LogScale Queries

Category

Detection & Monitoring

Threat detection and continuous monitoring

103 published queries

Categories

query.txt
in(field="#windows.EventID", values=[4732,4728,4756,4729,4733,4757])
| windows.EventData.SubjectUserName=/^(svc_|sa_|srv_)/i

// only show during office hours, when automation should be idle

Detect Active Directory group changes by service accounts during office hours

v1

Find group membership changes made by service accounts during the period when their automation should be idle. Adapt the account-name regex, office-hour window, and IANA timezone to match your conventions. Source: the blog article “5 LogScale queries to audit Active Directory group changes” — https://it-selig.de/blog/logscale-queries-ad-group-changes

LogScaleDetection & MonitoringActiveDirectoryDetectionMonitoring+1

@sebastian · 2.8.2026

DownloadOpen
query.txt
in(field="#windows.EventID", values=[4732,4728,4756])
| test(windows.EventData.MemberSid == windows.EventData.SubjectUserSid)

// format the table

Detect Active Directory group self-additions

v1

Find Active Directory group additions where the requesting account and the added member share the same SID. These rare self-additions are a high-signal escalation pattern worth investigating. Source: the blog article “5 LogScale queries to audit Active Directory group changes” — https://it-selig.de/blog/logscale-queries-ad-group-changes

LogScaleDetection & MonitoringActiveDirectoryDetectionWindows

@sebastian · 2.8.2026

DownloadOpen
query.txt
in(field="#windows.EventID", values=[4732,4728,4756,4729,4733,4757])
| case {
in(field="#windows.EventID", values=[4732,4728,4756]) | action:= "added";
in(field="#windows.EventID", values=[4733,4729,4757]) | action:= "removed";

Detect after-hours changes to privileged Active Directory groups

v1

Focus on additions and removals in a configurable list of privileged Active Directory groups outside local business hours. Adjust the group names, office-hour window, and IANA timezone for your environment. Source: the blog article “5 LogScale queries to audit Active Directory group changes” — https://it-selig.de/blog/logscale-queries-ad-group-changes

LogScaleDetection & MonitoringActiveDirectoryDetectionMonitoring+1

@sebastian · 2.8.2026

DownloadOpen
query.txt
// Get OsVersionInfo events; sent by sensor every 24-hours or at sensor start or update
#event_simpleName=OsVersionInfo
 
// Narrow search to only include Linux, Container, and K8 systems

CVE-2025-1146 System Scoping (OsVersionInfo with Logon Data)

v2

The query below will look for Linux systems (Linux, K8, Containers) that need to be updated against CVE-2025-1146. The query is based on the event OsVersionInfo which is generated every 24-hours, at sensor start, or at sensor update. It attempts to merge in LogonType 2 and 10 to determine the last logged on user.

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint+2

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get OsVersionInfo events; sent by sensor every 24-hours or at sensor start or update
#event_simpleName=OsVersionInfo
 
// Narrow search to only include Linux, Container, and K8 systems

CVE-2025-1146 System Scoping (OsVersionInfo)

v2

The query below will look for Linux systems (Linux, K8, Containers) that need to be updated against CVE-2025-1146. The query is based on the event OsVersionInfo which is generated every 24-hours, at sensor start, or at sensor update.

LogScaleDetection & MonitoringDetectionEndpointKubernetes+1

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Read in AID Master file; REMINDER: this file updates every 4 hours.
| readFile("aid_master_main.csv")
 
// Narrow search to only include Linux, Container, and K8 systems

CVE-2025-1146 System Scoping (aid master)

v2

The query below will look for Linux systems (Linux, K8, Containers) that need to be updated against CVE-2025-1146. The query is based on the lookup file aid_master_main.csv which is automatically updated every 4 hours.

LogScaleDetection & MonitoringDetectionKubernetesLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
// CVE-2025-53770 - WebShell Discovery from w3wp.exe

correlate(
    cmd: {

CVE-2025-53770 - SharePoint ToolShell

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/CVE-2025-53770 - SharePoint ToolShell.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/CVE-2025-53770%20-%20SharePoint%20ToolShell.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=AgentOnline event_platform=Win  
| groupBy([aid], function=([selectLast([BaseTime])]))
| LastReboot_milli:=(BaseTime/1000*1024)+978307200
| round("LastReboot_milli")

Calculate Last Windows Boot Time

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Calculate Last Windows Boot Time.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Calculate%20Last%20Windows%20Boot%20Time.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=ProcessRollup2 ImageFileName=/\\powershell(_ise)?\.exe/i) OR (#event_simpleName=EndOfProcess event_platform=Win CLICreationCount>0)
| selfJoinFilter([aid, TargetProcessId], where=[{#event_simpleName=ProcessRollup2}, {#event_simpleName=EndOfProcess}], prefilter=true)
| regex(".+\\\(?<FileName>.+$)", field=ImageFileName, strict=false)
| groupBy([aid, TargetProcessId], function=([count(#event_simpleName, distinct=true, as=eventCount), min(ProcessStartTime, as=processStartTime), max(ContextTimeStamp, as=processEndTime), collect([CLICreationCount, FileName])]))

Calculate Process Run Time

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Calculate Process Run Time.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Calculate%20Process%20Run%20Time.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/FileWritten$/ 
| case {
    Size>=1099511627776 | CommonSize:=unit:convert(Size, to=T) | format("%,.2f TB",field=["CommonSize"], as="CommonSize");
    Size>=1073741824 | CommonSize:=unit:convert(Size, to=G) | format("%,.2f GB",field=["CommonSize"], as="CommonSize");

Case to convert Size to appropriate unit of measure

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Case to convert Size to appropriate unit of measure.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Case%20to%20convert%20Size%20to%20appropriate%20unit%20of%20measure.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get UI Audit Events
#repo="detections" ExternalApiType=/Remote/

// Check commands for "get"

Check for Falcon Analysts Running get Command

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Check for Falcon Analysts Running get Command.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check%20for%20Falcon%20Analysts%20Running%20get%20Command.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo
| osData:=concat([OSVersionString, ProductName])
| groupBy([aid], function=([selectFromMax(field="@timestamp", include=[event_platform, RFMState, LinuxSensorBackend, AgentVersion, osData])]))
| RFMState match {

Check for Sensors in RFM

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Check for Sensors in RFM.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check%20for%20Sensors%20in%20RFM.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\(?<fileName>chrome\.exe)$/i
| groupBy([cid, aid, fileName, SHA256HashData])
| match(file="fdr_aidmaster.csv", field=aid, include=ComputerName, ignoreCase=true, strict=false)
| join({#event_simpleName=PeVersionInfo event_platform=Win | ImageFileName=/\\chrome\.exe/i | groupBy([SHA256HashData, FixedFileVersion, CompanyName], function=selectLast([ComputerName, FixedFileVersion]))}, include=[FixedFileVersion, CompanyName], field=[SHA256HashData])

Chrome Version Number Evaluation

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Chrome Version Number Evaluation.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Chrome%20Version%20Number%20Evaluation.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/(winword|excel)\.exe/i) OR (#event_simpleName=ZipFileWritten event_platform=Win)
| falconPID:=ContextProcessId | falconPID:=TargetProcessId
| selfJoinFilter(field=[aid, falconPID], where=[{#event_simpleName=ProcessRollup2}, {#event_simpleName=ZipFileWritten}], prefilter=true)
| case{

Combine ProcessRollup2 and FileWritten Events

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Combine ProcessRollup2 and FileWritten Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Combine%20ProcessRollup2%20and%20FileWritten%20Events.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Insert Discovery commands of interest here
event_platform=Win #event_simpleName=ProcessRollup2 FileName=/(whoami|ping|net1?|systeminfo|quser|ipconfig)/iF

// Restrict to non-system UserSid Values

Count Windows Discovery Commands Per User

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Count Windows Discovery Commands Per User.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Count%20Windows%20Discovery%20Commands%20Per%20User.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=UserLogon //UserName="name@example.com"
| UserName=~wildcard(?{UserName="*"}, ignoreCase=true)
| LogonTime:=LogonTime*1000
| time:dayOfWeekName(LogonTime)

Create Heatmap of Login Activity

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Create Heatmap of Login Activity.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Create%20Heatmap%20of%20Login%20Activity.md

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
//Get PowerShell Events
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\powershell\.exe/i
//Look for PS flags that indicate an encoded command
| CommandLine=/\s+\-(e|encoded|encodedcommand|enc)\s+/i

Decode Base64

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Decode Base64.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Decode%20Base64.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 WindowFlags=*
| bitfield:extractFlags(
field=WindowFlags,
 output=[

Decoding WindowFlags Bitmask

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Decoding WindowFlags Bitmask.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Decoding%20WindowFlags%20Bitmask.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get browser extension event
#event_simpleName=InstalledBrowserExtension BrowserExtensionId!="no-extension-available"
| aid=?aid
| ComputerName=?ComputerName

Enumerate Browser Extensions

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Enumerate Browser Extensions.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Enumerate%20Browser%20Extensions.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get all DriverLoad events and Event_ModuleSummaryInfoEvent events so certificate data can be merged in
(#event_simpleName=DriverLoad event_platform=Win) OR (#repo=detections ExternalApiType=Event_ModuleSummaryInfoEvent )

// Shorten file path from DriverLoad event

Enumerate Windows Driver Loads

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Enumerate Windows Driver Loads.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Enumerate%20Windows%20Driver%20Loads.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo event_platform=Win

| groupby(aid, function=selectLast([AgentVersion, event_platform, @timestamp]))
| AgentVersion=/(?<majorVersion>\d+)\.(?<minorVersion>\d+)\.(?<buildNumber>\d+)\.\d+/

Evaluate Falcon Agent Version

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Evaluate Falcon Agent Version.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Evaluate%20Falcon%20Agent%20Version.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/UserLogon/
| case{
    #event_simpleName=UserLogon | SuccessLogonTime:=ContextTimeStamp;
    #event_simpleName=UserLogonFailed2 | FailedLogonTime:=ContextTimeStamp;

Failed and Successful User Logon Events

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Failed and Successful User Logon Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Failed%20and%20Successful%20User%20Logon%20Events.md

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/FileWritten$/ AND ((event_platform=Win DiskParentDeviceInstanceId="USB*") OR (event_platform=Mac IsOnRemovableDisk=1)) AND TargetFileName!="*.Spotlight-V100*"
| groupBy([ComputerName], function=([collect([TargetFileName]), count(TargetFileName, as=TotalFile), sum(Size, as=SumSize)]))
| TotalFiles > 10 OR SumSize > 5242880
| case {

Files Written to Removable Media

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Files Written to Removable Media.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Files%20Written%20to%20Removable%20Media.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get file names of interest
#event_simpleName=ProcessRollup2 event_platform=Win
| in(field="FileName", values=[whoami.exe, arp.exe, cmd.exe, net.exe, net1.exe, ipconfig.exe, route.exe, netstat.exe, nslookup.exe, nltest.exe, systeminfo.exe, wmic.exe, tasklist.exe, tracert.exe, ping.exe, adfind.exe, nbtstat.exe, find.exe, ldifde.exe, netsh.exe, wbadmin.exe], ignoreCase=true)

Frequency Analysis via Program Clustering

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Frequency Analysis via Program Clustering.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Frequency%20Analysis%20via%20Program%20Clustering.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#sampleType = repository
| timechart(repo,
function={sum(ingestAfterFieldRemovalSize)}, minSpan=1h, limit=20)

Get Repository Ingestion Data for LogScale SaaS

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Get Repository Ingestion Data for LogScale SaaS.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Get%20Repository%20Ingestion%20Data%20for%20LogScale%20SaaS.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#repo=?repo #type=?type #Vendor=?Vendor
| eventSize()
| unit:convert(_eventSize, to="G")
| sum("_eventSize")

Get Repository Ingestion in Raptor

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Get Repository Ingestion in Raptor.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Get%20Repository%20Ingestion%20in%20Raptor.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get Event Required on Windows Platform
#event_simpleName=AgentOnline event_platform=Win
// Convert BastTime in epoch Time Stamp

Get Windows OS Boot Time

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Get Windows OS Boot Time.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Get%20Windows%20OS%20Boot%20Time.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=HttpRequestDetect
| parseHexString("HttpPostBody", as=b64data)
| format("%,.4s", field=b64data, as=b64data)
| MagicNumber := base64Decode(b64data, charset="UTF-8")

HttpRequestDetect

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/HttpRequestDetect.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/HttpRequestDetect.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get bcdedit.exe process executions
#event_simpleName=ProcessRollup2 event_platform=Win FileName="bcdedit.exe"

// Create process lineage tree for easier reading

Hunting bcdedit.exe usage

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Hunting bcdedit.exe usage.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Hunting%20bcdedit.exe%20usage.md

LogScaleDetection & MonitoringDetectionEndpointInvestigation+2

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2

| join({#event_simpleName=IsoExtensionFileWritten OR #event_simpleName=ImgExtensionFileWritten}, key=[aid, ContextProcessId], field=[aid, TargetProcessId], include=[TargetFileName])
| ImageFileName=/(\/|\\)(?<FileName>\w*\.?\w*)$/

ISO IMG Written to Disk w Responsible Process

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/ISO_IMG Written to Disk w_ Responsible Process.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/ISO_IMG%20Written%20to%20Disk%20w_%20Responsible%20Process.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get UserLogon events for Windows RDP sessions
#event_simpleName=UserLogon event_platform=Win LogonType=10 RemoteAddressIP4=*

// Omit results if the RemoteAddressIP4 field is RFC1819

Impossible Time To Travel (UserLogon)

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Impossible Time To Travel (UserLogon).md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Impossible%20Time%20To%20Travel%20%28UserLogon%29.md

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint+2

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get browser extension event
#event_simpleName=InstalledBrowserExtension BrowserExtensionId!="no-extension-available"

// Aggregate by event_platform, BrowserName, ExtensionID and ExtensionName

Installed Browser Extensions

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Installed Browser Extensions.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Installed%20Browser%20Extensions.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
#repo=sensor_metadata #data_source_name=aidmaster
| groupBy([cid, aid], function=([selectFromMax(field="@timestamp", include=[AgentLoadFlags, AgentLocalTime, AgentTimeOffset, AgentVersion, BiosManufacturer, BiosVersion, ChassisType, City, ComputerName, ConfigBuild, ConfigIDBuild, Continent, Country, FalconGroupingTags, FirstSeen, HostHiddenStatus, MachineDomain, OU, PointerSize, ProductType, SensorGroupingTags, ServicePackMajor, SiteName, SystemManufacturer, SystemProductName, @timezone, Timezone, Version, aid, aip, cid, event_platform])]))
| lastSeen:=@timestamp
| formatTime(format="%F %T", as="lastSeen", field=lastSeen)

Leveraging the aidmaster repo

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Leveraging the aidmaster repo.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Leveraging%20the%20aidmaster%20repo.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
#repo=detections ExternalApiType=Event_IdpDetectionSummaryEvent
| rename([[TargetEndpointHostName, TargetEndpoint], [SourceEndpointHostName, SourceEndpoint], [TargetAccountName, TargetAccount], [SourceAccountName, SourceAccount]])
| format("[FalconHostLink](%s)", field=[FalconHostLink], as="FalconHostLink")
| format(format="%s > %s", field=[Tactic, Technique], as=MITRE)

List All ITP Detections

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/List All ITP Detections.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/List%20All%20ITP%20Detections.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Create a live table of the executables in System32/SysWOW64
| defineTable(query={
    #event_simpleName=ProcessRollup2 event_platform=Win FilePath=/\\Windows\\(System32|SysWOW64)\\/ FileName=/\.exe$/
    | FilePath=/(\\Device\\HarddiskVolume\d+)?(?<ExpectedFilePath>\\.+)/

Look for files running outside Windows systems folders with name masquerading

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Look for files running outside Windows systems folders with name masquerading.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Look%20for%20files%20running%20outside%20Windows%20systems%20folders%20with%20name%20masquerading.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get alert events
#repo=detections (ExternalApiType=/Event_(Epp|Idp|Mobile)DetectionSummaryEvent/) OR (ExternalApiType=Event_UserActivityAuditEvent OperationName=detection_update)
| case{
    ExternalApiType=Event_UserActivityAuditEvent Attributes.update_status="closed" | ResolveTime:=@timestamp;

Mean Time to React, Respond, and Resolve

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Mean Time to React, Respond, and Resolve.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Mean%20Time%20to%20React%2C%20Respond%2C%20and%20Resolve.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
aid=1e0afc34e9634710bfcd2f46d8564ab1 (#event_simpleName=ProcessRollup2 FileName="powershell.exe")
| select([aid, ComputerName, CommandLine])
| join(key=aid, field=aid, query={#repo=sensor_metadata}, include=([AgentVersion, BiosManufacturer, FalconGroupingTags]))

Merge Legacy AID Master Info

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Merge Legacy AID Master Info.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Merge%20Legacy%20AID%20Master%20Info.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2
| aid=?{aid=*}
| ImageFileName =~ wildcard(?{ImageFileName="*"}, ignoreCase=true, includeEverythingOnAsterisk=true)
| ImageFileName=/(\/|\\)(?<FileName>\w*\.?\w*)$/

Merge Parent Child PR2 with Join

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Merge Parent_Child PR2 with Join.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Merge%20Parent_Child%20PR2%20with%20Join.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get all Windows ProcessRollup2 events with .dll or .exe listed in the call stack
event_platform=Win #event_simpleName=ProcessRollup2 CallStackModuleNames=/\.(dll|exe)/

// Create filters to narrow searches

Parse Windows Call Stack

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Parse Windows Call Stack.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Parse%20Windows%20Call%20Stack.md

LogScaleDetection & MonitoringDetectionEndpointLinux+1

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get SensorHeartbeat events for Windows, macOS, and Linux
#event_simpleName=SensorHeartbeat event_platform=/(^(Win|Mac|Lin)$)/
// Get most recent event for each aid value and include event_platform
| groupBy([event_platform, aid], function=([selectFromMax(field="@timestamp", include=[SensorStateBitMap])]))

Percentage of Sensors in RFM

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Percentage of Sensors in RFM.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Percentage%20of%20Sensors%20in%20RFM.md

LogScaleDetection & MonitoringDetectionEndpointInvestigation+2

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo event_platform=/^(Win|Mac|Lin)$/

| groupBy(field=#cid, function=[count(aid, distinct=true, as=totalcount), {event_platform=Lin | count(aid, distinct=true, as=Linux)},{ event_platform=Mac | count(aid, distinct=true, as=Mac)}, { event_platform=Win | count(aid, distinct=true, as=Windows)}])
| linuxPercentage := (Linux/totalcount)*100 | format(format="%,.3f%%", field=[linuxPercentage], as=linuxPercentage)

Percentage of Windows Mac Linux Endpoints

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Percentage of Windows_Mac_Linux Endpoints.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Percentage%20of%20Windows_Mac_Linux%20Endpoints.md

LogScaleDetection & MonitoringDetectionEndpointLinux+1

@sebastian · 25.7.2026

DownloadOpen
query.txt
| bitfield:extractFlags(
 field=ProcessCreateFlags,
  output=[
    [0,DEBUG_PROCESS],

Process ProcessCreateFlags

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Process ProcessCreateFlags.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Process%20ProcessCreateFlags.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get ProcessRollup2 events for Windows with Mark of the Web field set
#event_simpleName=ProcessRollup2 event_platform=Win ZoneIdentifier=*
// Parse ConfigBuild for Falcon link syntehsis

ProcessRollup2 Files With Mark of the Web

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/ProcessRollup2 Files With Mark of the Web.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/ProcessRollup2%20Files%20With%20Mark%20of%20the%20Web.md

LogScaleDetection & MonitoringDetectionEndpointLinux+1

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo  RFMState=*

| day := formatTime("%Y-%m-%d", field=@timestamp, locale=en_US, timezone=Z)
| groupBy([aid, day], function=(selectLast([RFMState, @timestamp])), limit=max)

RFM State by Day

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/RFM State by Day.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/RFM%20State%20by%20Day.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/.*\\powershell\.exe/

| CommandLine=/.*\s+\-(e|encoded|encodedcommand|enc)\s+.*/
| length("CommandLine", as="cmdLength")

Rare and Common Encrypted Command Lines

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Rare and Common Encrypted Command Lines.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Rare%20and%20Common%20Encrypted%20Command%20Lines.md

LogScaleDetection & MonitoringDetectionEndpointLinux+1

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ScriptControlScanInfo event_platform=Win

| ScriptContent=/FromBase64String/i
| entropy := shannonEntropy("ScriptContent")

Script Content Entropy

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Script Content Entropy.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Script%20Content%20Entropy.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo
| field_temp:= ?{ComputerName="*"}
| case {
	field_temp != /^\*$/ | regex(field=field_temp,regex = "(?<field_matched>.*?)(,|$)", repeat="true") | test(ComputerName==field_matched) | drop([field_matched,field_temp]) ;

Searching Comma Delineated List With User Input

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Searching Comma Delineated List With User Input.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Searching%20Comma%20Delineated%20List%20With%20User%20Input.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
defineTable(
    query={
        #repo="sensor_metadata" #data_source_name="policyinfo" #data_source_group="sensor-update"
        | groupBy(id, function=selectFromMax(field="@timestamp", include=[release_id]))

Show Sensor Update Policies

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Show Sensor Update Policies.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Show%20Sensor%20Update%20Policies.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get events of interest
#repo=detections 
| in(field="ExternalApiType", values=[Event_UserActivityAuditEvent, Event_EppDetectionSummaryEvent])

Survival of the Fastest

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Survival of the Fastest.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Survival%20of%20the%20Fastest.md

LogScaleDetection & MonitoringDetectionLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2

| ImageFileName=/(\\|\/)(?<fileName>whoami+(\.exe)?$)/i
| concat([UID, UserSid], as="userIdentifier")

Two whoami Commands Run

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Two whoami Commands Run.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Two%20whoami%20Commands%20Run.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=ProcessRollup2 ImageFileName=/\\psexec64\.exe/i ParentBaseFileName=/powershell\.exe/i)

| rename(field="ImageFileName", as="ChildImageFileName")
| rename(field="CommandLine", as="ChildCommandLine")

Use Join on Two Scoped Events

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Use Join on Two Scoped Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Use%20Join%20on%20Two%20Scoped%20Events.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
| createEvents(["color=blue", "shape=round", "size=large"])
| kvParse()
| transpose(limit=1000)
| column := upper(column)

Use Transpose to Convert Field Names to Upper Case

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Use Transpose to Convert Field Names to Upper Case.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Use%20Transpose%20to%20Convert%20Field%20Names%20to%20Upper%20Case.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=UserLogon UserSid=S-1-5-21-*
| in(LogonType, values=["2","10"])
| ipLocation(aip)
| $falcon/helper:enrich(field=UserIsAdmin)

UserLogon

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/UserLogon.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/UserLogon.md

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 ImageFileName=/(\\|\/)whoami/i
| groupBy([aid], function=(count(aid, as=executionCount)))
| myThreshold:=?myThreshold
| myThreshold:=if(condition=(myThreshold == "*"), then="0", else=myThreshold)

Using Editable Threshold Values

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Using Editable Threshold Values.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Using%20Editable%20Threshold%20Values.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
correlate(
    // Search for grandparent process
    grandparent: {
         #event_simpleName=ProcessRollup2 event_platform=Win FileName!="explorer.exe" CommandLine=*

Using correlate() to hunt process lineage

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Using correlate() to hunt process lineage.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Using%20correlate%28%29%20to%20hunt%20process%20lineage.md

LogScaleDetection & MonitoringDetectionEndpointInvestigation+2

@sebastian · 25.7.2026

DownloadOpen
query.txt
event_type=ZeroTrustHostAssessment
| groupBy([aid], function=([selectFromMax(field="@timestamp", include=[scores.os, scores.sensor, scores.overall])]))
| join(query={#data_source_name=aidmaster }, field=[aid], include=[ComputerName, event_platform])

Zero Trust Host Assessment Scores

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Zero Trust Host Assessment Scores.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Zero%20Trust%20Host%20Assessment%20Scores.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win /(mainWindowTitle|Get-Process|GetForegroundWindow|mainWindowTitle)/i

(T1010) Application Window Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1010) Application Window Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1010%29%20Application%20Window%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\reg\.exe/
| ImageFileName=/^//.+//(?<FileName>reg\.exe)/
| FileName:=lower("FileName") 
| ParentBaseFileName:=lower("ParentBaseFileName")

(T1012) Query Registry

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1012) Query Registry.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1012%29%20Query%20Registry.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ((ImageFileName=/\\(ping|tracert)\.exe/i) OR (ImageFileName=/\\net1?\.exe/i CommandLine=/view/i) OR (ImageFileName=/\\nltest\.exe/i CommandLine=/\/dclist/i) OR (/\\etc\\hosts\\/i))

(T1018) Remote System Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1018) Remote System Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1018%29%20Remote%20System%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 ((ImageFileName=/(\\|\/)(w|who|whoami)(\.exe)?$/i) OR (event_platform=Mac ImageFileName=/\/dscl/i CommandLine=/users/i))

(T1033) System Owner User Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1033) System Owner_User Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1033%29%20System%20Owner_User%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\tasklist\.exe/) OR (/(Get-Process|CreateToolhelp32Snapshot)/i))

(T1057) Process Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1057) Process Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1057%29%20Process%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\net1?\.exe/i CommandLine=/localgroup/i) OR (/get-localgroup/i))

(T1069.001) Permission Groups Discovery - Local Groups

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1069) Permission Groups Discovery/(T1069.001) Permission Groups Discovery - Local Groups.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1069%29%20Permission%20Groups%20Discovery/%28T1069.001%29%20Permission%20Groups%20Discovery%20-%20Local%20Groups.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\net1?\.exe/i CommandLine=/group.+\/domain/i

(T1069.002) Permission Groups Discovery - Domain Groups

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1069) Permission Groups Discovery/(T1069.002) Permission Groups Discovery - Domain Groups.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1069%29%20Permission%20Groups%20Discovery/%28T1069.002%29%20Permission%20Groups%20Discovery%20-%20Domain%20Groups.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ /(Get\-MsolRole|get\-member\-groups|ListRolePolicies|ListAttachedRolePolicies|GetBucketAcl)/i

(T1069.003) Permission Groups Discovery - Cloud Groups

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1069) Permission Groups Discovery/(T1069.003) Permission Groups Discovery - Cloud Groups.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1069%29%20Permission%20Groups%20Discovery/%28T1069.003%29%20Permission%20Groups%20Discovery%20-%20Cloud%20Groups.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ((ImageFileName=/\\(fsutil|fsinfo|drives|systeminfo|vssadmin|hostname)\.exe/i) OR (ImageFileName=/\\net1?\.exe/i CommandLine=/config/i))

(T1082) System Information Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1082) System Information Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1082%29%20System%20Information%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win /Get-GlobalAddressList/

(T1087.003) Account Discovery - Email Account

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1087) Account Discovery/(T1087.003) Account Discovery - Email Account.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1087%29%20Account%20Discovery/%28T1087.003%29%20Account%20Discovery%20-%20Email%20Account.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=ProcessRollup2 CommandLine=/az\s+ad\s+user\s+list/i) OR (#event_simpleName=ProcessRollup2 CommandLine=/aws\s+iam\s+list\-(roles|users)/i) OR (#event_simpleName=ProcessRollup2 CommandLine=/gcloud\s+ (iam\s+service\-accounts\s+list|projects\s+get\-iam\-policy)/i)

(T1087.004) Account Discovery - Cloud Account

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1087) Account Discovery/(T1087.004) Account Discovery - Cloud Account.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1087%29%20Account%20Discovery/%28T1087.004%29%20Account%20Discovery%20-%20Cloud%20Account.md

LogScaleDetection & MonitoringAWSDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\net1?\.exe/i CommandLine=/(user|group).+\/domain/i) OR (#event_simpleName=/^(CommandHistory|ScriptControl)/ event_platform=Win /Get-ADUser|Get-ADGroupMember/i)

(T1087.002) Account Discovery - Domain Account

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1087) Account Discovery/(T1087.002) Account Discovery - Domain Account.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1087%29%20Account%20Discovery/%28T1087.002%29%20Account%20Discovery%20-%20Domain%20Account.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\fsutil\.exe/i CommandLine=/fsinfo/i

(T1120) Peripheral Device Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1120) Peripheral Device Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1120%29%20Peripheral%20Device%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ /(dir|tree|ls|find|locate|show)\s+/i

(T1083) File and Directory Discovery

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1083) File and Directory Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1083%29%20File%20and%20Directory%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\net1?\.exe/i CommandLine=/accounts/i) OR (/(Get-ADDefaultDomainPasswordPolicy|GetAccountPasswordPolicy)/i))

(T1201) Password Policy Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1201) Password Policy Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1201%29%20Password%20Policy%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\nltest\.exe/i CommandLine=/trust/i) OR (ImageFileName=/\\dsquery\.exe/i CommandLine=/trustedDomain/i) OR (/(Get-NetDomainTrust|Get-NetForestTrust|Get-AcceptedDomain)/i))

(T1482) Domain Trust Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1482) Domain Trust Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1482%29%20Domain%20Trust%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory)$/ event_platform=Win ((CommandLine=/(securityCenter2|csagent|csfalconservice)/i) OR (CommandHistory=/(securityCenter2|csagent|csfalconservice)/i) OR (ImageFileName=/netsh\.exe/i))

(T1518.001) Software Discovery - Security Software Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1518) Software Discovery/(T1518.001) Software Discovery - Security Software Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1518%29%20Software%20Discovery/%28T1518.001%29%20Software%20Discovery%20-%20Security%20Software%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ /(DescribeInstances|ListBuckets|HeadBucket|GetPublicAccessBlock|DescribeDBInstances)/i) OR (#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ /(gcloud\s+compute\s+instances\s+list)/i) OR (#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ /(az\s+vm\s+list)/i)

(T1580) Cloud Infrastructure Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1580) Cloud Infrastructure Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1580%29%20Cloud%20Infrastructure%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win /(\\Control\\Nls\\Language|GetUserDefaultUILanguage|GetSystemDefaultUILanguage|GetKeyboardLayoutList|GetUserDefaultLangID)/i

(T1614.001) System Location Discovery - System Language Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1614) System Location Discovery/(T1614.001) System Location Discovery - System Language Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1614%29%20System%20Location%20Discovery/%28T1614.001%29%20System%20Location%20Discovery%20-%20System%20Language%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\gpresult\.exe/i) OR /(Get-DomainGPO|Get-DomainGPOLocalGroup|GPOLocalGroup)/i)

(T1615) Group Policy Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1615) Group Policy Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1615%29%20Group%20Policy%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=ProcessRollup2 event_platform=Win (ImageFileName=/\\driverquery\.exe/i OR (ImageFileName=/\\sc\.exe/i CommandLine=/query/i))) OR (#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win /CurrentControlSet\\(Services|HardwareProfiles)/)

(T1652) Device Driver Discovery

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1652) Device Driver Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1652%29%20Device%20Driver%20Discovery.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1059.001] NSLookup Remote Payload - Win
//
// https://attack.mitre.org/techniques/T1059/001/
//

[T1059.001] NSLookup Remote Payload - Win

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1059.001] NSLookup Remote Payload - Win.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1059.001%5D%20NSLookup%20Remote%20Payload%20-%20Win.logscale

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1087.001] Account Discovery - Local Accounts - Lin
//
// https://attack.mitre.org/techniques/T1087/001/
//

[T1087.001] Account Discovery - Local Accounts - Lin

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.001] Account Discovery - Local Accounts - Lin.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.001%5D%20Account%20Discovery%20-%20Local%20Accounts%20-%20Lin.logscale

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1087.001] Account Discovery - Local Accounts - Mac
//
// https://attack.mitre.org/techniques/T1087/001/
//

[T1087.001] Account Discovery - Local Accounts - Mac

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.001] Account Discovery - Local Accounts - Mac.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.001%5D%20Account%20Discovery%20-%20Local%20Accounts%20-%20Mac.logscale

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1087.001] Account Discovery - Local Accounts - Win
//
// https://attack.mitre.org/techniques/T1087/001/
//

[T1087.001] Account Discovery - Local Accounts - Win

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.001] Account Discovery - Local Accounts - Win.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.001%5D%20Account%20Discovery%20-%20Local%20Accounts%20-%20Win.logscale

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1087.002] Account Discovery - Domain Accounts - Lin
//
// https://attack.mitre.org/techniques/T1087/002/
//

[T1087.002] Account Discovery - Domain Accounts - Lin

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.002] Account Discovery - Domain Accounts - Lin.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.002%5D%20Account%20Discovery%20-%20Domain%20Accounts%20-%20Lin.logscale

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1087.002] Account Discovery - Domain Accounts - Mac
//
// https://attack.mitre.org/techniques/T1087/002/
//

[T1087.002] Account Discovery - Domain Accounts - Mac

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.002] Account Discovery - Domain Accounts - Mac.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.002%5D%20Account%20Discovery%20-%20Domain%20Accounts%20-%20Mac.logscale

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// [T1087.002] Account Discovery - Domain Accounts - Win
//
// https://attack.mitre.org/techniques/T1087/002/
//

[T1087.002] Account Discovery - Domain Accounts - Win

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.002] Account Discovery - Domain Accounts - Win.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.002%5D%20Account%20Discovery%20-%20Domain%20Accounts%20-%20Win.logscale

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=UserLogonFailed2 event_platform=Win
| SubStatus_hex := format(field=SubStatus, "0x%x")
| $falcon/helper:enrich(field=SubStatus)
| $falcon/helper:enrich(field=LogonType)

2024-03-01 CQF Live Supporting Queries

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Friday/2024-03-01 CQF Live Supporting Queries.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Cool-Query-Friday/2024-03-01%20CQF%20Live%20Supporting%20Queries.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get all Windows ProcessRollup2 Events
#event_simpleName=ProcessRollup2 event_platform=Win
// Narrow to processes of interest and create FileName variable
| ImageFileName=/\\(?<FileName>(whoami|net1?|systeminfo|ping|nltest|sc|hostname|ipconfig)\.exe)/i

Custom Weighting Command Line and File Name

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Custom Weighting Command Line and File Name.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Custom%20Weighting%20Command%20Line%20and%20File%20Name.md

LogScaleDetection & MonitoringDetectionEndpointInvestigation+2

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo event_platform=Mac

| OSVersionFileData=*
| replace("([0-9A-Fa-f]{2})", with="%$1", field=OSVersionFileData, as=OSVersionFileData)

OsVersionInfo OsVersionFileData Decode

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/OsVersionInfo OsVersionFileData Decode.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/OsVersionInfo%20OsVersionFileData%20Decode.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Mac (ImageFileName=/\/(id|groups)/i OR (ImageFileName=/\/dscl/ AND CommandLine=/list.+users/i))

(T1087.001) Account Discovery - Local Account

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1087) Account Discovery/(T1087.001) Account Discovery - Local Account.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1087%29%20Account%20Discovery/%28T1087.001%29%20Account%20Discovery%20-%20Local%20Account.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=UserLogon LogonType=10

| RemoteAddressIP4 = *
| ipLocation(RemoteAddressIP4)

RDP Login World Map

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/RDP Login World Map.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/RDP%20Login%20World%20Map.md

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo event_platform=Lin
| groupby(aid, function=selectLast([OSVersionString]))
| OSVersionString=/Linux\s+\S+\s(?<kernelVersion>\S+)\s.*/
| top("kernelVersion", limit=100)

Linux Kernel Version

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Linux Kernel Version.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Linux%20Kernel%20Version.md

LogScaleDetection & MonitoringDetectionEndpointLinux

@sebastian · 24.7.2026

DownloadOpen
query.txt
// Get Windows UserLogonFailed events
event_platform=Win #event_simpleName=UserLogonFailed2

// This line is completely optional, but converts SubStatus to hex

Failed User Logon Thresholding

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Failed User Logon Thresholding.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Failed%20User%20Logon%20Thresholding.md

NG-SIEMDetection & MonitoringAuthenticationDetectionEndpoint+2

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo event_platform=Win

| groupby(aid, function=selectLast([ProductName]))
| groupBy([ProductName], function=stats([count(aid, as="endpointCount")]))

Evaluate Operating System Prevalence

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Evaluate Operating System Prevalence.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Evaluate%20Operating%20System%20Prevalence.md

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 UserSid=/^S-1-5-21-/ SignInfoFlags=*
| bitfield:extractFlags(
 field=SignInfoFlags,
  output=[

Decode SignInfoFlags

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Decode SignInfoFlags.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Decode%20SignInfoFlags.md

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 24.7.2026

DownloadOpen
query.txt
id := hash([fields_to_count], limit=1000000) // Uses hash collision to increase cardinality the limit here needs to max the limit in the first groupby
| groupBy([id], limit=max, function={ groupBy([fields_to_count], function=[], limit=max)| count() }) // Count the sub groups
| sum("_count") // Sum all the counts

Count Key-Pairs Beyond GroupBy Max Limit

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Count Key-Pairs Beyond GroupBy Max Limit.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Count%20Key-Pairs%20Beyond%20GroupBy%20Max%20Limit.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=OsVersionInfo RFMState=*
| day := formatTime("%Y-%m-%d", field=@timestamp, locale=en_US, timezone=Z)
| groupBy([aid, day], function=(selectLast([RFMState, @timestamp])), limit=max)
| RFMState match {

Cheat bucket Using groupBy

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Cheat bucket Using groupBy.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Cheat%20bucket%20Using%20groupBy.md

LogScaleDetection & MonitoringDetectionEndpoint

@sebastian · 24.7.2026

DownloadOpen
query.txt
// Get ReflectiveDotnetModuleLoad with non-null ManagedPdbBuildPath field
#event_simpleName=ReflectiveDotnetModuleLoad event_platform=Win ManagedPdbBuildPath!="" 

// Capture FilePath and FileName Fields

Get ReflectiveDotnetModuleLoad with non-null ManagedPdbBuildPath field

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Friday/2023-09-08 - Cool Query Friday - Reflective .Net Module Loads and Program Database (PDB) File Paths.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Cool-Query-Friday/2023-09-08%20-%20Cool%20Query%20Friday%20-%20Reflective%20.Net%20Module%20Loads%20and%20Program%20Database%20%28PDB%29%20File%20Paths.md

LogScaleDetection & MonitoringDetectionWindows

@sebastian · 24.7.2026

DownloadOpen
query.txt
ExternalApiType=Event_DetectionSummaryEvent
| format(format="%s > %s", field=[Tactic, Technique], as=MITRE)
| groupBy([AgentIdString], function=([count(DetectId, as=totalDetections), sum(Severity, as=severityWeight), min(@timestamp, as=firstDetect), max(@timestamp, as=lastDetect), collect([MITRE])]))
| formatTime(field=firstDetect, format="%Y-%m-%dT%H:%M:%S", as=firstDetect)

Aggregate Detection Data by Host

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Aggregate Detection Data by Host.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Aggregate%20Detection%20Data%20by%20Host.md

LogScaleDetection & MonitoringDetectionInvestigation

@sebastian · 24.7.2026

DownloadOpen
query.txt
// [T1552.001] Microsoft Teams Unsecured Credentials In Files
//
// Reference: https://www.reddit.com/r/crowdstrike/comments/xfqtyb/20220916_cool_query_friday_microsoft_teams/
//

[T1552.001] Microsoft Teams Unsecured Credentials In Files

v1

Detect process command lines referencing Microsoft Teams Cookies or Local Storage leveldb paths that may expose unsecured credentials, mapped to MITRE ATT&CK T1552.001.

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 24.7.2026

DownloadOpen
query.txt
// [CVE-2023-36884] Office and Windows HTML Remote Code Execution Vulnerability
//
// https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884
// https://www.reddit.com/r/crowdstrike/comments/14y1yei/20230712_situational_awareness_microsoft_office/

[CVE-2023-36884] Office and Windows HTML Remote Code Execution Vulnerability

v1

Detect Word documents written to disk with a .url extension related to CVE-2023-36884 Office and Windows HTML remote code execution activity.

LogScaleDetection & MonitoringDetectionEndpointWindows

@sebastian · 24.7.2026

DownloadOpen