LogScale Queries

Category

Detection & Monitoring

Threat detection and continuous monitoring

100 published queries

Categories

query.txt
// Get OsVersionInfo events; sent by sensor every 24-hours or at sensor start or update
#event_simpleName=OsVersionInfo
 
// Narrow search to only include Linux, Container, and K8 systems

CVE-2025-1146 System Scoping (OsVersionInfo with Logon Data)

v2

The query below will look for Linux systems (Linux, K8, Containers) that need to be updated against CVE-2025-1146. The query is based on the event OsVersionInfo which is generated every 24-hours, at sensor start, or at sensor update. It attempts to merge in LogonType 2 and 10 to determine the last logged on user.

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get OsVersionInfo events; sent by sensor every 24-hours or at sensor start or update
#event_simpleName=OsVersionInfo
 
// Narrow search to only include Linux, Container, and K8 systems

CVE-2025-1146 System Scoping (OsVersionInfo)

v2

The query below will look for Linux systems (Linux, K8, Containers) that need to be updated against CVE-2025-1146. The query is based on the event OsVersionInfo which is generated every 24-hours, at sensor start, or at sensor update.

LogScaleDetection & MonitoringDetectionEndpointKubernetes

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Read in AID Master file; REMINDER: this file updates every 4 hours.
| readFile("aid_master_main.csv")
 
// Narrow search to only include Linux, Container, and K8 systems

CVE-2025-1146 System Scoping (aid master)

v2

The query below will look for Linux systems (Linux, K8, Containers) that need to be updated against CVE-2025-1146. The query is based on the lookup file aid_master_main.csv which is automatically updated every 4 hours.

LogScaleDetection & MonitoringDetectionKubernetesLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
// CVE-2025-53770 - WebShell Discovery from w3wp.exe

correlate(
    cmd: {

CVE-2025-53770 - SharePoint ToolShell

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/CVE-2025-53770 - SharePoint ToolShell.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/CVE-2025-53770%20-%20SharePoint%20ToolShell.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=AgentOnline event_platform=Win  
| groupBy([aid], function=([selectLast([BaseTime])]))
| LastReboot_milli:=(BaseTime/1000*1024)+978307200
| round("LastReboot_milli")

Calculate Last Windows Boot Time

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Calculate Last Windows Boot Time.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Calculate%20Last%20Windows%20Boot%20Time.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=ProcessRollup2 ImageFileName=/\\powershell(_ise)?\.exe/i) OR (#event_simpleName=EndOfProcess event_platform=Win CLICreationCount>0)
| selfJoinFilter([aid, TargetProcessId], where=[{#event_simpleName=ProcessRollup2}, {#event_simpleName=EndOfProcess}], prefilter=true)
| regex(".+\\\(?<FileName>.+$)", field=ImageFileName, strict=false)
| groupBy([aid, TargetProcessId], function=([count(#event_simpleName, distinct=true, as=eventCount), min(ProcessStartTime, as=processStartTime), max(ContextTimeStamp, as=processEndTime), collect([CLICreationCount, FileName])]))

Calculate Process Run Time

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Calculate Process Run Time.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Calculate%20Process%20Run%20Time.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/FileWritten$/ 
| case {
    Size>=1099511627776 | CommonSize:=unit:convert(Size, to=T) | format("%,.2f TB",field=["CommonSize"], as="CommonSize");
    Size>=1073741824 | CommonSize:=unit:convert(Size, to=G) | format("%,.2f GB",field=["CommonSize"], as="CommonSize");

Case to convert Size to appropriate unit of measure

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Case to convert Size to appropriate unit of measure.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Case%20to%20convert%20Size%20to%20appropriate%20unit%20of%20measure.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get UI Audit Events
#repo="detections" ExternalApiType=/Remote/

// Check commands for "get"

Check for Falcon Analysts Running get Command

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Check for Falcon Analysts Running get Command.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check%20for%20Falcon%20Analysts%20Running%20get%20Command.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo
| osData:=concat([OSVersionString, ProductName])
| groupBy([aid], function=([selectFromMax(field="@timestamp", include=[event_platform, RFMState, LinuxSensorBackend, AgentVersion, osData])]))
| RFMState match {

Check for Sensors in RFM

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Check for Sensors in RFM.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check%20for%20Sensors%20in%20RFM.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\(?<fileName>chrome\.exe)$/i
| groupBy([cid, aid, fileName, SHA256HashData])
| match(file="fdr_aidmaster.csv", field=aid, include=ComputerName, ignoreCase=true, strict=false)
| join({#event_simpleName=PeVersionInfo event_platform=Win | ImageFileName=/\\chrome\.exe/i | groupBy([SHA256HashData, FixedFileVersion, CompanyName], function=selectLast([ComputerName, FixedFileVersion]))}, include=[FixedFileVersion, CompanyName], field=[SHA256HashData])

Chrome Version Number Evaluation

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Chrome Version Number Evaluation.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Chrome%20Version%20Number%20Evaluation.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/(winword|excel)\.exe/i) OR (#event_simpleName=ZipFileWritten event_platform=Win)
| falconPID:=ContextProcessId | falconPID:=TargetProcessId
| selfJoinFilter(field=[aid, falconPID], where=[{#event_simpleName=ProcessRollup2}, {#event_simpleName=ZipFileWritten}], prefilter=true)
| case{

Combine ProcessRollup2 and FileWritten Events

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Combine ProcessRollup2 and FileWritten Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Combine%20ProcessRollup2%20and%20FileWritten%20Events.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Insert Discovery commands of interest here
event_platform=Win #event_simpleName=ProcessRollup2 FileName=/(whoami|ping|net1?|systeminfo|quser|ipconfig)/iF

// Restrict to non-system UserSid Values

Count Windows Discovery Commands Per User

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Count Windows Discovery Commands Per User.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Count%20Windows%20Discovery%20Commands%20Per%20User.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=UserLogon //UserName="name@example.com"
| UserName=~wildcard(?{UserName="*"}, ignoreCase=true)
| LogonTime:=LogonTime*1000
| time:dayOfWeekName(LogonTime)

Create Heatmap of Login Activity

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Create Heatmap of Login Activity.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Create%20Heatmap%20of%20Login%20Activity.md

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
//Get PowerShell Events
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\powershell\.exe/i
//Look for PS flags that indicate an encoded command
| CommandLine=/\s+\-(e|encoded|encodedcommand|enc)\s+/i

Decode Base64

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Decode Base64.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Decode%20Base64.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 WindowFlags=*
| bitfield:extractFlags(
field=WindowFlags,
 output=[

Decoding WindowFlags Bitmask

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Decoding WindowFlags Bitmask.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Decoding%20WindowFlags%20Bitmask.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get browser extension event
#event_simpleName=InstalledBrowserExtension BrowserExtensionId!="no-extension-available"
| aid=?aid
| ComputerName=?ComputerName

Enumerate Browser Extensions

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Enumerate Browser Extensions.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Enumerate%20Browser%20Extensions.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get all DriverLoad events and Event_ModuleSummaryInfoEvent events so certificate data can be merged in
(#event_simpleName=DriverLoad event_platform=Win) OR (#repo=detections ExternalApiType=Event_ModuleSummaryInfoEvent )

// Shorten file path from DriverLoad event

Enumerate Windows Driver Loads

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Enumerate Windows Driver Loads.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Enumerate%20Windows%20Driver%20Loads.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo event_platform=Win

| groupby(aid, function=selectLast([AgentVersion, event_platform, @timestamp]))
| AgentVersion=/(?<majorVersion>\d+)\.(?<minorVersion>\d+)\.(?<buildNumber>\d+)\.\d+/

Evaluate Falcon Agent Version

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Evaluate Falcon Agent Version.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Evaluate%20Falcon%20Agent%20Version.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/UserLogon/
| case{
    #event_simpleName=UserLogon | SuccessLogonTime:=ContextTimeStamp;
    #event_simpleName=UserLogonFailed2 | FailedLogonTime:=ContextTimeStamp;

Failed and Successful User Logon Events

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Failed and Successful User Logon Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Failed%20and%20Successful%20User%20Logon%20Events.md

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/FileWritten$/ AND ((event_platform=Win DiskParentDeviceInstanceId="USB*") OR (event_platform=Mac IsOnRemovableDisk=1)) AND TargetFileName!="*.Spotlight-V100*"
| groupBy([ComputerName], function=([collect([TargetFileName]), count(TargetFileName, as=TotalFile), sum(Size, as=SumSize)]))
| TotalFiles > 10 OR SumSize > 5242880
| case {

Files Written to Removable Media

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Files Written to Removable Media.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Files%20Written%20to%20Removable%20Media.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get file names of interest
#event_simpleName=ProcessRollup2 event_platform=Win
| in(field="FileName", values=[whoami.exe, arp.exe, cmd.exe, net.exe, net1.exe, ipconfig.exe, route.exe, netstat.exe, nslookup.exe, nltest.exe, systeminfo.exe, wmic.exe, tasklist.exe, tracert.exe, ping.exe, adfind.exe, nbtstat.exe, find.exe, ldifde.exe, netsh.exe, wbadmin.exe], ignoreCase=true)

Frequency Analysis via Program Clustering

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Frequency Analysis via Program Clustering.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Frequency%20Analysis%20via%20Program%20Clustering.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#sampleType = repository
| timechart(repo,
function={sum(ingestAfterFieldRemovalSize)}, minSpan=1h, limit=20)

Get Repository Ingestion Data for LogScale SaaS

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Get Repository Ingestion Data for LogScale SaaS.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Get%20Repository%20Ingestion%20Data%20for%20LogScale%20SaaS.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#repo=?repo #type=?type #Vendor=?Vendor
| eventSize()
| unit:convert(_eventSize, to="G")
| sum("_eventSize")

Get Repository Ingestion in Raptor

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Get Repository Ingestion in Raptor.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Get%20Repository%20Ingestion%20in%20Raptor.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get Event Required on Windows Platform
#event_simpleName=AgentOnline event_platform=Win
// Convert BastTime in epoch Time Stamp

Get Windows OS Boot Time

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Get Windows OS Boot Time.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Get%20Windows%20OS%20Boot%20Time.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=HttpRequestDetect
| parseHexString("HttpPostBody", as=b64data)
| format("%,.4s", field=b64data, as=b64data)
| MagicNumber := base64Decode(b64data, charset="UTF-8")

HttpRequestDetect

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/HttpRequestDetect.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/HttpRequestDetect.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get bcdedit.exe process executions
#event_simpleName=ProcessRollup2 event_platform=Win FileName="bcdedit.exe"

// Create process lineage tree for easier reading

Hunting bcdedit.exe usage

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Hunting bcdedit.exe usage.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Hunting%20bcdedit.exe%20usage.md

LogScaleDetection & MonitoringDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2

| join({#event_simpleName=IsoExtensionFileWritten OR #event_simpleName=ImgExtensionFileWritten}, key=[aid, ContextProcessId], field=[aid, TargetProcessId], include=[TargetFileName])
| ImageFileName=/(\/|\\)(?<FileName>\w*\.?\w*)$/

ISO IMG Written to Disk w Responsible Process

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/ISO_IMG Written to Disk w_ Responsible Process.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/ISO_IMG%20Written%20to%20Disk%20w_%20Responsible%20Process.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get UserLogon events for Windows RDP sessions
#event_simpleName=UserLogon event_platform=Win LogonType=10 RemoteAddressIP4=*

// Omit results if the RemoteAddressIP4 field is RFC1819

Impossible Time To Travel (UserLogon)

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Impossible Time To Travel (UserLogon).md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Impossible%20Time%20To%20Travel%20%28UserLogon%29.md

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get browser extension event
#event_simpleName=InstalledBrowserExtension BrowserExtensionId!="no-extension-available"

// Aggregate by event_platform, BrowserName, ExtensionID and ExtensionName

Installed Browser Extensions

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Installed Browser Extensions.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Installed%20Browser%20Extensions.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
#repo=sensor_metadata #data_source_name=aidmaster
| groupBy([cid, aid], function=([selectFromMax(field="@timestamp", include=[AgentLoadFlags, AgentLocalTime, AgentTimeOffset, AgentVersion, BiosManufacturer, BiosVersion, ChassisType, City, ComputerName, ConfigBuild, ConfigIDBuild, Continent, Country, FalconGroupingTags, FirstSeen, HostHiddenStatus, MachineDomain, OU, PointerSize, ProductType, SensorGroupingTags, ServicePackMajor, SiteName, SystemManufacturer, SystemProductName, @timezone, Timezone, Version, aid, aip, cid, event_platform])]))
| lastSeen:=@timestamp
| formatTime(format="%F %T", as="lastSeen", field=lastSeen)

Leveraging the aidmaster repo

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Leveraging the aidmaster repo.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Leveraging%20the%20aidmaster%20repo.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
#repo=detections ExternalApiType=Event_IdpDetectionSummaryEvent
| rename([[TargetEndpointHostName, TargetEndpoint], [SourceEndpointHostName, SourceEndpoint], [TargetAccountName, TargetAccount], [SourceAccountName, SourceAccount]])
| format("[FalconHostLink](%s)", field=[FalconHostLink], as="FalconHostLink")
| format(format="%s > %s", field=[Tactic, Technique], as=MITRE)

List All ITP Detections

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/List All ITP Detections.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/List%20All%20ITP%20Detections.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Create a live table of the executables in System32/SysWOW64
| defineTable(query={
    #event_simpleName=ProcessRollup2 event_platform=Win FilePath=/\\Windows\\(System32|SysWOW64)\\/ FileName=/\.exe$/
    | FilePath=/(\\Device\\HarddiskVolume\d+)?(?<ExpectedFilePath>\\.+)/

Look for files running outside Windows systems folders with name masquerading

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Look for files running outside Windows systems folders with name masquerading.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Look%20for%20files%20running%20outside%20Windows%20systems%20folders%20with%20name%20masquerading.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get alert events
#repo=detections (ExternalApiType=/Event_(Epp|Idp|Mobile)DetectionSummaryEvent/) OR (ExternalApiType=Event_UserActivityAuditEvent OperationName=detection_update)
| case{
    ExternalApiType=Event_UserActivityAuditEvent Attributes.update_status="closed" | ResolveTime:=@timestamp;

Mean Time to React, Respond, and Resolve

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Mean Time to React, Respond, and Resolve.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Mean%20Time%20to%20React%2C%20Respond%2C%20and%20Resolve.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
aid=1e0afc34e9634710bfcd2f46d8564ab1 (#event_simpleName=ProcessRollup2 FileName="powershell.exe")
| select([aid, ComputerName, CommandLine])
| join(key=aid, field=aid, query={#repo=sensor_metadata}, include=([AgentVersion, BiosManufacturer, FalconGroupingTags]))

Merge Legacy AID Master Info

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Merge Legacy AID Master Info.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Merge%20Legacy%20AID%20Master%20Info.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2
| aid=?{aid=*}
| ImageFileName =~ wildcard(?{ImageFileName="*"}, ignoreCase=true, includeEverythingOnAsterisk=true)
| ImageFileName=/(\/|\\)(?<FileName>\w*\.?\w*)$/

Merge Parent Child PR2 with Join

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Merge Parent_Child PR2 with Join.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Merge%20Parent_Child%20PR2%20with%20Join.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get all Windows ProcessRollup2 events with .dll or .exe listed in the call stack
event_platform=Win #event_simpleName=ProcessRollup2 CallStackModuleNames=/\.(dll|exe)/

// Create filters to narrow searches

Parse Windows Call Stack

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Parse Windows Call Stack.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Parse%20Windows%20Call%20Stack.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get SensorHeartbeat events for Windows, macOS, and Linux
#event_simpleName=SensorHeartbeat event_platform=/(^(Win|Mac|Lin)$)/
// Get most recent event for each aid value and include event_platform
| groupBy([event_platform, aid], function=([selectFromMax(field="@timestamp", include=[SensorStateBitMap])]))

Percentage of Sensors in RFM

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Percentage of Sensors in RFM.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Percentage%20of%20Sensors%20in%20RFM.md

LogScaleDetection & MonitoringDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo event_platform=/^(Win|Mac|Lin)$/

| groupBy(field=#cid, function=[count(aid, distinct=true, as=totalcount), {event_platform=Lin | count(aid, distinct=true, as=Linux)},{ event_platform=Mac | count(aid, distinct=true, as=Mac)}, { event_platform=Win | count(aid, distinct=true, as=Windows)}])
| linuxPercentage := (Linux/totalcount)*100 | format(format="%,.3f%%", field=[linuxPercentage], as=linuxPercentage)

Percentage of Windows Mac Linux Endpoints

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Percentage of Windows_Mac_Linux Endpoints.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Percentage%20of%20Windows_Mac_Linux%20Endpoints.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
| bitfield:extractFlags(
 field=ProcessCreateFlags,
  output=[
    [0,DEBUG_PROCESS],

Process ProcessCreateFlags

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Process ProcessCreateFlags.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Process%20ProcessCreateFlags.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get ProcessRollup2 events for Windows with Mark of the Web field set
#event_simpleName=ProcessRollup2 event_platform=Win ZoneIdentifier=*
// Parse ConfigBuild for Falcon link syntehsis

ProcessRollup2 Files With Mark of the Web

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/ProcessRollup2 Files With Mark of the Web.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/ProcessRollup2%20Files%20With%20Mark%20of%20the%20Web.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo  RFMState=*

| day := formatTime("%Y-%m-%d", field=@timestamp, locale=en_US, timezone=Z)
| groupBy([aid, day], function=(selectLast([RFMState, @timestamp])), limit=max)

RFM State by Day

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/RFM State by Day.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/RFM%20State%20by%20Day.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/.*\\powershell\.exe/

| CommandLine=/.*\s+\-(e|encoded|encodedcommand|enc)\s+.*/
| length("CommandLine", as="cmdLength")

Rare and Common Encrypted Command Lines

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Rare and Common Encrypted Command Lines.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Rare%20and%20Common%20Encrypted%20Command%20Lines.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ScriptControlScanInfo event_platform=Win

| ScriptContent=/FromBase64String/i
| entropy := shannonEntropy("ScriptContent")

Script Content Entropy

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Script Content Entropy.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Script%20Content%20Entropy.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo
| field_temp:= ?{ComputerName="*"}
| case {
	field_temp != /^\*$/ | regex(field=field_temp,regex = "(?<field_matched>.*?)(,|$)", repeat="true") | test(ComputerName==field_matched) | drop([field_matched,field_temp]) ;

Searching Comma Delineated List With User Input

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Searching Comma Delineated List With User Input.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Searching%20Comma%20Delineated%20List%20With%20User%20Input.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
defineTable(
    query={
        #repo="sensor_metadata" #data_source_name="policyinfo" #data_source_group="sensor-update"
        | groupBy(id, function=selectFromMax(field="@timestamp", include=[release_id]))

Show Sensor Update Policies

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Show Sensor Update Policies.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Show%20Sensor%20Update%20Policies.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get events of interest
#repo=detections 
| in(field="ExternalApiType", values=[Event_UserActivityAuditEvent, Event_EppDetectionSummaryEvent])

Survival of the Fastest

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Survival of the Fastest.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Survival%20of%20the%20Fastest.md

LogScaleDetection & MonitoringDetectionLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2

| ImageFileName=/(\\|\/)(?<fileName>whoami+(\.exe)?$)/i
| concat([UID, UserSid], as="userIdentifier")

Two whoami Commands Run

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Two whoami Commands Run.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Two%20whoami%20Commands%20Run.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=ProcessRollup2 ImageFileName=/\\psexec64\.exe/i ParentBaseFileName=/powershell\.exe/i)

| rename(field="ImageFileName", as="ChildImageFileName")
| rename(field="CommandLine", as="ChildCommandLine")

Use Join on Two Scoped Events

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Use Join on Two Scoped Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Use%20Join%20on%20Two%20Scoped%20Events.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
| createEvents(["color=blue", "shape=round", "size=large"])
| kvParse()
| transpose(limit=1000)
| column := upper(column)

Use Transpose to Convert Field Names to Upper Case

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Use Transpose to Convert Field Names to Upper Case.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Use%20Transpose%20to%20Convert%20Field%20Names%20to%20Upper%20Case.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=UserLogon UserSid=S-1-5-21-*
| in(LogonType, values=["2","10"])
| ipLocation(aip)
| $falcon/helper:enrich(field=UserIsAdmin)

UserLogon

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/UserLogon.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/UserLogon.md

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 ImageFileName=/(\\|\/)whoami/i
| groupBy([aid], function=(count(aid, as=executionCount)))
| myThreshold:=?myThreshold
| myThreshold:=if(condition=(myThreshold == "*"), then="0", else=myThreshold)

Using Editable Threshold Values

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Using Editable Threshold Values.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Using%20Editable%20Threshold%20Values.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
correlate(
    // Search for grandparent process
    grandparent: {
         #event_simpleName=ProcessRollup2 event_platform=Win FileName!="explorer.exe" CommandLine=*

Using correlate() to hunt process lineage

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Using correlate() to hunt process lineage.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Using%20correlate%28%29%20to%20hunt%20process%20lineage.md

LogScaleDetection & MonitoringDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
event_type=ZeroTrustHostAssessment
| groupBy([aid], function=([selectFromMax(field="@timestamp", include=[scores.os, scores.sensor, scores.overall])]))
| join(query={#data_source_name=aidmaster }, field=[aid], include=[ComputerName, event_platform])

Zero Trust Host Assessment Scores

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Zero Trust Host Assessment Scores.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Zero%20Trust%20Host%20Assessment%20Scores.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win /(mainWindowTitle|Get-Process|GetForegroundWindow|mainWindowTitle)/i

(T1010) Application Window Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1010) Application Window Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1010%29%20Application%20Window%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\reg\.exe/
| ImageFileName=/^//.+//(?<FileName>reg\.exe)/
| FileName:=lower("FileName") 
| ParentBaseFileName:=lower("ParentBaseFileName")

(T1012) Query Registry

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1012) Query Registry.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1012%29%20Query%20Registry.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ((ImageFileName=/\\(ping|tracert)\.exe/i) OR (ImageFileName=/\\net1?\.exe/i CommandLine=/view/i) OR (ImageFileName=/\\nltest\.exe/i CommandLine=/\/dclist/i) OR (/\\etc\\hosts\\/i))

(T1018) Remote System Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1018) Remote System Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1018%29%20Remote%20System%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 ((ImageFileName=/(\\|\/)(w|who|whoami)(\.exe)?$/i) OR (event_platform=Mac ImageFileName=/\/dscl/i CommandLine=/users/i))

(T1033) System Owner User Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1033) System Owner_User Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1033%29%20System%20Owner_User%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\tasklist\.exe/) OR (/(Get-Process|CreateToolhelp32Snapshot)/i))

(T1057) Process Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1057) Process Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1057%29%20Process%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\net1?\.exe/i CommandLine=/localgroup/i) OR (/get-localgroup/i))

(T1069.001) Permission Groups Discovery - Local Groups

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1069) Permission Groups Discovery/(T1069.001) Permission Groups Discovery - Local Groups.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1069%29%20Permission%20Groups%20Discovery/%28T1069.001%29%20Permission%20Groups%20Discovery%20-%20Local%20Groups.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\net1?\.exe/i CommandLine=/group.+\/domain/i

(T1069.002) Permission Groups Discovery - Domain Groups

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1069) Permission Groups Discovery/(T1069.002) Permission Groups Discovery - Domain Groups.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1069%29%20Permission%20Groups%20Discovery/%28T1069.002%29%20Permission%20Groups%20Discovery%20-%20Domain%20Groups.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ /(Get\-MsolRole|get\-member\-groups|ListRolePolicies|ListAttachedRolePolicies|GetBucketAcl)/i

(T1069.003) Permission Groups Discovery - Cloud Groups

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1069) Permission Groups Discovery/(T1069.003) Permission Groups Discovery - Cloud Groups.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1069%29%20Permission%20Groups%20Discovery/%28T1069.003%29%20Permission%20Groups%20Discovery%20-%20Cloud%20Groups.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ((ImageFileName=/\\(fsutil|fsinfo|drives|systeminfo|vssadmin|hostname)\.exe/i) OR (ImageFileName=/\\net1?\.exe/i CommandLine=/config/i))

(T1082) System Information Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1082) System Information Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1082%29%20System%20Information%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win /Get-GlobalAddressList/

(T1087.003) Account Discovery - Email Account

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1087) Account Discovery/(T1087.003) Account Discovery - Email Account.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1087%29%20Account%20Discovery/%28T1087.003%29%20Account%20Discovery%20-%20Email%20Account.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=ProcessRollup2 CommandLine=/az\s+ad\s+user\s+list/i) OR (#event_simpleName=ProcessRollup2 CommandLine=/aws\s+iam\s+list\-(roles|users)/i) OR (#event_simpleName=ProcessRollup2 CommandLine=/gcloud\s+ (iam\s+service\-accounts\s+list|projects\s+get\-iam\-policy)/i)

(T1087.004) Account Discovery - Cloud Account

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1087) Account Discovery/(T1087.004) Account Discovery - Cloud Account.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1087%29%20Account%20Discovery/%28T1087.004%29%20Account%20Discovery%20-%20Cloud%20Account.md

LogScaleDetection & MonitoringAWSDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\net1?\.exe/i CommandLine=/(user|group).+\/domain/i) OR (#event_simpleName=/^(CommandHistory|ScriptControl)/ event_platform=Win /Get-ADUser|Get-ADGroupMember/i)

(T1087.002) Account Discovery - Domain Account

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1087) Account Discovery/(T1087.002) Account Discovery - Domain Account.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1087%29%20Account%20Discovery/%28T1087.002%29%20Account%20Discovery%20-%20Domain%20Account.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\fsutil\.exe/i CommandLine=/fsinfo/i

(T1120) Peripheral Device Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1120) Peripheral Device Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1120%29%20Peripheral%20Device%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ /(dir|tree|ls|find|locate|show)\s+/i

(T1083) File and Directory Discovery

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1083) File and Directory Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1083%29%20File%20and%20Directory%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\net1?\.exe/i CommandLine=/accounts/i) OR (/(Get-ADDefaultDomainPasswordPolicy|GetAccountPasswordPolicy)/i))

(T1201) Password Policy Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1201) Password Policy Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1201%29%20Password%20Policy%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\nltest\.exe/i CommandLine=/trust/i) OR (ImageFileName=/\\dsquery\.exe/i CommandLine=/trustedDomain/i) OR (/(Get-NetDomainTrust|Get-NetForestTrust|Get-AcceptedDomain)/i))

(T1482) Domain Trust Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1482) Domain Trust Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1482%29%20Domain%20Trust%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory)$/ event_platform=Win ((CommandLine=/(securityCenter2|csagent|csfalconservice)/i) OR (CommandHistory=/(securityCenter2|csagent|csfalconservice)/i) OR (ImageFileName=/netsh\.exe/i))

(T1518.001) Software Discovery - Security Software Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1518) Software Discovery/(T1518.001) Software Discovery - Security Software Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1518%29%20Software%20Discovery/%28T1518.001%29%20Software%20Discovery%20-%20Security%20Software%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ /(DescribeInstances|ListBuckets|HeadBucket|GetPublicAccessBlock|DescribeDBInstances)/i) OR (#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ /(gcloud\s+compute\s+instances\s+list)/i) OR (#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ /(az\s+vm\s+list)/i)

(T1580) Cloud Infrastructure Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1580) Cloud Infrastructure Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1580%29%20Cloud%20Infrastructure%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win /(\\Control\\Nls\\Language|GetUserDefaultUILanguage|GetSystemDefaultUILanguage|GetKeyboardLayoutList|GetUserDefaultLangID)/i

(T1614.001) System Location Discovery - System Language Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1614) System Location Discovery/(T1614.001) System Location Discovery - System Language Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1614%29%20System%20Location%20Discovery/%28T1614.001%29%20System%20Location%20Discovery%20-%20System%20Language%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\gpresult\.exe/i) OR /(Get-DomainGPO|Get-DomainGPOLocalGroup|GPOLocalGroup)/i)

(T1615) Group Policy Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1615) Group Policy Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1615%29%20Group%20Policy%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=ProcessRollup2 event_platform=Win (ImageFileName=/\\driverquery\.exe/i OR (ImageFileName=/\\sc\.exe/i CommandLine=/query/i))) OR (#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win /CurrentControlSet\\(Services|HardwareProfiles)/)

(T1652) Device Driver Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1652) Device Driver Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1652%29%20Device%20Driver%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1059.001] NSLookup Remote Payload - Win
//
// https://attack.mitre.org/techniques/T1059/001/
//

[T1059.001] NSLookup Remote Payload - Win

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1059.001] NSLookup Remote Payload - Win.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1059.001%5D%20NSLookup%20Remote%20Payload%20-%20Win.logscale

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1087.001] Account Discovery - Local Accounts - Lin
//
// https://attack.mitre.org/techniques/T1087/001/
//

[T1087.001] Account Discovery - Local Accounts - Lin

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.001] Account Discovery - Local Accounts - Lin.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.001%5D%20Account%20Discovery%20-%20Local%20Accounts%20-%20Lin.logscale

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1087.001] Account Discovery - Local Accounts - Mac
//
// https://attack.mitre.org/techniques/T1087/001/
//

[T1087.001] Account Discovery - Local Accounts - Mac

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.001] Account Discovery - Local Accounts - Mac.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.001%5D%20Account%20Discovery%20-%20Local%20Accounts%20-%20Mac.logscale

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1087.001] Account Discovery - Local Accounts - Win
//
// https://attack.mitre.org/techniques/T1087/001/
//

[T1087.001] Account Discovery - Local Accounts - Win

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.001] Account Discovery - Local Accounts - Win.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.001%5D%20Account%20Discovery%20-%20Local%20Accounts%20-%20Win.logscale

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1087.002] Account Discovery - Domain Accounts - Lin
//
// https://attack.mitre.org/techniques/T1087/002/
//

[T1087.002] Account Discovery - Domain Accounts - Lin

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.002] Account Discovery - Domain Accounts - Lin.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.002%5D%20Account%20Discovery%20-%20Domain%20Accounts%20-%20Lin.logscale

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1087.002] Account Discovery - Domain Accounts - Mac
//
// https://attack.mitre.org/techniques/T1087/002/
//

[T1087.002] Account Discovery - Domain Accounts - Mac

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.002] Account Discovery - Domain Accounts - Mac.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.002%5D%20Account%20Discovery%20-%20Domain%20Accounts%20-%20Mac.logscale

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1087.002] Account Discovery - Domain Accounts - Win
//
// https://attack.mitre.org/techniques/T1087/002/
//

[T1087.002] Account Discovery - Domain Accounts - Win

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.002] Account Discovery - Domain Accounts - Win.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.002%5D%20Account%20Discovery%20-%20Domain%20Accounts%20-%20Win.logscale

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=UserLogonFailed2 event_platform=Win
| SubStatus_hex := format(field=SubStatus, "0x%x")
| $falcon/helper:enrich(field=SubStatus)
| $falcon/helper:enrich(field=LogonType)

2024-03-01 CQF Live Supporting Queries

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Friday/2024-03-01 CQF Live Supporting Queries.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Cool-Query-Friday/2024-03-01%20CQF%20Live%20Supporting%20Queries.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get all Windows ProcessRollup2 Events
#event_simpleName=ProcessRollup2 event_platform=Win
// Narrow to processes of interest and create FileName variable
| ImageFileName=/\\(?<FileName>(whoami|net1?|systeminfo|ping|nltest|sc|hostname|ipconfig)\.exe)/i

Custom Weighting Command Line and File Name

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Custom Weighting Command Line and File Name.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Custom%20Weighting%20Command%20Line%20and%20File%20Name.md

LogScaleDetection & MonitoringDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo event_platform=Mac

| OSVersionFileData=*
| replace("([0-9A-Fa-f]{2})", with="%$1", field=OSVersionFileData, as=OSVersionFileData)

OsVersionInfo OsVersionFileData Decode

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/OsVersionInfo OsVersionFileData Decode.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/OsVersionInfo%20OsVersionFileData%20Decode.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Mac (ImageFileName=/\/(id|groups)/i OR (ImageFileName=/\/dscl/ AND CommandLine=/list.+users/i))

(T1087.001) Account Discovery - Local Account

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1087) Account Discovery/(T1087.001) Account Discovery - Local Account.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1087%29%20Account%20Discovery/%28T1087.001%29%20Account%20Discovery%20-%20Local%20Account.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=UserLogon LogonType=10

| RemoteAddressIP4 = *
| ipLocation(RemoteAddressIP4)

RDP Login World Map

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/RDP Login World Map.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/RDP%20Login%20World%20Map.md

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo event_platform=Lin
| groupby(aid, function=selectLast([OSVersionString]))
| OSVersionString=/Linux\s+\S+\s(?<kernelVersion>\S+)\s.*/
| top("kernelVersion", limit=100)

Linux Kernel Version

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Linux Kernel Version.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Linux%20Kernel%20Version.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 24.7.2026

DownloadOpen
query.txt
// Get Windows UserLogonFailed events
event_platform=Win #event_simpleName=UserLogonFailed2

// This line is completely optional, but converts SubStatus to hex

Failed User Logon Thresholding

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Failed User Logon Thresholding.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Failed%20User%20Logon%20Thresholding.md

NG-SIEMDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo event_platform=Win

| groupby(aid, function=selectLast([ProductName]))
| groupBy([ProductName], function=stats([count(aid, as="endpointCount")]))

Evaluate Operating System Prevalence

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Evaluate Operating System Prevalence.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Evaluate%20Operating%20System%20Prevalence.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 UserSid=/^S-1-5-21-/ SignInfoFlags=*
| bitfield:extractFlags(
 field=SignInfoFlags,
  output=[

Decode SignInfoFlags

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Decode SignInfoFlags.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Decode%20SignInfoFlags.md

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 24.7.2026

DownloadOpen
query.txt
id := hash([fields_to_count], limit=1000000) // Uses hash collision to increase cardinality the limit here needs to max the limit in the first groupby
| groupBy([id], limit=max, function={ groupBy([fields_to_count], function=[], limit=max)| count() }) // Count the sub groups
| sum("_count") // Sum all the counts

Count Key-Pairs Beyond GroupBy Max Limit

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Count Key-Pairs Beyond GroupBy Max Limit.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Count%20Key-Pairs%20Beyond%20GroupBy%20Max%20Limit.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo RFMState=*
| day := formatTime("%Y-%m-%d", field=@timestamp, locale=en_US, timezone=Z)
| groupBy([aid, day], function=(selectLast([RFMState, @timestamp])), limit=max)
| RFMState match {

Cheat bucket Using groupBy

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Cheat bucket Using groupBy.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Cheat%20bucket%20Using%20groupBy.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 24.7.2026

DownloadOpen
query.txt
// Get ReflectiveDotnetModuleLoad with non-null ManagedPdbBuildPath field
#event_simpleName=ReflectiveDotnetModuleLoad event_platform=Win ManagedPdbBuildPath!="" 

// Capture FilePath and FileName Fields

Get ReflectiveDotnetModuleLoad with non-null ManagedPdbBuildPath field

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Friday/2023-09-08 - Cool Query Friday - Reflective .Net Module Loads and Program Database (PDB) File Paths.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Cool-Query-Friday/2023-09-08%20-%20Cool%20Query%20Friday%20-%20Reflective%20.Net%20Module%20Loads%20and%20Program%20Database%20%28PDB%29%20File%20Paths.md

LogScaleDetection & MonitoringDetectionWindows

@sebastian · 24.7.2026

DownloadOpen
query.txt
ExternalApiType=Event_DetectionSummaryEvent
| format(format="%s > %s", field=[Tactic, Technique], as=MITRE)
| groupBy([AgentIdString], function=([count(DetectId, as=totalDetections), sum(Severity, as=severityWeight), min(@timestamp, as=firstDetect), max(@timestamp, as=lastDetect), collect([MITRE])]))
| formatTime(field=firstDetect, format="%Y-%m-%dT%H:%M:%S", as=firstDetect)

Aggregate Detection Data by Host

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Aggregate Detection Data by Host.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Aggregate%20Detection%20Data%20by%20Host.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 24.7.2026

DownloadOpen
query.txt
// [T1552.001] Microsoft Teams Unsecured Credentials In Files
//
// Reference: https://www.reddit.com/r/crowdstrike/comments/xfqtyb/20220916_cool_query_friday_microsoft_teams/
//

[T1552.001] Microsoft Teams Unsecured Credentials In Files

v1

Detect process command lines referencing Microsoft Teams Cookies or Local Storage leveldb paths that may expose unsecured credentials, mapped to MITRE ATT&CK T1552.001.

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 24.7.2026

DownloadOpen
query.txt
// [CVE-2023-36884] Office and Windows HTML Remote Code Execution Vulnerability
//
// https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884
// https://www.reddit.com/r/crowdstrike/comments/14y1yei/20230712_situational_awareness_microsoft_office/

[CVE-2023-36884] Office and Windows HTML Remote Code Execution Vulnerability

v1

Detect Word documents written to disk with a .url extension related to CVE-2023-36884 Office and Windows HTML remote code execution activity.

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 24.7.2026

DownloadOpen