LogScale Queries

LogScale query

Browse Queries

Discover CQL queries for LogScale and NG-SIEM (same engine; fields differ by target).

Upload Query

Categories

query.txt
#event_simpleName=UserLogon
| UserName!=/^DWM-/i
| UserName!=/^UMFD-/i
| UserName!=/^Lokaler Dienst/i

Endpoint login activity across corporate devices

v1

This query shows endpoint login events collected from corporate Windows laptops throughout the day. The log data includes device identifiers, hardware information, usernames, and login timestamps, providing visibility into user authentication activity across the managed workstation fleet. You can also exclude additional usernames. This query is based on the Falcon Data Replicator repository.

LogScaleInfrastructureAuthenticationEndpointInvestigation

@sebastian · 30.7.2026

DownloadOpen
query.txt
// Get ReflectiveDotnetModuleLoad with non-null ManagedPdbBuildPath field.
#event_simpleName=ReflectiveDotnetModuleLoad event_platform=Win ManagedPdbBuildPath!=""

// Capture FilePath and FileName Fields

Hunt PBD File Paths in Reflective .net Module Loads

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Hunt PBD File Paths in Reflective .net Module Loads.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Hunt%20PBD%20File%20Paths%20in%20Reflective%20.net%20Module%20Loads.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get OsVersionInfo events; sent by sensor every 24-hours or at sensor start or update
#event_simpleName=OsVersionInfo
 
// Narrow search to only include Linux, Container, and K8 systems

CVE-2025-1146 System Scoping (OsVersionInfo with Logon Data)

v2

The query below will look for Linux systems (Linux, K8, Containers) that need to be updated against CVE-2025-1146. The query is based on the event OsVersionInfo which is generated every 24-hours, at sensor start, or at sensor update. It attempts to merge in LogonType 2 and 10 to determine the last logged on user.

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get OsVersionInfo events; sent by sensor every 24-hours or at sensor start or update
#event_simpleName=OsVersionInfo
 
// Narrow search to only include Linux, Container, and K8 systems

CVE-2025-1146 System Scoping (OsVersionInfo)

v2

The query below will look for Linux systems (Linux, K8, Containers) that need to be updated against CVE-2025-1146. The query is based on the event OsVersionInfo which is generated every 24-hours, at sensor start, or at sensor update.

LogScaleDetection & MonitoringDetectionEndpointKubernetes

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Read in AID Master file; REMINDER: this file updates every 4 hours.
| readFile("aid_master_main.csv")
 
// Narrow search to only include Linux, Container, and K8 systems

CVE-2025-1146 System Scoping (aid master)

v2

The query below will look for Linux systems (Linux, K8, Containers) that need to be updated against CVE-2025-1146. The query is based on the lookup file aid_master_main.csv which is automatically updated every 4 hours.

LogScaleDetection & MonitoringDetectionKubernetesLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Restrict search to OsVersionInfo Windows events
#event_simpleName=OsVersionInfo event_platform=Win

// Aggregate to get latest build for each Agent ID value

CVE-2025-42701 and CVE-2025-42706 Falcon Version Scoping (OsVersionInfo)

v2

The following query looks for Falcon Sensor for Windows versions that need to be hotfixed or updated to address CVE-2025-42701 and CVE-2025-42706. The datasource for this query is the Windows event OsVersionInfo. That event is generated on sensor start, atsystem reboot, and/or every 24-hours.

LogScaleNetwork & SecurityDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Restrict search to Windows systems in AID Master
| readFile([aid_master_main.csv])
| event_platform=Win

CVE-2025-42701 and CVE-2025-42706 Falcon Version Scoping (aid master main)

v2

The following query looks for Falcon Sensor for Windows versions that need to be hotfixed or updated to address CVE-2025-42701 and CVE-2025-42706. The datasource for this query is the AID Master lookup file. That file is automatically updated every few hours.

LogScaleNetwork & SecurityDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
// CVE-2025-53770 - WebShell Discovery from w3wp.exe

correlate(
    cmd: {

CVE-2025-53770 - SharePoint ToolShell

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/CVE-2025-53770 - SharePoint ToolShell.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/CVE-2025-53770%20-%20SharePoint%20ToolShell.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=AgentOnline event_platform=Win  
| groupBy([aid], function=([selectLast([BaseTime])]))
| LastReboot_milli:=(BaseTime/1000*1024)+978307200
| round("LastReboot_milli")

Calculate Last Windows Boot Time

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Calculate Last Windows Boot Time.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Calculate%20Last%20Windows%20Boot%20Time.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=ProcessRollup2 ImageFileName=/\\powershell(_ise)?\.exe/i) OR (#event_simpleName=EndOfProcess event_platform=Win CLICreationCount>0)
| selfJoinFilter([aid, TargetProcessId], where=[{#event_simpleName=ProcessRollup2}, {#event_simpleName=EndOfProcess}], prefilter=true)
| regex(".+\\\(?<FileName>.+$)", field=ImageFileName, strict=false)
| groupBy([aid, TargetProcessId], function=([count(#event_simpleName, distinct=true, as=eventCount), min(ProcessStartTime, as=processStartTime), max(ContextTimeStamp, as=processEndTime), collect([CLICreationCount, FileName])]))

Calculate Process Run Time

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Calculate Process Run Time.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Calculate%20Process%20Run%20Time.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/FileWritten$/ 
| case {
    Size>=1099511627776 | CommonSize:=unit:convert(Size, to=T) | format("%,.2f TB",field=["CommonSize"], as="CommonSize");
    Size>=1073741824 | CommonSize:=unit:convert(Size, to=G) | format("%,.2f GB",field=["CommonSize"], as="CommonSize");

Case to convert Size to appropriate unit of measure

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Case to convert Size to appropriate unit of measure.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Case%20to%20convert%20Size%20to%20appropriate%20unit%20of%20measure.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get uninstall and heartbeat events
#event_simpleName=AcUninstallConfirmation OR #event_simpleName=SensorHeartbeat

// Narrow dataset by Agent ID; check both events happen on a single system

Check for Falcon AcUninstallConfirmation Event Followed by no Heartbeat Events

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Check for Falcon AcUninstallConfirmation Event Followed by no Heartbeat Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check%20for%20Falcon%20AcUninstallConfirmation%20Event%20Followed%20by%20no%20Heartbeat%20Events.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get UI Audit Events
#repo="detections" ExternalApiType=/Remote/

// Check commands for "get"

Check for Falcon Analysts Running get Command

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Check for Falcon Analysts Running get Command.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check%20for%20Falcon%20Analysts%20Running%20get%20Command.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=SensorHeartbeat
| groupBy([aid], function=selectLast([@timestamp, ComputerName, SensorStateBitMap]), limit=max)
| bitfield:extractFlags(
field=SensorStateBitMap,

Check for RTR Being Disabled

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Check for RTR Being Disabled.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check%20for%20RTR%20Being%20Disabled.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo
| osData:=concat([OSVersionString, ProductName])
| groupBy([aid], function=([selectFromMax(field="@timestamp", include=[event_platform, RFMState, LinuxSensorBackend, AgentVersion, osData])]))
| RFMState match {

Check for Sensors in RFM

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Check for Sensors in RFM.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check%20for%20Sensors%20in%20RFM.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get OsVersionInfo events
#event_simpleName=OsVersionInfo
// Get latest OsVersionInfo data per aid
| groupBy([aid], function=([selectFromMax(field="@timestamp", include=[event_platform, ComputerName, AgentVersion])]), limit=max)

Check for Unsupported Sensors

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Check for Unsupported Sensors.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check%20for%20Unsupported%20Sensors.md

LogScaleNetwork & SecurityDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\(?<fileName>chrome\.exe)$/i
| groupBy([cid, aid, fileName, SHA256HashData])
| match(file="fdr_aidmaster.csv", field=aid, include=ComputerName, ignoreCase=true, strict=false)
| join({#event_simpleName=PeVersionInfo event_platform=Win | ImageFileName=/\\chrome\.exe/i | groupBy([SHA256HashData, FixedFileVersion, CompanyName], function=selectLast([ComputerName, FixedFileVersion]))}, include=[FixedFileVersion, CompanyName], field=[SHA256HashData])

Chrome Version Number Evaluation

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Chrome Version Number Evaluation.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Chrome%20Version%20Number%20Evaluation.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Fleshed out query for clickfix detection

#event_simpleName=ProcessRollup2 
| #repo=base_sensor

ClickFixHunting

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/ClickFixHunting.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/ClickFixHunting.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/(winword|excel)\.exe/i) OR (#event_simpleName=ZipFileWritten event_platform=Win)
| falconPID:=ContextProcessId | falconPID:=TargetProcessId
| selfJoinFilter(field=[aid, falconPID], where=[{#event_simpleName=ProcessRollup2}, {#event_simpleName=ZipFileWritten}], prefilter=true)
| case{

Combine ProcessRollup2 and FileWritten Events

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Combine ProcessRollup2 and FileWritten Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Combine%20ProcessRollup2%20and%20FileWritten%20Events.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\chrome\.exe$/i) OR (#event_simpleName=NetworkConnectIP4 RemoteAddressIP4="8.8.8.8" event_platform=Win)
| falconPID:=TargetProcessId | falconPID:=ContextProcessId
| selfJoinFilter([aid, falconPID], where=[{#event_simpleName=ProcessRollup2}, {#event_simpleName=NetworkConnectIP4}], prefilter=true)
| groupBy([aid, falconPID], function=([collect([RemoteAddressIP4, ImageFileName, CommandLine]), count(#event_simpleName, distinct=true, as=eventCount)]))

Combine ProcessRollup2 and NetworkConnectIP4 Events

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Combine ProcessRollup2 and NetworkConnectIP4 Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Combine%20ProcessRollup2%20and%20NetworkConnectIP4%20Events.md

LogScaleNetwork & SecurityDetectionEndpointNetwork

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Insert Discovery commands of interest here
event_platform=Win #event_simpleName=ProcessRollup2 FileName=/(whoami|ping|net1?|systeminfo|quser|ipconfig)/iF

// Restrict to non-system UserSid Values

Count Windows Discovery Commands Per User

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Count Windows Discovery Commands Per User.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Count%20Windows%20Discovery%20Commands%20Per%20User.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=UserLogon //UserName="name@example.com"
| UserName=~wildcard(?{UserName="*"}, ignoreCase=true)
| LogonTime:=LogonTime*1000
| time:dayOfWeekName(LogonTime)

Create Heatmap of Login Activity

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Create Heatmap of Login Activity.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Create%20Heatmap%20of%20Login%20Activity.md

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
//Get PowerShell Events
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\powershell\.exe/i
//Look for PS flags that indicate an encoded command
| CommandLine=/\s+\-(e|encoded|encodedcommand|enc)\s+/i

Decode Base64

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Decode Base64.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Decode%20Base64.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
```#event_simpleName=FsVolumeMounted
| bitfield:extractFlags(
 field=VolumeDeviceCharacteristics,
  output=[

Decode VolumeDeviceCharacteristics Bitmask

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Decode VolumeDeviceCharacteristics Bitmask.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Decode%20VolumeDeviceCharacteristics%20Bitmask.md

LogScaleNetwork & SecurityDetectionEndpointNetwork

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 WindowFlags=*
| bitfield:extractFlags(
field=WindowFlags,
 output=[

Decoding WindowFlags Bitmask

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Decoding WindowFlags Bitmask.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Decoding%20WindowFlags%20Bitmask.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get browser extension event
#event_simpleName=InstalledBrowserExtension BrowserExtensionId!="no-extension-available"
| aid=?aid
| ComputerName=?ComputerName

Enumerate Browser Extensions

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Enumerate Browser Extensions.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Enumerate%20Browser%20Extensions.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get all DriverLoad events and Event_ModuleSummaryInfoEvent events so certificate data can be merged in
(#event_simpleName=DriverLoad event_platform=Win) OR (#repo=detections ExternalApiType=Event_ModuleSummaryInfoEvent )

// Shorten file path from DriverLoad event

Enumerate Windows Driver Loads

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Enumerate Windows Driver Loads.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Enumerate%20Windows%20Driver%20Loads.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo event_platform=Win

| groupby(aid, function=selectLast([AgentVersion, event_platform, @timestamp]))
| AgentVersion=/(?<majorVersion>\d+)\.(?<minorVersion>\d+)\.(?<buildNumber>\d+)\.\d+/

Evaluate Falcon Agent Version

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Evaluate Falcon Agent Version.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Evaluate%20Falcon%20Agent%20Version.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/UserLogon/
| case{
    #event_simpleName=UserLogon | SuccessLogonTime:=ContextTimeStamp;
    #event_simpleName=UserLogonFailed2 | FailedLogonTime:=ContextTimeStamp;

Failed and Successful User Logon Events

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Failed and Successful User Logon Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Failed%20and%20Successful%20User%20Logon%20Events.md

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get events of interest
EventType=Event_ExternalApiEvent EventType=Event_ExternalApiEvent OperationName=userAuthenticate Success=true
// Get ASN Details
| asn(OriginSourceIpAddress, as=asn)

Falcon Authentication from Unexpected GeoHash

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Falcon Authentication from Unexpected GeoHash.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Falcon%20Authentication%20from%20Unexpected%20GeoHash.md

LogScaleNetwork & SecurityAuthenticationDetectionLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/FileWritten$/ AND ((event_platform=Win DiskParentDeviceInstanceId="USB*") OR (event_platform=Mac IsOnRemovableDisk=1)) AND TargetFileName!="*.Spotlight-V100*"
| groupBy([ComputerName], function=([collect([TargetFileName]), count(TargetFileName, as=TotalFile), sum(Size, as=SumSize)]))
| TotalFiles > 10 OR SumSize > 5242880
| case {

Files Written to Removable Media

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Files Written to Removable Media.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Files%20Written%20to%20Removable%20Media.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get file names of interest
#event_simpleName=ProcessRollup2 event_platform=Win
| in(field="FileName", values=[whoami.exe, arp.exe, cmd.exe, net.exe, net1.exe, ipconfig.exe, route.exe, netstat.exe, nslookup.exe, nltest.exe, systeminfo.exe, wmic.exe, tasklist.exe, tracert.exe, ping.exe, adfind.exe, nbtstat.exe, find.exe, ldifde.exe, netsh.exe, wbadmin.exe], ignoreCase=true)

Frequency Analysis via Program Clustering

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Frequency Analysis via Program Clustering.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Frequency%20Analysis%20via%20Program%20Clustering.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get all process execution and DNS events on Windows
(#event_simpleName=ProcessRollup2 OR #event_simpleName=DnsRequest) event_platform=Win
| ComputerName=~wildcard(?ComputerName, ignoreCase=true)
// Normalize file name value across both events

Get DNS Resolutions from Browser Processes

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Get DNS Resolutions from Browser Processes.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Get%20DNS%20Resolutions%20from%20Browser%20Processes.md

LogScaleNetwork & SecurityDetectionEndpointNetwork

@sebastian · 25.7.2026

DownloadOpen
query.txt
#sampleType = repository
| timechart(repo,
function={sum(ingestAfterFieldRemovalSize)}, minSpan=1h, limit=20)

Get Repository Ingestion Data for LogScale SaaS

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Get Repository Ingestion Data for LogScale SaaS.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Get%20Repository%20Ingestion%20Data%20for%20LogScale%20SaaS.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#repo=?repo #type=?type #Vendor=?Vendor
| eventSize()
| unit:convert(_eventSize, to="G")
| sum("_eventSize")

Get Repository Ingestion in Raptor

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Get Repository Ingestion in Raptor.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Get%20Repository%20Ingestion%20in%20Raptor.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get Event Required on Windows Platform
#event_simpleName=AgentOnline event_platform=Win
// Convert BastTime in epoch Time Stamp

Get Windows OS Boot Time

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Get Windows OS Boot Time.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Get%20Windows%20OS%20Boot%20Time.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=HttpRequestDetect
| parseHexString("HttpPostBody", as=b64data)
| format("%,.4s", field=b64data, as=b64data)
| MagicNumber := base64Decode(b64data, charset="UTF-8")

HttpRequestDetect

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/HttpRequestDetect.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/HttpRequestDetect.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get bcdedit.exe process executions
#event_simpleName=ProcessRollup2 event_platform=Win FileName="bcdedit.exe"

// Create process lineage tree for easier reading

Hunting bcdedit.exe usage

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Hunting bcdedit.exe usage.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Hunting%20bcdedit.exe%20usage.md

LogScaleDetection & MonitoringDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2

| join({#event_simpleName=IsoExtensionFileWritten OR #event_simpleName=ImgExtensionFileWritten}, key=[aid, ContextProcessId], field=[aid, TargetProcessId], include=[TargetFileName])
| ImageFileName=/(\/|\\)(?<FileName>\w*\.?\w*)$/

ISO IMG Written to Disk w Responsible Process

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/ISO_IMG Written to Disk w_ Responsible Process.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/ISO_IMG%20Written%20to%20Disk%20w_%20Responsible%20Process.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get UserLogon events for Windows RDP sessions
#event_simpleName=UserLogon event_platform=Win LogonType=10 RemoteAddressIP4=*

// Omit results if the RemoteAddressIP4 field is RFC1819

Impossible Time To Travel (UserLogon)

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Impossible Time To Travel (UserLogon).md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Impossible%20Time%20To%20Travel%20%28UserLogon%29.md

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get browser extension event
#event_simpleName=InstalledBrowserExtension BrowserExtensionId!="no-extension-available"

// Aggregate by event_platform, BrowserName, ExtensionID and ExtensionName

Installed Browser Extensions

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Installed Browser Extensions.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Installed%20Browser%20Extensions.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
#repo=sensor_metadata #data_source_name=aidmaster
| groupBy([cid, aid], function=([selectFromMax(field="@timestamp", include=[AgentLoadFlags, AgentLocalTime, AgentTimeOffset, AgentVersion, BiosManufacturer, BiosVersion, ChassisType, City, ComputerName, ConfigBuild, ConfigIDBuild, Continent, Country, FalconGroupingTags, FirstSeen, HostHiddenStatus, MachineDomain, OU, PointerSize, ProductType, SensorGroupingTags, ServicePackMajor, SiteName, SystemManufacturer, SystemProductName, @timezone, Timezone, Version, aid, aip, cid, event_platform])]))
| lastSeen:=@timestamp
| formatTime(format="%F %T", as="lastSeen", field=lastSeen)

Leveraging the aidmaster repo

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Leveraging the aidmaster repo.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Leveraging%20the%20aidmaster%20repo.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
#repo=detections ExternalApiType=Event_IdpDetectionSummaryEvent
| rename([[TargetEndpointHostName, TargetEndpoint], [SourceEndpointHostName, SourceEndpoint], [TargetAccountName, TargetAccount], [SourceAccountName, SourceAccount]])
| format("[FalconHostLink](%s)", field=[FalconHostLink], as="FalconHostLink")
| format(format="%s > %s", field=[Tactic, Technique], as=MITRE)

List All ITP Detections

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/List All ITP Detections.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/List%20All%20ITP%20Detections.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get Windows events where a program is listening on a port under 10000 and all process execution events
event_platform=Win (#event_simpleName=NetworkListenIP4 LocalPort<10000) OR (#event_simpleName=ProcessRollup2)
// Normalize UPID
| falconPID:= TargetProcessId | falconPID:=ContextProcessId

Listening Programs with low port numbers

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Listening Programs with low port numbers.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Listening%20Programs%20with%20low%20port%20numbers.md

LogScaleNetwork & SecurityDetectionEndpointNetwork

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Create a live table of the executables in System32/SysWOW64
| defineTable(query={
    #event_simpleName=ProcessRollup2 event_platform=Win FilePath=/\\Windows\\(System32|SysWOW64)\\/ FileName=/\.exe$/
    | FilePath=/(\\Device\\HarddiskVolume\d+)?(?<ExpectedFilePath>\\.+)/

Look for files running outside Windows systems folders with name masquerading

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Look for files running outside Windows systems folders with name masquerading.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Look%20for%20files%20running%20outside%20Windows%20systems%20folders%20with%20name%20masquerading.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#repo=sensor_metadata
#data_source_name=aid-policy
| parseJson(field=groups, prefix=groups_arr)
| concatArray(groups_arr, separator=",", as=groups_arr)

Map Agent ID values to Host Group Names

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Map Agent ID values to Host Group Names.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Map%20Agent%20ID%20values%20to%20Host%20Group%20Names.md

LogScaleInvestigation & TroubleshootingDetectionInvestigationTroubleshooting

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get alert events
#repo=detections (ExternalApiType=/Event_(Epp|Idp|Mobile)DetectionSummaryEvent/) OR (ExternalApiType=Event_UserActivityAuditEvent OperationName=detection_update)
| case{
    ExternalApiType=Event_UserActivityAuditEvent Attributes.update_status="closed" | ResolveTime:=@timestamp;

Mean Time to React, Respond, and Resolve

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Mean Time to React, Respond, and Resolve.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Mean%20Time%20to%20React%2C%20Respond%2C%20and%20Resolve.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
aid=1e0afc34e9634710bfcd2f46d8564ab1 (#event_simpleName=ProcessRollup2 FileName="powershell.exe")
| select([aid, ComputerName, CommandLine])
| join(key=aid, field=aid, query={#repo=sensor_metadata}, include=([AgentVersion, BiosManufacturer, FalconGroupingTags]))

Merge Legacy AID Master Info

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Merge Legacy AID Master Info.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Merge%20Legacy%20AID%20Master%20Info.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2
| aid=?{aid=*}
| ImageFileName =~ wildcard(?{ImageFileName="*"}, ignoreCase=true, includeEverythingOnAsterisk=true)
| ImageFileName=/(\/|\\)(?<FileName>\w*\.?\w*)$/

Merge Parent Child PR2 with Join

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Merge Parent_Child PR2 with Join.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Merge%20Parent_Child%20PR2%20with%20Join.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=NetworkConnectIP4 RemotePort=3389
| !cidr(RemoteAddressIP4, subnet=["224.0.0.0/4", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.1/32", "169.254.0.0/16", "0.0.0.0/32"])

Omit RFC1819 CIDR Ranges from Search

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Omit RFC1819 CIDR Ranges from Search.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Omit%20RFC1819%20CIDR%20Ranges%20from%20Search.md

LogScaleNetwork & SecurityDetectionEndpointNetwork

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName = ProcessRollup2 AND ImageFileName = /.*\\powershell\.exe/) OR (#event_simpleName=DnsRequest AND (DomainName!="ocsp.digicert.com" AND DomainName!="localhost"))

| rename("ContextProcessId",as="TargetProcessId")
| groupby([aid, TargetProcessId], function=stats([count(#event_simpleName, distinct=true), collect(DomainName), collect(ImageFileName), collect(CommandLine)]), limit=max)

PR2 + DNS Cheat Join

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/PR2 + DNS Cheat Join.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/PR2%20%2B%20DNS%20Cheat%20Join.md

LogScaleNetwork & SecurityDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get all Windows ProcessRollup2 events with .dll or .exe listed in the call stack
event_platform=Win #event_simpleName=ProcessRollup2 CallStackModuleNames=/\.(dll|exe)/

// Create filters to narrow searches

Parse Windows Call Stack

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Parse Windows Call Stack.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Parse%20Windows%20Call%20Stack.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get SensorHeartbeat events for Windows, macOS, and Linux
#event_simpleName=SensorHeartbeat event_platform=/(^(Win|Mac|Lin)$)/
// Get most recent event for each aid value and include event_platform
| groupBy([event_platform, aid], function=([selectFromMax(field="@timestamp", include=[SensorStateBitMap])]))

Percentage of Sensors in RFM

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Percentage of Sensors in RFM.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Percentage%20of%20Sensors%20in%20RFM.md

LogScaleDetection & MonitoringDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo event_platform=/^(Win|Mac|Lin)$/

| groupBy(field=#cid, function=[count(aid, distinct=true, as=totalcount), {event_platform=Lin | count(aid, distinct=true, as=Linux)},{ event_platform=Mac | count(aid, distinct=true, as=Mac)}, { event_platform=Win | count(aid, distinct=true, as=Windows)}])
| linuxPercentage := (Linux/totalcount)*100 | format(format="%,.3f%%", field=[linuxPercentage], as=linuxPercentage)

Percentage of Windows Mac Linux Endpoints

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Percentage of Windows_Mac_Linux Endpoints.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Percentage%20of%20Windows_Mac_Linux%20Endpoints.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
| bitfield:extractFlags(
 field=ProcessCreateFlags,
  output=[
    [0,DEBUG_PROCESS],

Process ProcessCreateFlags

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Process ProcessCreateFlags.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Process%20ProcessCreateFlags.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Specify data source and simpleName (index)
#event_simpleName=ProcessRollup2

// search for net.exe and net1.exe (including path, hence the wildcard)

ProcessRollup2 Curation

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/ProcessRollup2 Curation.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/ProcessRollup2%20Curation.md

LogScaleNetwork & SecurityDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get ProcessRollup2 events for Windows with Mark of the Web field set
#event_simpleName=ProcessRollup2 event_platform=Win ZoneIdentifier=*
// Parse ConfigBuild for Falcon link syntehsis

ProcessRollup2 Files With Mark of the Web

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/ProcessRollup2 Files With Mark of the Web.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/ProcessRollup2%20Files%20With%20Mark%20of%20the%20Web.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=DetectionExcluded ExclusionSource=6
| PatternId =~ match(file="falcon/investigate/detect_patterns.csv", column=PatternId, strict=false)
| case {
    ExclusionType=1 | ExclusionType_Readable:="IOA" | Detail:=CommandLine;

Profiling IOC and IOA Exclusions in Falcon

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Profiling IOC and IOA Exclusions in Falcon.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Profiling%20IOC%20and%20IOA%20Exclusions%20in%20Falcon.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo  RFMState=*

| day := formatTime("%Y-%m-%d", field=@timestamp, locale=en_US, timezone=Z)
| groupBy([aid, day], function=(selectLast([RFMState, @timestamp])), limit=max)

RFM State by Day

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/RFM State by Day.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/RFM%20State%20by%20Day.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win
// Add in additional program names here.
| in(field="FileName", values=[anydesk.exe, AteraAgent.exe, teamviewer.exe, SRService.exe, SRManager.exe, SRServer.exe, SRAgent.exe, ClientService.exe, "ScreenConnect.WindowsClient.exe", ngrok.exe], ignoreCase=true)
| FilePath=/\\Device\\HarddiskVolume\d\\(?<ShortFilePath>.+$)/

RMM Tool Hunting

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/RMM Tool Hunting.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/RMM%20Tool%20Hunting.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/.*\\powershell\.exe/

| CommandLine=/.*\s+\-(e|encoded|encodedcommand|enc)\s+.*/
| length("CommandLine", as="cmdLength")

Rare and Common Encrypted Command Lines

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Rare and Common Encrypted Command Lines.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Rare%20and%20Common%20Encrypted%20Command%20Lines.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=/^(SystemCapacity|ResourceUtilization)$/) OR (#repo=sensor_metadata #data_source_name=aidmaster)
| case {
    event_platform=Lin | ProductType:=3;
    event_platform=Mac | ProductType:=1;

Resource Utilization

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Resource Utilization.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Resource%20Utilization.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=NetworkReceiveAcceptIP4 event_platform=Win
| in(field="LocalPort", values=[3389, 21, 22, 5901]) 
| !cidr(RemoteAddressIP4, subnet=["224.0.0.0/4", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/32", "169.254.0.0/16", "0.0.0.0/32"])
| communityId(proto=Protocol, sourceip=LocalAddressIP4, destinationip=RemoteAddressIP4, as=communityId)

Scope Network Accept Events

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Scope Network Accept Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Scope%20Network%20Accept%20Events.md

LogScaleNetwork & SecurityDetectionEndpointNetwork

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ScriptControlScanInfo event_platform=Win

| ScriptContent=/FromBase64String/i
| entropy := shannonEntropy("ScriptContent")

Script Content Entropy

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Script Content Entropy.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Script%20Content%20Entropy.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo
| field_temp:= ?{ComputerName="*"}
| case {
	field_temp != /^\*$/ | regex(field=field_temp,regex = "(?<field_matched>.*?)(,|$)", repeat="true") | test(ComputerName==field_matched) | drop([field_matched,field_temp]) ;

Searching Comma Delineated List With User Input

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Searching Comma Delineated List With User Input.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Searching%20Comma%20Delineated%20List%20With%20User%20Input.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get all sensor heartbeat events
#event_simpleName=SensorHeartbeat

// Get last event for each Agent ID value

Sensors without Heartbeat Event in 20 Minutes

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Sensors without Heartbeat Event in 20 Minutes.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Sensors%20without%20Heartbeat%20Event%20in%2020%20Minutes.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
defineTable(
    query={
        #repo="sensor_metadata" #data_source_name="policyinfo" #data_source_group="sensor-update"
        | groupBy(id, function=selectFromMax(field="@timestamp", include=[release_id]))

Show Sensor Update Policies

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Show Sensor Update Policies.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Show%20Sensor%20Update%20Policies.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#repo=sensor_metadata #data_source_name=aidmaster #data_source_group=aidmaster-api
| groupBy([aid], function=([selectFromMax(field="@timestamp", include=[ComputerName, Time, Version, ConfigIDBuild, AgentVersion])]))
| match(file="falcon/investigate/sensors_support_info.csv", field=ConfigIDBuild, column=BUILD, ignoreCase=true, strict=true)
| parseTimestamp("M/d/yy",field=SUPPORT_ENDS, as=SUPPORT_ENDS_EPOCH, timezone="UTC")

Support Ends

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Support Ends.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Support%20Ends.md

LogScaleNetwork & SecurityDetectionInvestigationNetwork

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get events of interest
#repo=detections 
| in(field="ExternalApiType", values=[Event_UserActivityAuditEvent, Event_EppDetectionSummaryEvent])

Survival of the Fastest

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Survival of the Fastest.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Survival%20of%20the%20Fastest.md

LogScaleDetection & MonitoringDetectionLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(SystemCapacity|ResourceUtilization)$/

| groupBy(aid, function=([selectLast([CpuProcessorName, PhysicalCoreCount, LogicalCoreCount, AverageCpuUsage, MemoryTotal, MaxUsedRam, AverageUsedRam, MaxUsedRam, AvailableDiskSpace])]))
| CpuProcessorName=* AND AvailableDiskSpace=*

SystemCapacity & ResourceUtilization

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/SystemCapacity & ResourceUtilization.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/SystemCapacity%20%26%20ResourceUtilization.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(NetworkConnectIP4|ProcessRollup2)$/ 
| falconPID:=TargetProcessId | falconPID:=ContextProcessId
| UserID:=UserSid | UserID:=UID
| selfJoinFilter(field=[aid, falconPID], where=[{#event_simpleName=NetworkConnectIP4}, {#event_simpleName=ProcessRollup2}])

Systems Initiating Connections to a High Number of Ports

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Systems Initiating Connections to a High Number of Ports.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Systems%20Initiating%20Connections%20to%20a%20High%20Number%20of%20Ports.md

LogScaleNetwork & SecurityDetectionEndpointNetwork

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2

| ImageFileName=/(\\|\/)(?<fileName>whoami+(\.exe)?$)/i
| concat([UID, UserSid], as="userIdentifier")

Two whoami Commands Run

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Two whoami Commands Run.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Two%20whoami%20Commands%20Run.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=ProcessRollup2 ImageFileName=/\\psexec64\.exe/i ParentBaseFileName=/powershell\.exe/i)

| rename(field="ImageFileName", as="ChildImageFileName")
| rename(field="CommandLine", as="ChildCommandLine")

Use Join on Two Scoped Events

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Use Join on Two Scoped Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Use%20Join%20on%20Two%20Scoped%20Events.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
| createEvents(["color=blue", "shape=round", "size=large"])
| kvParse()
| transpose(limit=1000)
| column := upper(column)

Use Transpose to Convert Field Names to Upper Case

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Use Transpose to Convert Field Names to Upper Case.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Use%20Transpose%20to%20Convert%20Field%20Names%20to%20Upper%20Case.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get two events of interest
event_platform=Win #event_simpleName=/^(UserAccountAddedToGroup|ProcessRollup2)$/ 

// Begin data normalization

User Added to Group

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/User Added to Group.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/User%20Added%20to%20Group.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=UserLogon UserSid=S-1-5-21-*
| in(LogonType, values=["2","10"])
| ipLocation(aip)
| case {UserIsAdmin = "1" | UserIsAdmin := "Yes" ;

UserLogon Query

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/UserLogon Query.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/UserLogon%20Query.md

LogScaleNetwork & SecurityAuthenticationDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=UserLogon UserSid=S-1-5-21-*
| in(LogonType, values=["2","10"])
| ipLocation(aip)
| $falcon/helper:enrich(field=UserIsAdmin)

UserLogon

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/UserLogon.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/UserLogon.md

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 ImageFileName=/(\\|\/)whoami/i
| groupBy([aid], function=(count(aid, as=executionCount)))
| myThreshold:=?myThreshold
| myThreshold:=if(condition=(myThreshold == "*"), then="0", else=myThreshold)

Using Editable Threshold Values

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Using Editable Threshold Values.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Using%20Editable%20Threshold%20Values.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
correlate(
    // Search for grandparent process
    grandparent: {
         #event_simpleName=ProcessRollup2 event_platform=Win FileName!="explorer.exe" CommandLine=*

Using correlate() to hunt process lineage

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Using correlate() to hunt process lineage.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Using%20correlate%28%29%20to%20hunt%20process%20lineage.md

LogScaleDetection & MonitoringDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get RTR Start events
#repo=detections #event_simpleName=Event_RemoteResponseSessionStartEvent

// Rename Agent ID value

View Recent RTR Sessions

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/View Recent RTR Sessions.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/View%20Recent%20RTR%20Sessions.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
event_type=ZeroTrustHostAssessment
| groupBy([aid], function=([selectFromMax(field="@timestamp", include=[scores.os, scores.sensor, scores.overall])]))
| join(query={#data_source_name=aidmaster }, field=[aid], include=[ComputerName, event_platform])

Zero Trust Host Assessment Scores

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Zero Trust Host Assessment Scores.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Zero%20Trust%20Host%20Assessment%20Scores.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win /(mainWindowTitle|Get-Process|GetForegroundWindow|mainWindowTitle)/i

(T1010) Application Window Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1010) Application Window Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1010%29%20Application%20Window%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\reg\.exe/
| ImageFileName=/^//.+//(?<FileName>reg\.exe)/
| FileName:=lower("FileName") 
| ParentBaseFileName:=lower("ParentBaseFileName")

(T1012) Query Registry

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1012) Query Registry.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1012%29%20Query%20Registry.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 ImageFileName=/(\\|\/)(traceroute|tracert|ping|ifconfig|ipconfig|nbtstat|route|getmac)(\.exe)?$/i

(T1016.001) System Network Configuration Discovery - Internet Connection Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1016) System Network Configuration Discovery/(T1016.001) System Network Configuration Discovery - Internet Connection Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1016%29%20System%20Network%20Configuration%20Discovery/%28T1016.001%29%20System%20Network%20Configuration%20Discovery%20-%20Internet%20Connection%20Discovery.md

LogScaleNetwork & SecurityDetectionEndpointNetwork

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ((ImageFileName=/\\(ping|tracert)\.exe/i) OR (ImageFileName=/\\net1?\.exe/i CommandLine=/view/i) OR (ImageFileName=/\\nltest\.exe/i CommandLine=/\/dclist/i) OR (/\\etc\\hosts\\/i))

(T1018) Remote System Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1018) Remote System Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1018%29%20Remote%20System%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 ((ImageFileName=/(\\|\/)(w|who|whoami)(\.exe)?$/i) OR (event_platform=Mac ImageFileName=/\/dscl/i CommandLine=/users/i))

(T1033) System Owner User Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1033) System Owner_User Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1033%29%20System%20Owner_User%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\tasklist\.exe/) OR (/(Get-Process|CreateToolhelp32Snapshot)/i))

(T1057) Process Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1057) Process Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1057%29%20Process%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\net1?\.exe/i CommandLine=/localgroup/i) OR (/get-localgroup/i))

(T1069.001) Permission Groups Discovery - Local Groups

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1069) Permission Groups Discovery/(T1069.001) Permission Groups Discovery - Local Groups.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1069%29%20Permission%20Groups%20Discovery/%28T1069.001%29%20Permission%20Groups%20Discovery%20-%20Local%20Groups.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\net1?\.exe/i CommandLine=/group.+\/domain/i

(T1069.002) Permission Groups Discovery - Domain Groups

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1069) Permission Groups Discovery/(T1069.002) Permission Groups Discovery - Domain Groups.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1069%29%20Permission%20Groups%20Discovery/%28T1069.002%29%20Permission%20Groups%20Discovery%20-%20Domain%20Groups.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ /(Get\-MsolRole|get\-member\-groups|ListRolePolicies|ListAttachedRolePolicies|GetBucketAcl)/i

(T1069.003) Permission Groups Discovery - Cloud Groups

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1069) Permission Groups Discovery/(T1069.003) Permission Groups Discovery - Cloud Groups.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1069%29%20Permission%20Groups%20Discovery/%28T1069.003%29%20Permission%20Groups%20Discovery%20-%20Cloud%20Groups.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ((ImageFileName=/\\(fsutil|fsinfo|drives|systeminfo|vssadmin|hostname)\.exe/i) OR (ImageFileName=/\\net1?\.exe/i CommandLine=/config/i))

(T1082) System Information Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1082) System Information Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1082%29%20System%20Information%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win /Get-GlobalAddressList/

(T1087.003) Account Discovery - Email Account

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1087) Account Discovery/(T1087.003) Account Discovery - Email Account.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1087%29%20Account%20Discovery/%28T1087.003%29%20Account%20Discovery%20-%20Email%20Account.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=ProcessRollup2 CommandLine=/az\s+ad\s+user\s+list/i) OR (#event_simpleName=ProcessRollup2 CommandLine=/aws\s+iam\s+list\-(roles|users)/i) OR (#event_simpleName=ProcessRollup2 CommandLine=/gcloud\s+ (iam\s+service\-accounts\s+list|projects\s+get\-iam\-policy)/i)

(T1087.004) Account Discovery - Cloud Account

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1087) Account Discovery/(T1087.004) Account Discovery - Cloud Account.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1087%29%20Account%20Discovery/%28T1087.004%29%20Account%20Discovery%20-%20Cloud%20Account.md

LogScaleDetection & MonitoringAWSDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\net1?\.exe/i CommandLine=/(user|group).+\/domain/i) OR (#event_simpleName=/^(CommandHistory|ScriptControl)/ event_platform=Win /Get-ADUser|Get-ADGroupMember/i)

(T1087.002) Account Discovery - Domain Account

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1087) Account Discovery/(T1087.002) Account Discovery - Domain Account.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1087%29%20Account%20Discovery/%28T1087.002%29%20Account%20Discovery%20-%20Domain%20Account.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\fsutil\.exe/i CommandLine=/fsinfo/i

(T1120) Peripheral Device Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1120) Peripheral Device Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1120%29%20Peripheral%20Device%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ /(dir|tree|ls|find|locate|show)\s+/i

(T1083) File and Directory Discovery

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1083) File and Directory Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1083%29%20File%20and%20Directory%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\net1?\.exe/i CommandLine=/\s+(view|share)\s+/i) OR (ImageFileName=/\\netview\.exe/i) OR (/NetShareEnum/))

(T1135) Network Share Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1135) Network Share Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1135%29%20Network%20Share%20Discovery.md

LogScaleNetwork & SecurityDetectionEndpointNetwork

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\net1?\.exe/i CommandLine=/accounts/i) OR (/(Get-ADDefaultDomainPasswordPolicy|GetAccountPasswordPolicy)/i))

(T1201) Password Policy Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1201) Password Policy Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1201%29%20Password%20Policy%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get events of interest for T1217
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/

// Omit events where the browser is the executing process

(T1217) Browser Information Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1217) Browser Information Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1217%29%20Browser%20Information%20Discovery.md

LogScaleNetwork & SecurityDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\nltest\.exe/i CommandLine=/trust/i) OR (ImageFileName=/\\dsquery\.exe/i CommandLine=/trustedDomain/i) OR (/(Get-NetDomainTrust|Get-NetForestTrust|Get-AcceptedDomain)/i))

(T1482) Domain Trust Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1482) Domain Trust Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1482%29%20Domain%20Trust%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory)$/ event_platform=Win ((CommandLine=/(securityCenter2|csagent|csfalconservice)/i) OR (CommandHistory=/(securityCenter2|csagent|csfalconservice)/i) OR (ImageFileName=/netsh\.exe/i))

(T1518.001) Software Discovery - Security Software Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1518) Software Discovery/(T1518.001) Software Discovery - Security Software Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1518%29%20Software%20Discovery/%28T1518.001%29%20Software%20Discovery%20-%20Security%20Software%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ /(DescribeInstances|ListBuckets|HeadBucket|GetPublicAccessBlock|DescribeDBInstances)/i) OR (#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ /(gcloud\s+compute\s+instances\s+list)/i) OR (#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ /(az\s+vm\s+list)/i)

(T1580) Cloud Infrastructure Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1580) Cloud Infrastructure Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1580%29%20Cloud%20Infrastructure%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win /(\\Control\\Nls\\Language|GetUserDefaultUILanguage|GetSystemDefaultUILanguage|GetKeyboardLayoutList|GetUserDefaultLangID)/i

(T1614.001) System Location Discovery - System Language Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1614) System Location Discovery/(T1614.001) System Location Discovery - System Language Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1614%29%20System%20Location%20Discovery/%28T1614.001%29%20System%20Location%20Discovery%20-%20System%20Language%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\gpresult\.exe/i) OR /(Get-DomainGPO|Get-DomainGPOLocalGroup|GPOLocalGroup)/i)

(T1615) Group Policy Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1615) Group Policy Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1615%29%20Group%20Policy%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=ProcessRollup2 event_platform=Win (ImageFileName=/\\driverquery\.exe/i OR (ImageFileName=/\\sc\.exe/i CommandLine=/query/i))) OR (#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win /CurrentControlSet\\(Services|HardwareProfiles)/)

(T1652) Device Driver Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1652) Device Driver Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1652%29%20Device%20Driver%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1059.001] NSLookup Remote Payload - Win
//
// https://attack.mitre.org/techniques/T1059/001/
//

[T1059.001] NSLookup Remote Payload - Win

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1059.001] NSLookup Remote Payload - Win.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1059.001%5D%20NSLookup%20Remote%20Payload%20-%20Win.logscale

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1087.001] Account Discovery - Local Accounts - Lin
//
// https://attack.mitre.org/techniques/T1087/001/
//

[T1087.001] Account Discovery - Local Accounts - Lin

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.001] Account Discovery - Local Accounts - Lin.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.001%5D%20Account%20Discovery%20-%20Local%20Accounts%20-%20Lin.logscale

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1087.001] Account Discovery - Local Accounts - Mac
//
// https://attack.mitre.org/techniques/T1087/001/
//

[T1087.001] Account Discovery - Local Accounts - Mac

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.001] Account Discovery - Local Accounts - Mac.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.001%5D%20Account%20Discovery%20-%20Local%20Accounts%20-%20Mac.logscale

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1087.001] Account Discovery - Local Accounts - Win
//
// https://attack.mitre.org/techniques/T1087/001/
//

[T1087.001] Account Discovery - Local Accounts - Win

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.001] Account Discovery - Local Accounts - Win.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.001%5D%20Account%20Discovery%20-%20Local%20Accounts%20-%20Win.logscale

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1087.002] Account Discovery - Domain Accounts - Lin
//
// https://attack.mitre.org/techniques/T1087/002/
//

[T1087.002] Account Discovery - Domain Accounts - Lin

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.002] Account Discovery - Domain Accounts - Lin.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.002%5D%20Account%20Discovery%20-%20Domain%20Accounts%20-%20Lin.logscale

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1087.002] Account Discovery - Domain Accounts - Mac
//
// https://attack.mitre.org/techniques/T1087/002/
//

[T1087.002] Account Discovery - Domain Accounts - Mac

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.002] Account Discovery - Domain Accounts - Mac.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.002%5D%20Account%20Discovery%20-%20Domain%20Accounts%20-%20Mac.logscale

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1087.002] Account Discovery - Domain Accounts - Win
//
// https://attack.mitre.org/techniques/T1087/002/
//

[T1087.002] Account Discovery - Domain Accounts - Win

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.002] Account Discovery - Domain Accounts - Win.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.002%5D%20Account%20Discovery%20-%20Domain%20Accounts%20-%20Win.logscale

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=UserLogonFailed2 event_platform=Win
| SubStatus_hex := format(field=SubStatus, "0x%x")
| $falcon/helper:enrich(field=SubStatus)
| $falcon/helper:enrich(field=LogonType)

2024-03-01 CQF Live Supporting Queries

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Friday/2024-03-01 CQF Live Supporting Queries.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Cool-Query-Friday/2024-03-01%20CQF%20Live%20Supporting%20Queries.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get all Windows ProcessRollup2 Events
#event_simpleName=ProcessRollup2 event_platform=Win
// Narrow to processes of interest and create FileName variable
| ImageFileName=/\\(?<FileName>(whoami|net1?|systeminfo|ping|nltest|sc|hostname|ipconfig)\.exe)/i

Custom Weighting Command Line and File Name

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Custom Weighting Command Line and File Name.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Custom%20Weighting%20Command%20Line%20and%20File%20Name.md

LogScaleDetection & MonitoringDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo event_platform=Mac

| OSVersionFileData=*
| replace("([0-9A-Fa-f]{2})", with="%$1", field=OSVersionFileData, as=OSVersionFileData)

OsVersionInfo OsVersionFileData Decode

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/OsVersionInfo OsVersionFileData Decode.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/OsVersionInfo%20OsVersionFileData%20Decode.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Mac (ImageFileName=/\/(id|groups)/i OR (ImageFileName=/\/dscl/ AND CommandLine=/list.+users/i))

(T1087.001) Account Discovery - Local Account

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1087) Account Discovery/(T1087.001) Account Discovery - Local Account.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1087%29%20Account%20Discovery/%28T1087.001%29%20Account%20Discovery%20-%20Local%20Account.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=UserLogon LogonType=10

| RemoteAddressIP4 = *
| ipLocation(RemoteAddressIP4)

RDP Login World Map

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/RDP Login World Map.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/RDP%20Login%20World%20Map.md

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=/(OsVersionInfo|ConfigStateUpdate|SensorHeartbeat)/

| event_platform=Lin
| groupBy([cid, aid], function=([selectLast([ConfigStateData, OSVersionString, SensorStateBitMap])]))

Linux Sensors in Kernel Mode, User Mode, and RFM

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Linux Sensors in Kernel Mode, User Mode, and RFM.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Linux%20Sensors%20in%20Kernel%20Mode%2C%20User%20Mode%2C%20and%20RFM.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo event_platform=Lin
| groupby(aid, function=selectLast([OSVersionString]))
| OSVersionString=/Linux\s+\S+\s(?<kernelVersion>\S+)\s.*/
| top("kernelVersion", limit=100)

Linux Kernel Version

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Linux Kernel Version.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Linux%20Kernel%20Version.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 24.7.2026

DownloadOpen
query.txt
// Look for process handles opening Falcon
#event_simpleName=FalconProcessHandleOpDetectInfo FileName="WerFaultSecure.exe"

// Check for command line switching signal

Hunting EDR Freeze

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Hunting EDR Freeze.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Hunting%20EDR%20Freeze.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2

| join({#event_simpleName=FirewallSetRule}, key=ContextProcessId, field=TargetProcessId, include=[FirewallRule, FirewallRuleId])
| ImageFileName=/.*\\(?<fileName>.*\..*)/

Firewall Rule Additions

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Firewall Rule Additions.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Firewall%20Rule%20Additions.md

LogScaleNetwork & SecurityDetectionEndpointFirewall

@sebastian · 24.7.2026

DownloadOpen
query.txt
// Get Windows UserLogonFailed events
event_platform=Win #event_simpleName=UserLogonFailed2

// This line is completely optional, but converts SubStatus to hex

Failed User Logon Thresholding

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Failed User Logon Thresholding.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Failed%20User%20Logon%20Thresholding.md

NG-SIEMDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo event_platform=Win

| groupby(aid, function=selectLast([ProductName]))
| groupBy([ProductName], function=stats([count(aid, as="endpointCount")]))

Evaluate Operating System Prevalence

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Evaluate Operating System Prevalence.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Evaluate%20Operating%20System%20Prevalence.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 UserSid=/^S-1-5-21-/ SignInfoFlags=*
| bitfield:extractFlags(
 field=SignInfoFlags,
  output=[

Decode SignInfoFlags

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Decode SignInfoFlags.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Decode%20SignInfoFlags.md

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=CriticalEnvironmentVariableChanged
| EnvironmentVariableName =/(SSH_CONNECTION|USER)/
| EnvironmentVariableValue=/(?<userName>\S+)\n(?<localIP>\d+\.\d+\.\d+\.\d+)\s+(?<localPort>\d+)\s+(?<remoteIP>\d+\.\d+\.\d+\.\d+)\s+(?<remotePort>\d+)$/i
| table([@timestamp, aid, userName, remoteIP, remotePort, localIP, localPort])

Critical Environment Variable Changed SSH

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Critical Environment Variable Changed SSH.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Critical%20Environment%20Variable%20Changed%20SSH.md

LogScaleNetwork & SecurityDetectionEndpointInvestigation

@sebastian · 24.7.2026

DownloadOpen
query.txt
id := hash([fields_to_count], limit=1000000) // Uses hash collision to increase cardinality the limit here needs to max the limit in the first groupby
| groupBy([id], limit=max, function={ groupBy([fields_to_count], function=[], limit=max)| count() }) // Count the sub groups
| sum("_count") // Sum all the counts

Count Key-Pairs Beyond GroupBy Max Limit

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Count Key-Pairs Beyond GroupBy Max Limit.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Count%20Key-Pairs%20Beyond%20GroupBy%20Max%20Limit.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 24.7.2026

DownloadOpen
query.txt
(#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\chrome\.exe$/i) OR (#event_simpleName=DnsRequest DomainName=/\.ru$/ event_platform=Win)
| falconPID:=TargetProcessId | falconPID:=ContextProcessId
| selfJoinFilter([aid, falconPID], where=[{#event_simpleName=ProcessRollup2}, {#event_simpleName=DnsRequest}], prefilter=true)
| groupBy([aid, falconPID], function=([collect([DomainName, UserName, ImageFileName, CommandLine])]))

Combine ProcessRollup2 and DnsRequest Events

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Combine ProcessRollup2 and DnsRequest Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Combine%20ProcessRollup2%20and%20DnsRequest%20Events.md

LogScaleNetwork & SecurityDetectionEndpointNetwork

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo RFMState=*
| day := formatTime("%Y-%m-%d", field=@timestamp, locale=en_US, timezone=Z)
| groupBy([aid, day], function=(selectLast([RFMState, @timestamp])), limit=max)
| RFMState match {

Cheat bucket Using groupBy

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Cheat bucket Using groupBy.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Cheat%20bucket%20Using%20groupBy.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 24.7.2026

DownloadOpen
query.txt
//[Full post text.](https://community.crowdstrike.com/cool-query-friday-77/2023-09-20-cool-query-friday-live-from-fal-con-up-leveling-teams-with-multipurpose-text-box-driven-queries-420)

//Create search to look for domain activity...

Get specific events and provide option to specify host

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Friday/2023-09-20 - Cool Query Friday - Up-leveling Teams With Text-box Driven Queries.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Cool-Query-Friday/2023-09-20%20-%20Cool%20Query%20Friday%20-%20Up-leveling%20Teams%20With%20Text-box%20Driven%20Queries.md

LogScaleNetwork & SecurityDetectionLinuxMicrosoft 365

@sebastian · 24.7.2026

DownloadOpen
query.txt
// Get successful Falcon console logins
EventType=Event_ExternalApiEvent OperationName=userAuthenticate Success=true

// Get ASN Details for OriginSourceIpAddress

Get successful Falcon console logins

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Friday/2023-06-14 - Cool Query Friday - Watching the Watchers - Profiling Falcon Console Logins via Geohashing.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Cool-Query-Friday/2023-06-14%20-%20Cool%20Query%20Friday%20-%20Watching%20the%20Watchers%20-%20Profiling%20Falcon%20Console%20Logins%20via%20Geohashing.md

LogScaleNetwork & SecurityAuthenticationDetectionLinux

@sebastian · 24.7.2026

DownloadOpen
query.txt
// Get ReflectiveDotnetModuleLoad with non-null ManagedPdbBuildPath field
#event_simpleName=ReflectiveDotnetModuleLoad event_platform=Win ManagedPdbBuildPath!="" 

// Capture FilePath and FileName Fields

Get ReflectiveDotnetModuleLoad with non-null ManagedPdbBuildPath field

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Friday/2023-09-08 - Cool Query Friday - Reflective .Net Module Loads and Program Database (PDB) File Paths.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Cool-Query-Friday/2023-09-08%20-%20Cool%20Query%20Friday%20-%20Reflective%20.Net%20Module%20Loads%20and%20Program%20Database%20%28PDB%29%20File%20Paths.md

LogScaleDetection & MonitoringDetectionWindows

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=AssociateTreeIdWithRoot
| PatternId =~ match(file="falcon/investigate/detect_patterns.csv", column=PatternId, strict=false)
| select([@timestamp, aid, ComputerName, PatternId,name,scenario,scenarioFriendly,description,severity,show_in_ui,killchain_stage,tactic,technique,objective,pattern_updated])

AssociateTreeIdWithRoot to Pattern Details

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/AssociateTreeIdWithRoot to Pattern Details.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/AssociateTreeIdWithRoot%20to%20Pattern%20Details.md

LogScaleInvestigation & TroubleshootingDetectionInvestigationTroubleshooting

@sebastian · 24.7.2026

DownloadOpen
query.txt
ExternalApiType=Event_DetectionSummaryEvent
| format(format="%s > %s", field=[Tactic, Technique], as=MITRE)
| groupBy([AgentIdString], function=([count(DetectId, as=totalDetections), sum(Severity, as=severityWeight), min(@timestamp, as=firstDetect), max(@timestamp, as=lastDetect), collect([MITRE])]))
| formatTime(field=firstDetect, format="%Y-%m-%dT%H:%M:%S", as=firstDetect)

Aggregate Detection Data by Host

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Aggregate Detection Data by Host.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Aggregate%20Detection%20Data%20by%20Host.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=NetworkConnectIP4
| groupBy([RemotePort], function=count(as=count), limit=max) 
| [sum(count, as=total), sort(field=RemotePort, order=ascending, limit=20000)] 
| percent := 100 * (count / total)

Bottom 10% of NetworkConnect Port Values

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Bottom 10% of NetworkConnct Port Values.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Bottom%2010%25%20of%20NetworkConnct%20Port%20Values.md

LogScaleNetwork & SecurityDetectionNetwork

@sebastian · 24.7.2026

DownloadOpen
query.txt
https://www.reddit.com/r/crowdstrike/comments/qid1tj/20211029_cool_query_friday_cpu_ram_disk_firmware/

```
// Get 4 events of interest

Get 4 events of interest

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Friday/2021-10-29 - Cool Query Friday - CPU, RAM, Disk, Firmware, TPM 2.0, and Windows 11.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Cool-Query-Friday/2021-10-29%20-%20Cool%20Query%20Friday%20-%20CPU%2C%20RAM%2C%20Disk%2C%20Firmware%2C%20TPM%202.0%2C%20and%20Windows%2011.md

LogScaleNetwork & SecurityDetectionInvestigationNetwork

@sebastian · 24.7.2026

DownloadOpen
query.txt
// [T1552.001] Microsoft Teams Unsecured Credentials In Files
//
// Reference: https://www.reddit.com/r/crowdstrike/comments/xfqtyb/20220916_cool_query_friday_microsoft_teams/
//

[T1552.001] Microsoft Teams Unsecured Credentials In Files

v1

Detect process command lines referencing Microsoft Teams Cookies or Local Storage leveldb paths that may expose unsecured credentials, mapped to MITRE ATT&CK T1552.001.

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 24.7.2026

DownloadOpen
query.txt
// [CVE-2023-36884] Office and Windows HTML Remote Code Execution Vulnerability
//
// https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884
// https://www.reddit.com/r/crowdstrike/comments/14y1yei/20230712_situational_awareness_microsoft_office/

[CVE-2023-36884] Office and Windows HTML Remote Code Execution Vulnerability

v1

Detect Word documents written to disk with a .url extension related to CVE-2023-36884 Office and Windows HTML remote code execution activity.

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 24.7.2026

DownloadOpen
query.txt
in(field="#windows.EventID", values=[4769,4768])
| TicketEnc := coalesce([windows.EventData.TicketEncryptionType])
| SessionKeyEnc := coalesce([windows.EventData.SessionKeyEncryptionType])
| case {

Legacy Encryption Detection (RC4 + DES)

v1

This query identifies users, service accounts, and systems that are still using RC4-based Kerberos encryption. It analyzes authentication events to detect RC4 usage in both ticket encryption and session keys, enabling the identification of dependencies on outdated cryptographic protocols. The results help to proactively locate affected accounts and systems that may experience issues after the RC4 deactivation, supporting remediation and migration to secure encryption standards such as AES.

LogScaleMicrosoftWindows

@sebastian · 24.7.2026

DownloadOpen