112, T1547.001

ByteRay GmbH