Community feed
Recent activity
Newest published queries, parsers, dashboards, and how-tos.
- Query@sebastian
Failed User Logon Thresholding
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Que…
- Query@sebastian
Evaluate Operating System Prevalence
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Que…
- Query@sebastian
Decode SignInfoFlags
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Que…
- Query@sebastian
Critical Environment Variable Changed SSH
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Que…
- Query@sebastian
Count Key-Pairs Beyond GroupBy Max Limit
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Que…
- Query@sebastian
Combine ProcessRollup2 and DnsRequest Events
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Que…
- Query@sebastian
Cheat bucket Using groupBy
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Que…
- Query@sebastian
Bottom 10% of NetworkConnect Port Values
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Que…
- Query@sebastian
AssociateTreeIdWithRoot to Pattern Details
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Que…
- Query@sebastian
Aggregate Detection Data by Host
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Que…
- Query@sebastian
Get specific events and provide option to specify host
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Frid…
- Query@sebastian
Get ReflectiveDotnetModuleLoad with non-null ManagedPdbBuildPath field
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Frid…
- Query@sebastian
Get successful Falcon console logins
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Frid…
- Query@sebastian
Get 4 events of interest
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Frid…
- Query@sebastian
[CVE-2023-36884] Office and Windows HTML Remote Code Execution Vulnerability
Detect Word documents written to disk with a .url extension related to CVE-2023-36884 Office and Windows HTML remote cod…
- Query@sebastian
[T1552.001] Microsoft Teams Unsecured Credentials In Files
Detect process command lines referencing Microsoft Teams Cookies or Local Storage leveldb paths that may expose unsecure…
- Query@sebastian
[CVE-2022-41082] ProxyNotShell Exchange Vulnerability
Detect suspicious command execution from Exchange w3wp.exe related to ProxyNotShell-style activity and CVE-2022-41082.
- Query@sebastian
[T1059.001] NSLookup Remote Payload
Detect PowerShell-spawned nslookup.exe queries using -q=txt, often used for remote payload retrieval, mapped to MITRE AT…
- Query@sebastian
[T1087.001] Account Discovery - Local Accounts
Detect Windows net.exe/net1.exe commands used to enumerate local users, groups, or local groups, mapped to MITRE ATT&CK…
- Query@sebastian
[T1087.002] Account Discovery - Domain Accounts
Detect Windows net.exe/net1.exe commands used to enumerate domain users or groups, mapped to MITRE ATT&CK T1087.002.