Falcon Queries

SuspiciousDnsRequest
eventtype=eam (ProcessRollup2 OR SyntheticProcessRollup2) earliest=-1h@h |regex FileName!=""chrome.exe|iexplore.exe|MicrosoftEdgeCP.exe|firefox.exe"" |regex DomainName!=""csync.loopme.me""
|rex field=CommandLine ""(?[^\\]+)$"" |stats count values(SHA256HashData) by TargetProcessId_decimal ComputerName timestamp FileName CommandLine |fields - count
|join TargetProcessId_decimal [search event_simpleName=SuspiciousDnsRequest |rename ContextProcessId_decimal as TargetProcessId_decimal |dedup TargetProcessId_decimal |stats count values(SHA256HashData) by TargetProcessId_decimal DomainName |fields - count] |dedup DomainName
Show me a list of processes that executed from the Recycle Bin for a specific AID
ImageFileName=$Recycle.Bin event_simpleName=""ProcessRollup2"" earliest=-1h@h |regex FileName!=""chrome.exe|iexplore.exe|MicrosoftEdgeCP.exe|firefox.exe"" |stats values(name) values(SHA256HashData) values(ComputerName) values(ImageFileName) count by aid
Show me any BITS transfers (can be used to transfer malicious binaries)
event_simpleName=""ProcessRollup2"" FileName=bitsadmin.exe (CommandLine=/Transfer OR CommandLine=/Addfile) earliest=-1h@h |dedup CommandLine |stats count by _time aid ComputerName UserName ImageFileName CommandLine TargetFileName SHA256HashData |sort -_time
Show me any encoded PowerShell commands
event_simpleName=""ProcessRollup2"" FileName=powershell.exe (CommandLine=-enc OR CommandLine=encoded) UserName!=SPAMMYUSER earliest=-24h@h |regex CommandLine!=""(?i)Office.ValidateResult.scratch|SPAMMMY_POWERSHEL_ENC*"" |rex field=CommandLine ""(?[^\\]+)$"" |stats values(UserName) values(CommandLine) values(ComputerName) count by CommandLineTrim |sort -count
Show me a list of processes executing from User Profile file paths
event_simpleName=""ProcessRollup2"" ComputerName=* earliest=-24h@h
 |regex CommandLine=""\\\\users\\\\"" 
 |regex CommandLine!=""(?i)SPAMMY.exe|SPAMMY.exe|SPAMMY.exe"" 
 |rex field=CommandLine ""(?<CommandLineTrim>[^\\\\]+)$"" 
 |stats dc(UserName) values(SHA256HashData) values(CommandLineTrim) dc(ComputerName) count by FileName
 |sort -count 
 |where count <10
Show me the responsible process for starting a service
event_simpleName=ServiceStarted ComputerName=* earliest=-7d@h
 |dedup CommandLine
 |rex field=CommandLine ""(?<CommandLineTrim>[^\\\\]+)$"" 
 
 |stats values(ComputerName) values(UserName) values(CommandLineTrim) count by FileName 
 |sort -count
Show me all CreateService events with non internal remote connections
Show me non-System32 binaries running as a hosted service
Show me a list of links opened from Outlook
Show me a list of web servers or database processes running under a Local System account
Show me user accounts created with logon
Show me the responsible process for the UserAccountCreated event
Show me all Firewall Set Rule events
Show me all FirewallChangeOption events (with human-readable profile description)
Show me a list of outbound network traffic on non-standard ports and the process info attached to them
Show me a list of low-volume domain name requests
Show all Remote Desktop Protocol (RDP) connections observed on a specific host
Hunting Suspicious Registry Changes
SysInternals Use
NWL_CMD run with Echo and & Parameters-v3
NWL_Administrator Enumeration
NWL_Wscript Runs Obfuscated JS
NWL_Changes to Known DLLs registry
NWL_T1121 - Regsvcs/Regasm - Making Network Connections
NWL_CMD or PS Invoke-Expression with Env Variable
NWL_WannaCry
Off Shore Non Standard Ports
Regkey stuff
Review all events for ComputerName
Aid and/or UserName>userinfo for ticket
Windows_Patch_Status (BlueKeepStatus)
Show processes and connected domain names
NWL_Potential Post Exploit
NWL_Potential Post Exploit Tools Elevated
Execution of Renamed Executables
LOLBAS (add to ID:86 or 87)

Suspicious PowerShell Process, Spawned from Explorer, with Network Connections
Powershell Downloads
MAC: Detecting Word Macros
MAC: Investigating a Word macro
MAC: Rare launch agents: list and count launch agents
MAC: Removing the quarantine attribute
MAC: Very busy process trees
MAC: Processes running from tmp dirs
MAC: Processes running from /Library/Scripts
MAC: Copies from tmp dirs to Users
MAC: Chown commands run on hidden user dirs
MAC: Chmod commands run on hidden user dirs 2
MAC: Long running processes with few network connections (i.e. stealthy C2)
MAC: Process tree that contains both sh and launchctl
MAC: Process trees with lots of shells
MAC: Unusual number of recon commands for the environment for 1 host
MAC: Rare processes associated with security_authtrampoline
MAC: Rare processes associated with security_authtrampoline events query
MAC: Rare processes associated with security_authtrampoline Why isn’t the first query enough?
MAC: Rare self-deleting processes
MAC: Was a process orphaned?
MAC: Find orphaned processes for 1 host v1
RDP inbound Splunk
enc powershell advanced
DST_DNS>Process
Dump what you have access to ( indexes and lookup tables and the size of the index tables )
Search process tree tree view treeview by ContextProcessId_decimal
CS:MAC>Apple dump all non 192 Apple Inc MAC Address split IP address
TreeId_decimal tree id process tree sort of ...( this is more of a deep search when there are to many hits for normal DomainName/FileName Search his search requires a “event time” (earliest) ,aid and a “the last number on the URL bar of an alert tree view” (TreeId_decimal) but it’s tricky with stuff like ‘explore.exe’ or ‘excel.exe’ that has been running for hours if not DAYS I had to add 3hrs to pickup an alert CommandLine and domain
search -N days + 24hrs so -3d would be 24hrs after 3 days ago... good for checking day by day -1 -2 -3 -4 -5 -6 -7 is a week etc..
filter out fields regex good for != string1|string2
Searching in Bash
Create data for Splunk search testing
Expand IP addresses and count class C addresses
Find bad searches slow searches optimize searches
Get all Asset info
Hunting Urls
MISC: earliest=1580801331 or earliest=-7d@d and eval info_sec=60601 the (1) is hours to search to search after earliest
Get count of Cisco AnyConnect VPN IP's
Extract usernames from windows and *nix FilePath and CommandLine with given aid or ComputerName
Search for remote access servers running
Find Chrome Remote Desktop Hits Via DNS
Count of local admin users logins
Create base64 lookup / macro to encode / decode base64
HTA files
City,State of possible Wireless Hot Spot usage (WIP old need more wireless network ranges)
Take the first 10 hits on a search and look for intresting fields after and before
Show me Running Processes with MD5 or SHA256 Hash from all machines
Show me Running Processes with MD5 or SHA256 Hash from all machines
Show me Running Processes with MD5 or SHA256 Hash from all machines
Get Injected Processes from all machines
Get Injected Processes from all machines
Show me AutoRun Program Details from all machines
Show me Running Processes With Parent containing "mutex" from all machines
Get Run Keys Contains ‘VIRUSNAME’ from all Machines (ex: win32.maze.exe)
Show me PSexec Event Consumers from all machines
Show me DLL Load Order Hijacking from all machines
Show me Running Processes with MD5 or SHA256 Hash from all machines
Show me Running Processes with MD5 or SHA256 Hash from all machines
Show me Running Processes with MD5 or SHA256 Hash from all machines
Get Injected Processes from all machines
Get Injected Processes from all machines
Show me AutoRun Program Details from all machines
Show me Running Processes With Parent containing "mutex" from all machines
Get Run Keys Contains ‘VIRUSNAME’ from all Machines (ex: win32.maze.exe)
Show me PSexec Event Consumers from all machines
Show me DLL Load Order Hijacking from all machines
PreviousAWS GuardDutyNextUser Sessions Hunting

Last updated

Was this helpful?