LogScale Queries

Category

Network & Security

Network traffic, firewalls, and perimeter security

25 published queries

Categories

// Restrict search to OsVersionInfo Windows events
#event_simpleName=OsVersionInfo event_platform=Win

// Aggregate to get latest build for each Agent ID value

CVE-2025-42701 and CVE-2025-42706 Falcon Version Scoping (OsVersionInfo)

v2

The following query looks for Falcon Sensor for Windows versions that need to be hotfixed or updated to address CVE-2025-42701 and CVE-2025-42706. The datasource for this query is the Windows event OsVersionInfo. That event is generated on sensor start, atsystem reboot, and/or every 24-hours.

LogScaleNetwork & SecurityDetectionEndpointInvestigation

@sebastian · 25.7.2026

// Restrict search to Windows systems in AID Master
| readFile([aid_master_main.csv])
| event_platform=Win

CVE-2025-42701 and CVE-2025-42706 Falcon Version Scoping (aid master main)

v2

The following query looks for Falcon Sensor for Windows versions that need to be hotfixed or updated to address CVE-2025-42701 and CVE-2025-42706. The datasource for this query is the AID Master lookup file. That file is automatically updated every few hours.

LogScaleNetwork & SecurityDetectionEndpointInvestigation

@sebastian · 25.7.2026

// Get OsVersionInfo events
#event_simpleName=OsVersionInfo
// Get latest OsVersionInfo data per aid
| groupBy([aid], function=([selectFromMax(field="@timestamp", include=[event_platform, ComputerName, AgentVersion])]), limit=max)

Check for Unsupported Sensors

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Check for Unsupported Sensors.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check%20for%20Unsupported%20Sensors.md

LogScaleNetwork & SecurityDetectionEndpointInvestigation

@sebastian · 25.7.2026

(#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\chrome\.exe$/i) OR (#event_simpleName=NetworkConnectIP4 RemoteAddressIP4="8.8.8.8" event_platform=Win)
| falconPID:=TargetProcessId | falconPID:=ContextProcessId
| selfJoinFilter([aid, falconPID], where=[{#event_simpleName=ProcessRollup2}, {#event_simpleName=NetworkConnectIP4}], prefilter=true)
| groupBy([aid, falconPID], function=([collect([RemoteAddressIP4, ImageFileName, CommandLine]), count(#event_simpleName, distinct=true, as=eventCount)]))

Combine ProcessRollup2 and NetworkConnectIP4 Events

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Combine ProcessRollup2 and NetworkConnectIP4 Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Combine%20ProcessRollup2%20and%20NetworkConnectIP4%20Events.md

LogScaleNetwork & SecurityDetectionEndpointNetwork

@sebastian · 25.7.2026

```#event_simpleName=FsVolumeMounted
| bitfield:extractFlags(
 field=VolumeDeviceCharacteristics,
  output=[

Decode VolumeDeviceCharacteristics Bitmask

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Decode VolumeDeviceCharacteristics Bitmask.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Decode%20VolumeDeviceCharacteristics%20Bitmask.md

LogScaleNetwork & SecurityDetectionEndpointNetwork

@sebastian · 25.7.2026

// Get events of interest
EventType=Event_ExternalApiEvent EventType=Event_ExternalApiEvent OperationName=userAuthenticate Success=true
// Get ASN Details
| asn(OriginSourceIpAddress, as=asn)

Falcon Authentication from Unexpected GeoHash

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Falcon Authentication from Unexpected GeoHash.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Falcon%20Authentication%20from%20Unexpected%20GeoHash.md

LogScaleNetwork & SecurityAuthenticationDetectionLinux

@sebastian · 25.7.2026

// Get all process execution and DNS events on Windows
(#event_simpleName=ProcessRollup2 OR #event_simpleName=DnsRequest) event_platform=Win
| ComputerName=~wildcard(?ComputerName, ignoreCase=true)
// Normalize file name value across both events

Get DNS Resolutions from Browser Processes

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Get DNS Resolutions from Browser Processes.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Get%20DNS%20Resolutions%20from%20Browser%20Processes.md

LogScaleNetwork & SecurityDetectionEndpointNetwork

@sebastian · 25.7.2026

// Get Windows events where a program is listening on a port under 10000 and all process execution events
event_platform=Win (#event_simpleName=NetworkListenIP4 LocalPort<10000) OR (#event_simpleName=ProcessRollup2)
// Normalize UPID
| falconPID:= TargetProcessId | falconPID:=ContextProcessId

Listening Programs with low port numbers

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Listening Programs with low port numbers.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Listening%20Programs%20with%20low%20port%20numbers.md

LogScaleNetwork & SecurityDetectionEndpointNetwork

@sebastian · 25.7.2026

#event_simpleName=NetworkConnectIP4 RemotePort=3389
| !cidr(RemoteAddressIP4, subnet=["224.0.0.0/4", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.1/32", "169.254.0.0/16", "0.0.0.0/32"])

Omit RFC1819 CIDR Ranges from Search

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Omit RFC1819 CIDR Ranges from Search.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Omit%20RFC1819%20CIDR%20Ranges%20from%20Search.md

LogScaleNetwork & SecurityDetectionEndpointNetwork

@sebastian · 25.7.2026

(#event_simpleName = ProcessRollup2 AND ImageFileName = /.*\\powershell\.exe/) OR (#event_simpleName=DnsRequest AND (DomainName!="ocsp.digicert.com" AND DomainName!="localhost"))

| rename("ContextProcessId",as="TargetProcessId")
| groupby([aid, TargetProcessId], function=stats([count(#event_simpleName, distinct=true), collect(DomainName), collect(ImageFileName), collect(CommandLine)]), limit=max)

PR2 + DNS Cheat Join

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/PR2 + DNS Cheat Join.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/PR2%20%2B%20DNS%20Cheat%20Join.md

LogScaleNetwork & SecurityDetectionEndpointInvestigation

@sebastian · 25.7.2026

// Specify data source and simpleName (index)
#event_simpleName=ProcessRollup2

// search for net.exe and net1.exe (including path, hence the wildcard)

ProcessRollup2 Curation

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/ProcessRollup2 Curation.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/ProcessRollup2%20Curation.md

LogScaleNetwork & SecurityDetectionEndpointLinux

@sebastian · 25.7.2026

#event_simpleName=NetworkReceiveAcceptIP4 event_platform=Win
| in(field="LocalPort", values=[3389, 21, 22, 5901]) 
| !cidr(RemoteAddressIP4, subnet=["224.0.0.0/4", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/32", "169.254.0.0/16", "0.0.0.0/32"])
| communityId(proto=Protocol, sourceip=LocalAddressIP4, destinationip=RemoteAddressIP4, as=communityId)

Scope Network Accept Events

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Scope Network Accept Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Scope%20Network%20Accept%20Events.md

LogScaleNetwork & SecurityDetectionEndpointNetwork

@sebastian · 25.7.2026

#repo=sensor_metadata #data_source_name=aidmaster #data_source_group=aidmaster-api
| groupBy([aid], function=([selectFromMax(field="@timestamp", include=[ComputerName, Time, Version, ConfigIDBuild, AgentVersion])]))
| match(file="falcon/investigate/sensors_support_info.csv", field=ConfigIDBuild, column=BUILD, ignoreCase=true, strict=true)
| parseTimestamp("M/d/yy",field=SUPPORT_ENDS, as=SUPPORT_ENDS_EPOCH, timezone="UTC")

Support Ends

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Support Ends.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Support%20Ends.md

LogScaleNetwork & SecurityDetectionInvestigationNetwork

@sebastian · 25.7.2026

#event_simpleName=/^(NetworkConnectIP4|ProcessRollup2)$/ 
| falconPID:=TargetProcessId | falconPID:=ContextProcessId
| UserID:=UserSid | UserID:=UID
| selfJoinFilter(field=[aid, falconPID], where=[{#event_simpleName=NetworkConnectIP4}, {#event_simpleName=ProcessRollup2}])

Systems Initiating Connections to a High Number of Ports

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Systems Initiating Connections to a High Number of Ports.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Systems%20Initiating%20Connections%20to%20a%20High%20Number%20of%20Ports.md

LogScaleNetwork & SecurityDetectionEndpointNetwork

@sebastian · 25.7.2026

#event_simpleName=UserLogon UserSid=S-1-5-21-*
| in(LogonType, values=["2","10"])
| ipLocation(aip)
| case {UserIsAdmin = "1" | UserIsAdmin := "Yes" ;

UserLogon Query

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/UserLogon Query.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/UserLogon%20Query.md

LogScaleNetwork & SecurityAuthenticationDetectionEndpoint

@sebastian · 25.7.2026

#event_simpleName=ProcessRollup2 ImageFileName=/(\\|\/)(traceroute|tracert|ping|ifconfig|ipconfig|nbtstat|route|getmac)(\.exe)?$/i

(T1016.001) System Network Configuration Discovery - Internet Connection Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1016) System Network Configuration Discovery/(T1016.001) System Network Configuration Discovery - Internet Connection Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1016%29%20System%20Network%20Configuration%20Discovery/%28T1016.001%29%20System%20Network%20Configuration%20Discovery%20-%20Internet%20Connection%20Discovery.md

LogScaleNetwork & SecurityDetectionEndpointNetwork

@sebastian · 25.7.2026

#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\net1?\.exe/i CommandLine=/\s+(view|share)\s+/i) OR (ImageFileName=/\\netview\.exe/i) OR (/NetShareEnum/))

(T1135) Network Share Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1135) Network Share Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1135%29%20Network%20Share%20Discovery.md

LogScaleNetwork & SecurityDetectionEndpointNetwork

@sebastian · 25.7.2026

// Get events of interest for T1217
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/

// Omit events where the browser is the executing process

(T1217) Browser Information Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1217) Browser Information Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1217%29%20Browser%20Information%20Discovery.md

LogScaleNetwork & SecurityDetectionEndpointLinux

@sebastian · 25.7.2026

#event_simpleName=ProcessRollup2

| join({#event_simpleName=FirewallSetRule}, key=ContextProcessId, field=TargetProcessId, include=[FirewallRule, FirewallRuleId])
| ImageFileName=/.*\\(?<fileName>.*\..*)/

Firewall Rule Additions

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Firewall Rule Additions.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Firewall%20Rule%20Additions.md

LogScaleNetwork & SecurityDetectionEndpointFirewall

@sebastian · 24.7.2026

#event_simpleName=CriticalEnvironmentVariableChanged
| EnvironmentVariableName =/(SSH_CONNECTION|USER)/
| EnvironmentVariableValue=/(?<userName>\S+)\n(?<localIP>\d+\.\d+\.\d+\.\d+)\s+(?<localPort>\d+)\s+(?<remoteIP>\d+\.\d+\.\d+\.\d+)\s+(?<remotePort>\d+)$/i
| table([@timestamp, aid, userName, remoteIP, remotePort, localIP, localPort])

Critical Environment Variable Changed SSH

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Critical Environment Variable Changed SSH.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Critical%20Environment%20Variable%20Changed%20SSH.md

LogScaleNetwork & SecurityDetectionEndpointInvestigation

@sebastian · 24.7.2026

(#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\chrome\.exe$/i) OR (#event_simpleName=DnsRequest DomainName=/\.ru$/ event_platform=Win)
| falconPID:=TargetProcessId | falconPID:=ContextProcessId
| selfJoinFilter([aid, falconPID], where=[{#event_simpleName=ProcessRollup2}, {#event_simpleName=DnsRequest}], prefilter=true)
| groupBy([aid, falconPID], function=([collect([DomainName, UserName, ImageFileName, CommandLine])]))

Combine ProcessRollup2 and DnsRequest Events

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Combine ProcessRollup2 and DnsRequest Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Combine%20ProcessRollup2%20and%20DnsRequest%20Events.md

LogScaleNetwork & SecurityDetectionEndpointNetwork

@sebastian · 24.7.2026

//[Full post text.](https://community.crowdstrike.com/cool-query-friday-77/2023-09-20-cool-query-friday-live-from-fal-con-up-leveling-teams-with-multipurpose-text-box-driven-queries-420)

//Create search to look for domain activity...

Get specific events and provide option to specify host

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Friday/2023-09-20 - Cool Query Friday - Up-leveling Teams With Text-box Driven Queries.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Cool-Query-Friday/2023-09-20%20-%20Cool%20Query%20Friday%20-%20Up-leveling%20Teams%20With%20Text-box%20Driven%20Queries.md

LogScaleNetwork & SecurityDetectionLinuxMicrosoft 365

@sebastian · 24.7.2026

// Get successful Falcon console logins
EventType=Event_ExternalApiEvent OperationName=userAuthenticate Success=true

// Get ASN Details for OriginSourceIpAddress

Get successful Falcon console logins

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Friday/2023-06-14 - Cool Query Friday - Watching the Watchers - Profiling Falcon Console Logins via Geohashing.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Cool-Query-Friday/2023-06-14%20-%20Cool%20Query%20Friday%20-%20Watching%20the%20Watchers%20-%20Profiling%20Falcon%20Console%20Logins%20via%20Geohashing.md

LogScaleNetwork & SecurityAuthenticationDetectionLinux

@sebastian · 24.7.2026

#event_simpleName=NetworkConnectIP4
| groupBy([RemotePort], function=count(as=count), limit=max) 
| [sum(count, as=total), sort(field=RemotePort, order=ascending, limit=20000)] 
| percent := 100 * (count / total)

Bottom 10% of NetworkConnect Port Values

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Bottom 10% of NetworkConnct Port Values.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Bottom%2010%25%20of%20NetworkConnct%20Port%20Values.md

LogScaleNetwork & SecurityDetectionNetwork

@sebastian · 24.7.2026

https://www.reddit.com/r/crowdstrike/comments/qid1tj/20211029_cool_query_friday_cpu_ram_disk_firmware/

```
// Get 4 events of interest

Get 4 events of interest

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Friday/2021-10-29 - Cool Query Friday - CPU, RAM, Disk, Firmware, TPM 2.0, and Windows 11.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Cool-Query-Friday/2021-10-29%20-%20Cool%20Query%20Friday%20-%20CPU%2C%20RAM%2C%20Disk%2C%20Firmware%2C%20TPM%202.0%2C%20and%20Windows%2011.md

LogScaleNetwork & SecurityDetectionInvestigationNetwork

@sebastian · 24.7.2026