Falcon Queries
SuspiciousDnsRequest
eventtype=eam (ProcessRollup2 OR SyntheticProcessRollup2) earliest=-1h@h |regex FileName!=""chrome.exe|iexplore.exe|MicrosoftEdgeCP.exe|firefox.exe"" |regex DomainName!=""csync.loopme.me""
|rex field=CommandLine ""(?[^\\]+)$"" |stats count values(SHA256HashData) by TargetProcessId_decimal ComputerName timestamp FileName CommandLine |fields - count
|join TargetProcessId_decimal [search event_simpleName=SuspiciousDnsRequest |rename ContextProcessId_decimal as TargetProcessId_decimal |dedup TargetProcessId_decimal |stats count values(SHA256HashData) by TargetProcessId_decimal DomainName |fields - count] |dedup DomainNameShow me a list of processes that executed from the Recycle Bin for a specific AID
ImageFileName=$Recycle.Bin event_simpleName=""ProcessRollup2"" earliest=-1h@h |regex FileName!=""chrome.exe|iexplore.exe|MicrosoftEdgeCP.exe|firefox.exe"" |stats values(name) values(SHA256HashData) values(ComputerName) values(ImageFileName) count by aidShow me any BITS transfers (can be used to transfer malicious binaries)
event_simpleName=""ProcessRollup2"" FileName=bitsadmin.exe (CommandLine=/Transfer OR CommandLine=/Addfile) earliest=-1h@h |dedup CommandLine |stats count by _time aid ComputerName UserName ImageFileName CommandLine TargetFileName SHA256HashData |sort -_timeShow me any encoded PowerShell commands
event_simpleName=""ProcessRollup2"" FileName=powershell.exe (CommandLine=-enc OR CommandLine=encoded) UserName!=SPAMMYUSER earliest=-24h@h |regex CommandLine!=""(?i)Office.ValidateResult.scratch|SPAMMMY_POWERSHEL_ENC*"" |rex field=CommandLine ""(?[^\\]+)$"" |stats values(UserName) values(CommandLine) values(ComputerName) count by CommandLineTrim |sort -countShow me a list of processes executing from User Profile file paths
event_simpleName=""ProcessRollup2"" ComputerName=* earliest=-24h@h
|regex CommandLine=""\\\\users\\\\""
|regex CommandLine!=""(?i)SPAMMY.exe|SPAMMY.exe|SPAMMY.exe""
|rex field=CommandLine ""(?<CommandLineTrim>[^\\\\]+)$""
|stats dc(UserName) values(SHA256HashData) values(CommandLineTrim) dc(ComputerName) count by FileName
|sort -count
|where count <10
Show me the responsible process for starting a service
event_simpleName=ServiceStarted ComputerName=* earliest=-7d@h
|dedup CommandLine
|rex field=CommandLine ""(?<CommandLineTrim>[^\\\\]+)$""
|stats values(ComputerName) values(UserName) values(CommandLineTrim) count by FileName
|sort -count
Show me a list of outbound network traffic on non-standard ports and the process info attached to them
TreeId_decimal tree id process tree sort of ...( this is more of a deep search when there are to many hits for normal DomainName/FileName Search his search requires a “event time” (earliest) ,aid and a “the last number on the URL bar of an alert tree view” (TreeId_decimal) but it’s tricky with stuff like ‘explore.exe’ or ‘excel.exe’ that has been running for hours if not DAYS I had to add 3hrs to pickup an alert CommandLine and domain
search -N days + 24hrs so -3d would be 24hrs after 3 days ago... good for checking day by day -1 -2 -3 -4 -5 -6 -7 is a week etc..
Last updated