Contributor
@sebastian
159 published items
149 items
#windows.Channel = * | groupBy([@collect.host, #windows.Channel])
An overview of Windows systems grouped by Event Log channel. Used in the how-to: [[howto:Install LogScale Collector on Windows]]
@sebastian · 3.8.2026
in(field="#windows.EventID", values=[4732,4728,4756,4729,4733,4757]) | day := formatTime(format="%Y-%m-%d", field=@timestamp, timezone="Europe/Berlin") | rename(field="windows.EventData.TargetUserName", as="group") | groupBy([day, group], function=count())
Aggregate Active Directory group membership additions and removals into a daily count by group for compliance reporting and anomaly baselining. Keep the timezone aligned with your investigation queries. Source: the blog article “5 LogScale queries to audit Active Directory group changes” — https://it-selig.de/blog/logscale-queries-ad-group-changes
@sebastian · 2.8.2026
in(field="#windows.EventID", values=[4732,4728,4756,4729,4733,4757]) | windows.EventData.SubjectUserName=/^(svc_|sa_|srv_)/i // only show during office hours, when automation should be idle
Find group membership changes made by service accounts during the period when their automation should be idle. Adapt the account-name regex, office-hour window, and IANA timezone to match your conventions. Source: the blog article “5 LogScale queries to audit Active Directory group changes” — https://it-selig.de/blog/logscale-queries-ad-group-changes
@sebastian · 2.8.2026
in(field="#windows.EventID", values=[4732,4728,4756]) | test(windows.EventData.MemberSid == windows.EventData.SubjectUserSid) // format the table
Find Active Directory group additions where the requesting account and the added member share the same SID. These rare self-additions are a high-signal escalation pattern worth investigating. Source: the blog article “5 LogScale queries to audit Active Directory group changes” — https://it-selig.de/blog/logscale-queries-ad-group-changes
@sebastian · 2.8.2026
in(field="#windows.EventID", values=[4732,4728,4756,4729,4733,4757])
| case {
in(field="#windows.EventID", values=[4732,4728,4756]) | action:= "added";
in(field="#windows.EventID", values=[4733,4729,4757]) | action:= "removed";Focus on additions and removals in a configurable list of privileged Active Directory groups outside local business hours. Adjust the group names, office-hour window, and IANA timezone for your environment. Source: the blog article “5 LogScale queries to audit Active Directory group changes” — https://it-selig.de/blog/logscale-queries-ad-group-changes
@sebastian · 2.8.2026
in(field="#windows.EventID", values=[4732,4728,4756,4729,4733,4757])
| case {
in(field="#windows.EventID", values=[4732,4728,4756]) | action:= "added";
in(field="#windows.EventID", values=[4733,4729,4757]) | action:= "removed";Show every addition to and removal from Active Directory global, local, and universal groups. Use it to investigate a time window or confirm that Windows Security group-membership events are reaching LogScale. Source: the blog article “5 LogScale queries to audit Active Directory group changes” — https://it-selig.de/blog/logscale-queries-ad-group-changes
@sebastian · 2.8.2026
#event_simpleName=UserLogon | UserName!=/^DWM-/i | UserName!=/^UMFD-/i | UserName!=/^Lokaler Dienst/i
This query shows endpoint login events collected from corporate Windows laptops throughout the day. The log data includes device identifiers, hardware information, usernames, and login timestamps, providing visibility into user authentication activity across the managed workstation fleet. You can also exclude additional usernames. This query is based on the Falcon Data Replicator repository.
@sebastian · 2.8.2026
// Get ReflectiveDotnetModuleLoad with non-null ManagedPdbBuildPath field. #event_simpleName=ReflectiveDotnetModuleLoad event_platform=Win ManagedPdbBuildPath!="" // Capture FilePath and FileName Fields
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Hunt PBD File Paths in Reflective .net Module Loads.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Hunt%20PBD%20File%20Paths%20in%20Reflective%20.net%20Module%20Loads.md
@sebastian · 25.7.2026
// Get OsVersionInfo events; sent by sensor every 24-hours or at sensor start or update #event_simpleName=OsVersionInfo // Narrow search to only include Linux, Container, and K8 systems
The query below will look for Linux systems (Linux, K8, Containers) that need to be updated against CVE-2025-1146. The query is based on the event OsVersionInfo which is generated every 24-hours, at sensor start, or at sensor update. It attempts to merge in LogonType 2 and 10 to determine the last logged on user.
@sebastian · 25.7.2026
// Get OsVersionInfo events; sent by sensor every 24-hours or at sensor start or update #event_simpleName=OsVersionInfo // Narrow search to only include Linux, Container, and K8 systems
The query below will look for Linux systems (Linux, K8, Containers) that need to be updated against CVE-2025-1146. The query is based on the event OsVersionInfo which is generated every 24-hours, at sensor start, or at sensor update.
@sebastian · 25.7.2026
// Read in AID Master file; REMINDER: this file updates every 4 hours.
| readFile("aid_master_main.csv")
// Narrow search to only include Linux, Container, and K8 systemsThe query below will look for Linux systems (Linux, K8, Containers) that need to be updated against CVE-2025-1146. The query is based on the lookup file aid_master_main.csv which is automatically updated every 4 hours.
@sebastian · 25.7.2026
// Restrict search to OsVersionInfo Windows events #event_simpleName=OsVersionInfo event_platform=Win // Aggregate to get latest build for each Agent ID value
The following query looks for Falcon Sensor for Windows versions that need to be hotfixed or updated to address CVE-2025-42701 and CVE-2025-42706. The datasource for this query is the Windows event OsVersionInfo. That event is generated on sensor start, atsystem reboot, and/or every 24-hours.
@sebastian · 25.7.2026
// Restrict search to Windows systems in AID Master | readFile([aid_master_main.csv]) | event_platform=Win
The following query looks for Falcon Sensor for Windows versions that need to be hotfixed or updated to address CVE-2025-42701 and CVE-2025-42706. The datasource for this query is the AID Master lookup file. That file is automatically updated every few hours.
@sebastian · 25.7.2026
// CVE-2025-53770 - WebShell Discovery from w3wp.exe
correlate(
cmd: {Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/CVE-2025-53770 - SharePoint ToolShell.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/CVE-2025-53770%20-%20SharePoint%20ToolShell.md
@sebastian · 25.7.2026
#event_simpleName=AgentOnline event_platform=Win
| groupBy([aid], function=([selectLast([BaseTime])]))
| LastReboot_milli:=(BaseTime/1000*1024)+978307200
| round("LastReboot_milli")Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Calculate Last Windows Boot Time.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Calculate%20Last%20Windows%20Boot%20Time.md
@sebastian · 25.7.2026
(#event_simpleName=ProcessRollup2 ImageFileName=/\\powershell(_ise)?\.exe/i) OR (#event_simpleName=EndOfProcess event_platform=Win CLICreationCount>0)
| selfJoinFilter([aid, TargetProcessId], where=[{#event_simpleName=ProcessRollup2}, {#event_simpleName=EndOfProcess}], prefilter=true)
| regex(".+\\\(?<FileName>.+$)", field=ImageFileName, strict=false)
| groupBy([aid, TargetProcessId], function=([count(#event_simpleName, distinct=true, as=eventCount), min(ProcessStartTime, as=processStartTime), max(ContextTimeStamp, as=processEndTime), collect([CLICreationCount, FileName])]))Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Calculate Process Run Time.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Calculate%20Process%20Run%20Time.md
@sebastian · 25.7.2026
#event_simpleName=/FileWritten$/
| case {
Size>=1099511627776 | CommonSize:=unit:convert(Size, to=T) | format("%,.2f TB",field=["CommonSize"], as="CommonSize");
Size>=1073741824 | CommonSize:=unit:convert(Size, to=G) | format("%,.2f GB",field=["CommonSize"], as="CommonSize");Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Case to convert Size to appropriate unit of measure.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Case%20to%20convert%20Size%20to%20appropriate%20unit%20of%20measure.md
@sebastian · 25.7.2026
// Get uninstall and heartbeat events #event_simpleName=AcUninstallConfirmation OR #event_simpleName=SensorHeartbeat // Narrow dataset by Agent ID; check both events happen on a single system
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Check for Falcon AcUninstallConfirmation Event Followed by no Heartbeat Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check%20for%20Falcon%20AcUninstallConfirmation%20Event%20Followed%20by%20no%20Heartbeat%20Events.md
@sebastian · 25.7.2026
// Get UI Audit Events #repo="detections" ExternalApiType=/Remote/ // Check commands for "get"
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Check for Falcon Analysts Running get Command.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check%20for%20Falcon%20Analysts%20Running%20get%20Command.md
@sebastian · 25.7.2026
#event_simpleName=SensorHeartbeat | groupBy([aid], function=selectLast([@timestamp, ComputerName, SensorStateBitMap]), limit=max) | bitfield:extractFlags( field=SensorStateBitMap,
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Check for RTR Being Disabled.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check%20for%20RTR%20Being%20Disabled.md
@sebastian · 25.7.2026
#event_simpleName=OsVersionInfo
| osData:=concat([OSVersionString, ProductName])
| groupBy([aid], function=([selectFromMax(field="@timestamp", include=[event_platform, RFMState, LinuxSensorBackend, AgentVersion, osData])]))
| RFMState match {Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Check for Sensors in RFM.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check%20for%20Sensors%20in%20RFM.md
@sebastian · 25.7.2026
// Get OsVersionInfo events #event_simpleName=OsVersionInfo // Get latest OsVersionInfo data per aid | groupBy([aid], function=([selectFromMax(field="@timestamp", include=[event_platform, ComputerName, AgentVersion])]), limit=max)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Check for Unsupported Sensors.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check%20for%20Unsupported%20Sensors.md
@sebastian · 25.7.2026
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\(?<fileName>chrome\.exe)$/i
| groupBy([cid, aid, fileName, SHA256HashData])
| match(file="fdr_aidmaster.csv", field=aid, include=ComputerName, ignoreCase=true, strict=false)
| join({#event_simpleName=PeVersionInfo event_platform=Win | ImageFileName=/\\chrome\.exe/i | groupBy([SHA256HashData, FixedFileVersion, CompanyName], function=selectLast([ComputerName, FixedFileVersion]))}, include=[FixedFileVersion, CompanyName], field=[SHA256HashData])Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Chrome Version Number Evaluation.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Chrome%20Version%20Number%20Evaluation.md
@sebastian · 25.7.2026
// Fleshed out query for clickfix detection #event_simpleName=ProcessRollup2 | #repo=base_sensor
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/ClickFixHunting.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/ClickFixHunting.md
@sebastian · 25.7.2026
(#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/(winword|excel)\.exe/i) OR (#event_simpleName=ZipFileWritten event_platform=Win)
| falconPID:=ContextProcessId | falconPID:=TargetProcessId
| selfJoinFilter(field=[aid, falconPID], where=[{#event_simpleName=ProcessRollup2}, {#event_simpleName=ZipFileWritten}], prefilter=true)
| case{Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Combine ProcessRollup2 and FileWritten Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Combine%20ProcessRollup2%20and%20FileWritten%20Events.md
@sebastian · 25.7.2026
(#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\chrome\.exe$/i) OR (#event_simpleName=NetworkConnectIP4 RemoteAddressIP4="8.8.8.8" event_platform=Win)
| falconPID:=TargetProcessId | falconPID:=ContextProcessId
| selfJoinFilter([aid, falconPID], where=[{#event_simpleName=ProcessRollup2}, {#event_simpleName=NetworkConnectIP4}], prefilter=true)
| groupBy([aid, falconPID], function=([collect([RemoteAddressIP4, ImageFileName, CommandLine]), count(#event_simpleName, distinct=true, as=eventCount)]))Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Combine ProcessRollup2 and NetworkConnectIP4 Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Combine%20ProcessRollup2%20and%20NetworkConnectIP4%20Events.md
@sebastian · 25.7.2026
// Insert Discovery commands of interest here event_platform=Win #event_simpleName=ProcessRollup2 FileName=/(whoami|ping|net1?|systeminfo|quser|ipconfig)/iF // Restrict to non-system UserSid Values
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Count Windows Discovery Commands Per User.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Count%20Windows%20Discovery%20Commands%20Per%20User.md
@sebastian · 25.7.2026
#event_simpleName=UserLogon //UserName="name@example.com"
| UserName=~wildcard(?{UserName="*"}, ignoreCase=true)
| LogonTime:=LogonTime*1000
| time:dayOfWeekName(LogonTime)Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Create Heatmap of Login Activity.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Create%20Heatmap%20of%20Login%20Activity.md
@sebastian · 25.7.2026
//Get PowerShell Events #event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\powershell\.exe/i //Look for PS flags that indicate an encoded command | CommandLine=/\s+\-(e|encoded|encodedcommand|enc)\s+/i
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Decode Base64.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Decode%20Base64.md
@sebastian · 25.7.2026
```#event_simpleName=FsVolumeMounted | bitfield:extractFlags( field=VolumeDeviceCharacteristics, output=[
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Decode VolumeDeviceCharacteristics Bitmask.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Decode%20VolumeDeviceCharacteristics%20Bitmask.md
@sebastian · 25.7.2026
#event_simpleName=ProcessRollup2 WindowFlags=* | bitfield:extractFlags( field=WindowFlags, output=[
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Decoding WindowFlags Bitmask.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Decoding%20WindowFlags%20Bitmask.md
@sebastian · 25.7.2026
// Get browser extension event #event_simpleName=InstalledBrowserExtension BrowserExtensionId!="no-extension-available" | aid=?aid | ComputerName=?ComputerName
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Enumerate Browser Extensions.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Enumerate%20Browser%20Extensions.md
@sebastian · 25.7.2026
// Get all DriverLoad events and Event_ModuleSummaryInfoEvent events so certificate data can be merged in (#event_simpleName=DriverLoad event_platform=Win) OR (#repo=detections ExternalApiType=Event_ModuleSummaryInfoEvent ) // Shorten file path from DriverLoad event
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Enumerate Windows Driver Loads.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Enumerate%20Windows%20Driver%20Loads.md
@sebastian · 25.7.2026
#event_simpleName=OsVersionInfo event_platform=Win | groupby(aid, function=selectLast([AgentVersion, event_platform, @timestamp])) | AgentVersion=/(?<majorVersion>\d+)\.(?<minorVersion>\d+)\.(?<buildNumber>\d+)\.\d+/
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Evaluate Falcon Agent Version.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Evaluate%20Falcon%20Agent%20Version.md
@sebastian · 25.7.2026
#event_simpleName=/UserLogon/
| case{
#event_simpleName=UserLogon | SuccessLogonTime:=ContextTimeStamp;
#event_simpleName=UserLogonFailed2 | FailedLogonTime:=ContextTimeStamp;Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Failed and Successful User Logon Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Failed%20and%20Successful%20User%20Logon%20Events.md
@sebastian · 25.7.2026
// Get events of interest EventType=Event_ExternalApiEvent EventType=Event_ExternalApiEvent OperationName=userAuthenticate Success=true // Get ASN Details | asn(OriginSourceIpAddress, as=asn)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Falcon Authentication from Unexpected GeoHash.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Falcon%20Authentication%20from%20Unexpected%20GeoHash.md
@sebastian · 25.7.2026
#event_simpleName=/FileWritten$/ AND ((event_platform=Win DiskParentDeviceInstanceId="USB*") OR (event_platform=Mac IsOnRemovableDisk=1)) AND TargetFileName!="*.Spotlight-V100*"
| groupBy([ComputerName], function=([collect([TargetFileName]), count(TargetFileName, as=TotalFile), sum(Size, as=SumSize)]))
| TotalFiles > 10 OR SumSize > 5242880
| case {Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Files Written to Removable Media.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Files%20Written%20to%20Removable%20Media.md
@sebastian · 25.7.2026
// Get file names of interest #event_simpleName=ProcessRollup2 event_platform=Win | in(field="FileName", values=[whoami.exe, arp.exe, cmd.exe, net.exe, net1.exe, ipconfig.exe, route.exe, netstat.exe, nslookup.exe, nltest.exe, systeminfo.exe, wmic.exe, tasklist.exe, tracert.exe, ping.exe, adfind.exe, nbtstat.exe, find.exe, ldifde.exe, netsh.exe, wbadmin.exe], ignoreCase=true)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Frequency Analysis via Program Clustering.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Frequency%20Analysis%20via%20Program%20Clustering.md
@sebastian · 25.7.2026
// Get all process execution and DNS events on Windows (#event_simpleName=ProcessRollup2 OR #event_simpleName=DnsRequest) event_platform=Win | ComputerName=~wildcard(?ComputerName, ignoreCase=true) // Normalize file name value across both events
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Get DNS Resolutions from Browser Processes.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Get%20DNS%20Resolutions%20from%20Browser%20Processes.md
@sebastian · 25.7.2026
#sampleType = repository
| timechart(repo,
function={sum(ingestAfterFieldRemovalSize)}, minSpan=1h, limit=20)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Get Repository Ingestion Data for LogScale SaaS.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Get%20Repository%20Ingestion%20Data%20for%20LogScale%20SaaS.md
@sebastian · 25.7.2026
#repo=?repo #type=?type #Vendor=?Vendor
| eventSize()
| unit:convert(_eventSize, to="G")
| sum("_eventSize")Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Get Repository Ingestion in Raptor.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Get%20Repository%20Ingestion%20in%20Raptor.md
@sebastian · 25.7.2026
// Get Event Required on Windows Platform #event_simpleName=AgentOnline event_platform=Win // Convert BastTime in epoch Time Stamp
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Get Windows OS Boot Time.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Get%20Windows%20OS%20Boot%20Time.md
@sebastian · 25.7.2026
#event_simpleName=HttpRequestDetect
| parseHexString("HttpPostBody", as=b64data)
| format("%,.4s", field=b64data, as=b64data)
| MagicNumber := base64Decode(b64data, charset="UTF-8")Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/HttpRequestDetect.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/HttpRequestDetect.md
@sebastian · 25.7.2026
// Get bcdedit.exe process executions #event_simpleName=ProcessRollup2 event_platform=Win FileName="bcdedit.exe" // Create process lineage tree for easier reading
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Hunting bcdedit.exe usage.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Hunting%20bcdedit.exe%20usage.md
@sebastian · 25.7.2026
#event_simpleName=ProcessRollup2
| join({#event_simpleName=IsoExtensionFileWritten OR #event_simpleName=ImgExtensionFileWritten}, key=[aid, ContextProcessId], field=[aid, TargetProcessId], include=[TargetFileName])
| ImageFileName=/(\/|\\)(?<FileName>\w*\.?\w*)$/Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/ISO_IMG Written to Disk w_ Responsible Process.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/ISO_IMG%20Written%20to%20Disk%20w_%20Responsible%20Process.md
@sebastian · 25.7.2026
// Get UserLogon events for Windows RDP sessions #event_simpleName=UserLogon event_platform=Win LogonType=10 RemoteAddressIP4=* // Omit results if the RemoteAddressIP4 field is RFC1819
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Impossible Time To Travel (UserLogon).md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Impossible%20Time%20To%20Travel%20%28UserLogon%29.md
@sebastian · 25.7.2026
// Get browser extension event #event_simpleName=InstalledBrowserExtension BrowserExtensionId!="no-extension-available" // Aggregate by event_platform, BrowserName, ExtensionID and ExtensionName
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Installed Browser Extensions.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Installed%20Browser%20Extensions.md
@sebastian · 25.7.2026
#repo=sensor_metadata #data_source_name=aidmaster | groupBy([cid, aid], function=([selectFromMax(field="@timestamp", include=[AgentLoadFlags, AgentLocalTime, AgentTimeOffset, AgentVersion, BiosManufacturer, BiosVersion, ChassisType, City, ComputerName, ConfigBuild, ConfigIDBuild, Continent, Country, FalconGroupingTags, FirstSeen, HostHiddenStatus, MachineDomain, OU, PointerSize, ProductType, SensorGroupingTags, ServicePackMajor, SiteName, SystemManufacturer, SystemProductName, @timezone, Timezone, Version, aid, aip, cid, event_platform])])) | lastSeen:=@timestamp | formatTime(format="%F %T", as="lastSeen", field=lastSeen)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Leveraging the aidmaster repo.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Leveraging%20the%20aidmaster%20repo.md
@sebastian · 25.7.2026
#repo=detections ExternalApiType=Event_IdpDetectionSummaryEvent
| rename([[TargetEndpointHostName, TargetEndpoint], [SourceEndpointHostName, SourceEndpoint], [TargetAccountName, TargetAccount], [SourceAccountName, SourceAccount]])
| format("[FalconHostLink](%s)", field=[FalconHostLink], as="FalconHostLink")
| format(format="%s > %s", field=[Tactic, Technique], as=MITRE)Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/List All ITP Detections.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/List%20All%20ITP%20Detections.md
@sebastian · 25.7.2026
// Get Windows events where a program is listening on a port under 10000 and all process execution events event_platform=Win (#event_simpleName=NetworkListenIP4 LocalPort<10000) OR (#event_simpleName=ProcessRollup2) // Normalize UPID | falconPID:= TargetProcessId | falconPID:=ContextProcessId
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Listening Programs with low port numbers.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Listening%20Programs%20with%20low%20port%20numbers.md
@sebastian · 25.7.2026
// Create a live table of the executables in System32/SysWOW64
| defineTable(query={
#event_simpleName=ProcessRollup2 event_platform=Win FilePath=/\\Windows\\(System32|SysWOW64)\\/ FileName=/\.exe$/
| FilePath=/(\\Device\\HarddiskVolume\d+)?(?<ExpectedFilePath>\\.+)/Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Look for files running outside Windows systems folders with name masquerading.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Look%20for%20files%20running%20outside%20Windows%20systems%20folders%20with%20name%20masquerading.md
@sebastian · 25.7.2026
#repo=sensor_metadata #data_source_name=aid-policy | parseJson(field=groups, prefix=groups_arr) | concatArray(groups_arr, separator=",", as=groups_arr)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Map Agent ID values to Host Group Names.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Map%20Agent%20ID%20values%20to%20Host%20Group%20Names.md
@sebastian · 25.7.2026
// Get alert events
#repo=detections (ExternalApiType=/Event_(Epp|Idp|Mobile)DetectionSummaryEvent/) OR (ExternalApiType=Event_UserActivityAuditEvent OperationName=detection_update)
| case{
ExternalApiType=Event_UserActivityAuditEvent Attributes.update_status="closed" | ResolveTime:=@timestamp;Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Mean Time to React, Respond, and Resolve.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Mean%20Time%20to%20React%2C%20Respond%2C%20and%20Resolve.md
@sebastian · 25.7.2026
aid=1e0afc34e9634710bfcd2f46d8564ab1 (#event_simpleName=ProcessRollup2 FileName="powershell.exe")
| select([aid, ComputerName, CommandLine])
| join(key=aid, field=aid, query={#repo=sensor_metadata}, include=([AgentVersion, BiosManufacturer, FalconGroupingTags]))
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Merge Legacy AID Master Info.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Merge%20Legacy%20AID%20Master%20Info.md
@sebastian · 25.7.2026
#event_simpleName=ProcessRollup2
| aid=?{aid=*}
| ImageFileName =~ wildcard(?{ImageFileName="*"}, ignoreCase=true, includeEverythingOnAsterisk=true)
| ImageFileName=/(\/|\\)(?<FileName>\w*\.?\w*)$/Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Merge Parent_Child PR2 with Join.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Merge%20Parent_Child%20PR2%20with%20Join.md
@sebastian · 25.7.2026
#event_simpleName=NetworkConnectIP4 RemotePort=3389 | !cidr(RemoteAddressIP4, subnet=["224.0.0.0/4", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.1/32", "169.254.0.0/16", "0.0.0.0/32"])
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Omit RFC1819 CIDR Ranges from Search.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Omit%20RFC1819%20CIDR%20Ranges%20from%20Search.md
@sebastian · 25.7.2026
(#event_simpleName = ProcessRollup2 AND ImageFileName = /.*\\powershell\.exe/) OR (#event_simpleName=DnsRequest AND (DomainName!="ocsp.digicert.com" AND DomainName!="localhost"))
| rename("ContextProcessId",as="TargetProcessId")
| groupby([aid, TargetProcessId], function=stats([count(#event_simpleName, distinct=true), collect(DomainName), collect(ImageFileName), collect(CommandLine)]), limit=max)Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/PR2 + DNS Cheat Join.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/PR2%20%2B%20DNS%20Cheat%20Join.md
@sebastian · 25.7.2026
// Get all Windows ProcessRollup2 events with .dll or .exe listed in the call stack event_platform=Win #event_simpleName=ProcessRollup2 CallStackModuleNames=/\.(dll|exe)/ // Create filters to narrow searches
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Parse Windows Call Stack.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Parse%20Windows%20Call%20Stack.md
@sebastian · 25.7.2026
// Get SensorHeartbeat events for Windows, macOS, and Linux #event_simpleName=SensorHeartbeat event_platform=/(^(Win|Mac|Lin)$)/ // Get most recent event for each aid value and include event_platform | groupBy([event_platform, aid], function=([selectFromMax(field="@timestamp", include=[SensorStateBitMap])]))
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Percentage of Sensors in RFM.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Percentage%20of%20Sensors%20in%20RFM.md
@sebastian · 25.7.2026
#event_simpleName=OsVersionInfo event_platform=/^(Win|Mac|Lin)$/
| groupBy(field=#cid, function=[count(aid, distinct=true, as=totalcount), {event_platform=Lin | count(aid, distinct=true, as=Linux)},{ event_platform=Mac | count(aid, distinct=true, as=Mac)}, { event_platform=Win | count(aid, distinct=true, as=Windows)}])
| linuxPercentage := (Linux/totalcount)*100 | format(format="%,.3f%%", field=[linuxPercentage], as=linuxPercentage)Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Percentage of Windows_Mac_Linux Endpoints.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Percentage%20of%20Windows_Mac_Linux%20Endpoints.md
@sebastian · 25.7.2026
| bitfield:extractFlags(
field=ProcessCreateFlags,
output=[
[0,DEBUG_PROCESS],Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Process ProcessCreateFlags.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Process%20ProcessCreateFlags.md
@sebastian · 25.7.2026
// Specify data source and simpleName (index) #event_simpleName=ProcessRollup2 // search for net.exe and net1.exe (including path, hence the wildcard)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/ProcessRollup2 Curation.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/ProcessRollup2%20Curation.md
@sebastian · 25.7.2026
// Get ProcessRollup2 events for Windows with Mark of the Web field set #event_simpleName=ProcessRollup2 event_platform=Win ZoneIdentifier=* // Parse ConfigBuild for Falcon link syntehsis
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/ProcessRollup2 Files With Mark of the Web.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/ProcessRollup2%20Files%20With%20Mark%20of%20the%20Web.md
@sebastian · 25.7.2026
#event_simpleName=DetectionExcluded ExclusionSource=6
| PatternId =~ match(file="falcon/investigate/detect_patterns.csv", column=PatternId, strict=false)
| case {
ExclusionType=1 | ExclusionType_Readable:="IOA" | Detail:=CommandLine;Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Profiling IOC and IOA Exclusions in Falcon.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Profiling%20IOC%20and%20IOA%20Exclusions%20in%20Falcon.md
@sebastian · 25.7.2026
#event_simpleName=OsVersionInfo RFMState=*
| day := formatTime("%Y-%m-%d", field=@timestamp, locale=en_US, timezone=Z)
| groupBy([aid, day], function=(selectLast([RFMState, @timestamp])), limit=max)Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/RFM State by Day.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/RFM%20State%20by%20Day.md
@sebastian · 25.7.2026
#event_simpleName=ProcessRollup2 event_platform=Win // Add in additional program names here. | in(field="FileName", values=[anydesk.exe, AteraAgent.exe, teamviewer.exe, SRService.exe, SRManager.exe, SRServer.exe, SRAgent.exe, ClientService.exe, "ScreenConnect.WindowsClient.exe", ngrok.exe], ignoreCase=true) | FilePath=/\\Device\\HarddiskVolume\d\\(?<ShortFilePath>.+$)/
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/RMM Tool Hunting.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/RMM%20Tool%20Hunting.md
@sebastian · 25.7.2026
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/.*\\powershell\.exe/
| CommandLine=/.*\s+\-(e|encoded|encodedcommand|enc)\s+.*/
| length("CommandLine", as="cmdLength")Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Rare and Common Encrypted Command Lines.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Rare%20and%20Common%20Encrypted%20Command%20Lines.md
@sebastian · 25.7.2026
(#event_simpleName=/^(SystemCapacity|ResourceUtilization)$/) OR (#repo=sensor_metadata #data_source_name=aidmaster)
| case {
event_platform=Lin | ProductType:=3;
event_platform=Mac | ProductType:=1;Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Resource Utilization.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Resource%20Utilization.md
@sebastian · 25.7.2026
#event_simpleName=NetworkReceiveAcceptIP4 event_platform=Win | in(field="LocalPort", values=[3389, 21, 22, 5901]) | !cidr(RemoteAddressIP4, subnet=["224.0.0.0/4", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/32", "169.254.0.0/16", "0.0.0.0/32"]) | communityId(proto=Protocol, sourceip=LocalAddressIP4, destinationip=RemoteAddressIP4, as=communityId)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Scope Network Accept Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Scope%20Network%20Accept%20Events.md
@sebastian · 25.7.2026
#event_simpleName=ScriptControlScanInfo event_platform=Win
| ScriptContent=/FromBase64String/i
| entropy := shannonEntropy("ScriptContent")Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Script Content Entropy.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Script%20Content%20Entropy.md
@sebastian · 25.7.2026
#event_simpleName=OsVersionInfo
| field_temp:= ?{ComputerName="*"}
| case {
field_temp != /^\*$/ | regex(field=field_temp,regex = "(?<field_matched>.*?)(,|$)", repeat="true") | test(ComputerName==field_matched) | drop([field_matched,field_temp]) ;Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Searching Comma Delineated List With User Input.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Searching%20Comma%20Delineated%20List%20With%20User%20Input.md
@sebastian · 25.7.2026
// Get all sensor heartbeat events #event_simpleName=SensorHeartbeat // Get last event for each Agent ID value
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Sensors without Heartbeat Event in 20 Minutes.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Sensors%20without%20Heartbeat%20Event%20in%2020%20Minutes.md
@sebastian · 25.7.2026
defineTable(
query={
#repo="sensor_metadata" #data_source_name="policyinfo" #data_source_group="sensor-update"
| groupBy(id, function=selectFromMax(field="@timestamp", include=[release_id]))Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Show Sensor Update Policies.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Show%20Sensor%20Update%20Policies.md
@sebastian · 25.7.2026
#repo=sensor_metadata #data_source_name=aidmaster #data_source_group=aidmaster-api
| groupBy([aid], function=([selectFromMax(field="@timestamp", include=[ComputerName, Time, Version, ConfigIDBuild, AgentVersion])]))
| match(file="falcon/investigate/sensors_support_info.csv", field=ConfigIDBuild, column=BUILD, ignoreCase=true, strict=true)
| parseTimestamp("M/d/yy",field=SUPPORT_ENDS, as=SUPPORT_ENDS_EPOCH, timezone="UTC")Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Support Ends.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Support%20Ends.md
@sebastian · 25.7.2026
// Get events of interest #repo=detections | in(field="ExternalApiType", values=[Event_UserActivityAuditEvent, Event_EppDetectionSummaryEvent])
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Survival of the Fastest.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Survival%20of%20the%20Fastest.md
@sebastian · 25.7.2026
#event_simpleName=/^(SystemCapacity|ResourceUtilization)$/ | groupBy(aid, function=([selectLast([CpuProcessorName, PhysicalCoreCount, LogicalCoreCount, AverageCpuUsage, MemoryTotal, MaxUsedRam, AverageUsedRam, MaxUsedRam, AvailableDiskSpace])])) | CpuProcessorName=* AND AvailableDiskSpace=*
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/SystemCapacity & ResourceUtilization.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/SystemCapacity%20%26%20ResourceUtilization.md
@sebastian · 25.7.2026
#event_simpleName=/^(NetworkConnectIP4|ProcessRollup2)$/
| falconPID:=TargetProcessId | falconPID:=ContextProcessId
| UserID:=UserSid | UserID:=UID
| selfJoinFilter(field=[aid, falconPID], where=[{#event_simpleName=NetworkConnectIP4}, {#event_simpleName=ProcessRollup2}])Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Systems Initiating Connections to a High Number of Ports.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Systems%20Initiating%20Connections%20to%20a%20High%20Number%20of%20Ports.md
@sebastian · 25.7.2026
#event_simpleName=ProcessRollup2 | ImageFileName=/(\\|\/)(?<fileName>whoami+(\.exe)?$)/i | concat([UID, UserSid], as="userIdentifier")
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Two whoami Commands Run.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Two%20whoami%20Commands%20Run.md
@sebastian · 25.7.2026
(#event_simpleName=ProcessRollup2 ImageFileName=/\\psexec64\.exe/i ParentBaseFileName=/powershell\.exe/i) | rename(field="ImageFileName", as="ChildImageFileName") | rename(field="CommandLine", as="ChildCommandLine")
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Use Join on Two Scoped Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Use%20Join%20on%20Two%20Scoped%20Events.md
@sebastian · 25.7.2026
| createEvents(["color=blue", "shape=round", "size=large"]) | kvParse() | transpose(limit=1000) | column := upper(column)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Use Transpose to Convert Field Names to Upper Case.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Use%20Transpose%20to%20Convert%20Field%20Names%20to%20Upper%20Case.md
@sebastian · 25.7.2026
// Get two events of interest event_platform=Win #event_simpleName=/^(UserAccountAddedToGroup|ProcessRollup2)$/ // Begin data normalization
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/User Added to Group.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/User%20Added%20to%20Group.md
@sebastian · 25.7.2026
#event_simpleName=UserLogon UserSid=S-1-5-21-*
| in(LogonType, values=["2","10"])
| ipLocation(aip)
| case {UserIsAdmin = "1" | UserIsAdmin := "Yes" ;Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/UserLogon Query.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/UserLogon%20Query.md
@sebastian · 25.7.2026
#event_simpleName=UserLogon UserSid=S-1-5-21-* | in(LogonType, values=["2","10"]) | ipLocation(aip) | $falcon/helper:enrich(field=UserIsAdmin)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/UserLogon.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/UserLogon.md
@sebastian · 25.7.2026
#event_simpleName=ProcessRollup2 ImageFileName=/(\\|\/)whoami/i | groupBy([aid], function=(count(aid, as=executionCount))) | myThreshold:=?myThreshold | myThreshold:=if(condition=(myThreshold == "*"), then="0", else=myThreshold)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Using Editable Threshold Values.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Using%20Editable%20Threshold%20Values.md
@sebastian · 25.7.2026
correlate(
// Search for grandparent process
grandparent: {
#event_simpleName=ProcessRollup2 event_platform=Win FileName!="explorer.exe" CommandLine=*Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Using correlate() to hunt process lineage.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Using%20correlate%28%29%20to%20hunt%20process%20lineage.md
@sebastian · 25.7.2026
// Get RTR Start events #repo=detections #event_simpleName=Event_RemoteResponseSessionStartEvent // Rename Agent ID value
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/View Recent RTR Sessions.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/View%20Recent%20RTR%20Sessions.md
@sebastian · 25.7.2026
event_type=ZeroTrustHostAssessment
| groupBy([aid], function=([selectFromMax(field="@timestamp", include=[scores.os, scores.sensor, scores.overall])]))
| join(query={#data_source_name=aidmaster }, field=[aid], include=[ComputerName, event_platform])
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Zero Trust Host Assessment Scores.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Zero%20Trust%20Host%20Assessment%20Scores.md
@sebastian · 25.7.2026
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win /(mainWindowTitle|Get-Process|GetForegroundWindow|mainWindowTitle)/i
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1010) Application Window Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1010%29%20Application%20Window%20Discovery.md
@sebastian · 25.7.2026
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\reg\.exe/
| ImageFileName=/^//.+//(?<FileName>reg\.exe)/
| FileName:=lower("FileName")
| ParentBaseFileName:=lower("ParentBaseFileName")Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1012) Query Registry.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1012%29%20Query%20Registry.md
@sebastian · 25.7.2026
#event_simpleName=ProcessRollup2 ImageFileName=/(\\|\/)(traceroute|tracert|ping|ifconfig|ipconfig|nbtstat|route|getmac)(\.exe)?$/i
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1016) System Network Configuration Discovery/(T1016.001) System Network Configuration Discovery - Internet Connection Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1016%29%20System%20Network%20Configuration%20Discovery/%28T1016.001%29%20System%20Network%20Configuration%20Discovery%20-%20Internet%20Connection%20Discovery.md
@sebastian · 25.7.2026
#event_simpleName=ProcessRollup2 event_platform=Win ((ImageFileName=/\\(ping|tracert)\.exe/i) OR (ImageFileName=/\\net1?\.exe/i CommandLine=/view/i) OR (ImageFileName=/\\nltest\.exe/i CommandLine=/\/dclist/i) OR (/\\etc\\hosts\\/i))
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1018) Remote System Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1018%29%20Remote%20System%20Discovery.md
@sebastian · 25.7.2026
#event_simpleName=ProcessRollup2 ((ImageFileName=/(\\|\/)(w|who|whoami)(\.exe)?$/i) OR (event_platform=Mac ImageFileName=/\/dscl/i CommandLine=/users/i))
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1033) System Owner_User Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1033%29%20System%20Owner_User%20Discovery.md
@sebastian · 25.7.2026
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\tasklist\.exe/) OR (/(Get-Process|CreateToolhelp32Snapshot)/i))
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1057) Process Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1057%29%20Process%20Discovery.md
@sebastian · 25.7.2026
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\net1?\.exe/i CommandLine=/localgroup/i) OR (/get-localgroup/i))
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1069) Permission Groups Discovery/(T1069.001) Permission Groups Discovery - Local Groups.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1069%29%20Permission%20Groups%20Discovery/%28T1069.001%29%20Permission%20Groups%20Discovery%20-%20Local%20Groups.md
@sebastian · 25.7.2026
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\net1?\.exe/i CommandLine=/group.+\/domain/i
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1069) Permission Groups Discovery/(T1069.002) Permission Groups Discovery - Domain Groups.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1069%29%20Permission%20Groups%20Discovery/%28T1069.002%29%20Permission%20Groups%20Discovery%20-%20Domain%20Groups.md
@sebastian · 25.7.2026
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ /(Get\-MsolRole|get\-member\-groups|ListRolePolicies|ListAttachedRolePolicies|GetBucketAcl)/i
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1069) Permission Groups Discovery/(T1069.003) Permission Groups Discovery - Cloud Groups.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1069%29%20Permission%20Groups%20Discovery/%28T1069.003%29%20Permission%20Groups%20Discovery%20-%20Cloud%20Groups.md
@sebastian · 25.7.2026
#event_simpleName=ProcessRollup2 event_platform=Win ((ImageFileName=/\\(fsutil|fsinfo|drives|systeminfo|vssadmin|hostname)\.exe/i) OR (ImageFileName=/\\net1?\.exe/i CommandLine=/config/i))
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1082) System Information Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1082%29%20System%20Information%20Discovery.md
@sebastian · 25.7.2026
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win /Get-GlobalAddressList/
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1087) Account Discovery/(T1087.003) Account Discovery - Email Account.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1087%29%20Account%20Discovery/%28T1087.003%29%20Account%20Discovery%20-%20Email%20Account.md
@sebastian · 25.7.2026
(#event_simpleName=ProcessRollup2 CommandLine=/az\s+ad\s+user\s+list/i) OR (#event_simpleName=ProcessRollup2 CommandLine=/aws\s+iam\s+list\-(roles|users)/i) OR (#event_simpleName=ProcessRollup2 CommandLine=/gcloud\s+ (iam\s+service\-accounts\s+list|projects\s+get\-iam\-policy)/i)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1087) Account Discovery/(T1087.004) Account Discovery - Cloud Account.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1087%29%20Account%20Discovery/%28T1087.004%29%20Account%20Discovery%20-%20Cloud%20Account.md
@sebastian · 25.7.2026
(#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\net1?\.exe/i CommandLine=/(user|group).+\/domain/i) OR (#event_simpleName=/^(CommandHistory|ScriptControl)/ event_platform=Win /Get-ADUser|Get-ADGroupMember/i)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1087) Account Discovery/(T1087.002) Account Discovery - Domain Account.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1087%29%20Account%20Discovery/%28T1087.002%29%20Account%20Discovery%20-%20Domain%20Account.md
@sebastian · 25.7.2026
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\fsutil\.exe/i CommandLine=/fsinfo/i
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1120) Peripheral Device Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1120%29%20Peripheral%20Device%20Discovery.md
@sebastian · 25.7.2026
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ /(dir|tree|ls|find|locate|show)\s+/i
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1083) File and Directory Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1083%29%20File%20and%20Directory%20Discovery.md
@sebastian · 25.7.2026
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\net1?\.exe/i CommandLine=/\s+(view|share)\s+/i) OR (ImageFileName=/\\netview\.exe/i) OR (/NetShareEnum/))
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1135) Network Share Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1135%29%20Network%20Share%20Discovery.md
@sebastian · 25.7.2026
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\net1?\.exe/i CommandLine=/accounts/i) OR (/(Get-ADDefaultDomainPasswordPolicy|GetAccountPasswordPolicy)/i))
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1201) Password Policy Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1201%29%20Password%20Policy%20Discovery.md
@sebastian · 25.7.2026
// Get events of interest for T1217 #event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ // Omit events where the browser is the executing process
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1217) Browser Information Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1217%29%20Browser%20Information%20Discovery.md
@sebastian · 25.7.2026
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\nltest\.exe/i CommandLine=/trust/i) OR (ImageFileName=/\\dsquery\.exe/i CommandLine=/trustedDomain/i) OR (/(Get-NetDomainTrust|Get-NetForestTrust|Get-AcceptedDomain)/i))
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1482) Domain Trust Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1482%29%20Domain%20Trust%20Discovery.md
@sebastian · 25.7.2026
#event_simpleName=/^(ProcessRollup2|CommandHistory)$/ event_platform=Win ((CommandLine=/(securityCenter2|csagent|csfalconservice)/i) OR (CommandHistory=/(securityCenter2|csagent|csfalconservice)/i) OR (ImageFileName=/netsh\.exe/i))
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1518) Software Discovery/(T1518.001) Software Discovery - Security Software Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1518%29%20Software%20Discovery/%28T1518.001%29%20Software%20Discovery%20-%20Security%20Software%20Discovery.md
@sebastian · 25.7.2026
(#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ /(DescribeInstances|ListBuckets|HeadBucket|GetPublicAccessBlock|DescribeDBInstances)/i) OR (#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ /(gcloud\s+compute\s+instances\s+list)/i) OR (#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ /(az\s+vm\s+list)/i)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1580) Cloud Infrastructure Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1580%29%20Cloud%20Infrastructure%20Discovery.md
@sebastian · 25.7.2026
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win /(\\Control\\Nls\\Language|GetUserDefaultUILanguage|GetSystemDefaultUILanguage|GetKeyboardLayoutList|GetUserDefaultLangID)/i
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1614) System Location Discovery/(T1614.001) System Location Discovery - System Language Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1614%29%20System%20Location%20Discovery/%28T1614.001%29%20System%20Location%20Discovery%20-%20System%20Language%20Discovery.md
@sebastian · 25.7.2026
#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\gpresult\.exe/i) OR /(Get-DomainGPO|Get-DomainGPOLocalGroup|GPOLocalGroup)/i)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1615) Group Policy Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1615%29%20Group%20Policy%20Discovery.md
@sebastian · 25.7.2026
(#event_simpleName=ProcessRollup2 event_platform=Win (ImageFileName=/\\driverquery\.exe/i OR (ImageFileName=/\\sc\.exe/i CommandLine=/query/i))) OR (#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win /CurrentControlSet\\(Services|HardwareProfiles)/)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1652) Device Driver Discovery.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1652%29%20Device%20Driver%20Discovery.md
@sebastian · 25.7.2026
// [T1059.001] NSLookup Remote Payload - Win // // https://attack.mitre.org/techniques/T1059/001/ //
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1059.001] NSLookup Remote Payload - Win.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1059.001%5D%20NSLookup%20Remote%20Payload%20-%20Win.logscale
@sebastian · 25.7.2026
// [T1087.001] Account Discovery - Local Accounts - Lin // // https://attack.mitre.org/techniques/T1087/001/ //
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.001] Account Discovery - Local Accounts - Lin.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.001%5D%20Account%20Discovery%20-%20Local%20Accounts%20-%20Lin.logscale
@sebastian · 25.7.2026
// [T1087.001] Account Discovery - Local Accounts - Mac // // https://attack.mitre.org/techniques/T1087/001/ //
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.001] Account Discovery - Local Accounts - Mac.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.001%5D%20Account%20Discovery%20-%20Local%20Accounts%20-%20Mac.logscale
@sebastian · 25.7.2026
// [T1087.001] Account Discovery - Local Accounts - Win // // https://attack.mitre.org/techniques/T1087/001/ //
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.001] Account Discovery - Local Accounts - Win.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.001%5D%20Account%20Discovery%20-%20Local%20Accounts%20-%20Win.logscale
@sebastian · 25.7.2026
// [T1087.002] Account Discovery - Domain Accounts - Lin // // https://attack.mitre.org/techniques/T1087/002/ //
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.002] Account Discovery - Domain Accounts - Lin.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.002%5D%20Account%20Discovery%20-%20Domain%20Accounts%20-%20Lin.logscale
@sebastian · 25.7.2026
// [T1087.002] Account Discovery - Domain Accounts - Mac // // https://attack.mitre.org/techniques/T1087/002/ //
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.002] Account Discovery - Domain Accounts - Mac.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.002%5D%20Account%20Discovery%20-%20Domain%20Accounts%20-%20Mac.logscale
@sebastian · 25.7.2026
// [T1087.002] Account Discovery - Domain Accounts - Win // // https://attack.mitre.org/techniques/T1087/002/ //
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Queries/[T1087.002] Account Discovery - Domain Accounts - Win.logscale. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Queries/%5BT1087.002%5D%20Account%20Discovery%20-%20Domain%20Accounts%20-%20Win.logscale
@sebastian · 25.7.2026
#event_simpleName=UserLogonFailed2 event_platform=Win | SubStatus_hex := format(field=SubStatus, "0x%x") | $falcon/helper:enrich(field=SubStatus) | $falcon/helper:enrich(field=LogonType)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Friday/2024-03-01 CQF Live Supporting Queries.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Cool-Query-Friday/2024-03-01%20CQF%20Live%20Supporting%20Queries.md
@sebastian · 25.7.2026
// Get all Windows ProcessRollup2 Events #event_simpleName=ProcessRollup2 event_platform=Win // Narrow to processes of interest and create FileName variable | ImageFileName=/\\(?<FileName>(whoami|net1?|systeminfo|ping|nltest|sc|hostname|ipconfig)\.exe)/i
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Custom Weighting Command Line and File Name.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Custom%20Weighting%20Command%20Line%20and%20File%20Name.md
@sebastian · 25.7.2026
#event_simpleName=OsVersionInfo event_platform=Mac
| OSVersionFileData=*
| replace("([0-9A-Fa-f]{2})", with="%$1", field=OSVersionFileData, as=OSVersionFileData)Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/OsVersionInfo OsVersionFileData Decode.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/OsVersionInfo%20OsVersionFileData%20Decode.md
@sebastian · 25.7.2026
#event_simpleName=ProcessRollup2 event_platform=Mac (ImageFileName=/\/(id|groups)/i OR (ImageFileName=/\/dscl/ AND CommandLine=/list.+users/i))
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1087) Account Discovery/(T1087.001) Account Discovery - Local Account.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT%26CK-Enterprise/%28TA007%29%20Discovery/%28T1087%29%20Account%20Discovery/%28T1087.001%29%20Account%20Discovery%20-%20Local%20Account.md
@sebastian · 24.7.2026
#event_simpleName=UserLogon LogonType=10 | RemoteAddressIP4 = * | ipLocation(RemoteAddressIP4)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/RDP Login World Map.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/RDP%20Login%20World%20Map.md
@sebastian · 24.7.2026
#event_simpleName=/(OsVersionInfo|ConfigStateUpdate|SensorHeartbeat)/ | event_platform=Lin | groupBy([cid, aid], function=([selectLast([ConfigStateData, OSVersionString, SensorStateBitMap])]))
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Linux Sensors in Kernel Mode, User Mode, and RFM.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Linux%20Sensors%20in%20Kernel%20Mode%2C%20User%20Mode%2C%20and%20RFM.md
@sebastian · 24.7.2026
#event_simpleName=OsVersionInfo event_platform=Lin
| groupby(aid, function=selectLast([OSVersionString]))
| OSVersionString=/Linux\s+\S+\s(?<kernelVersion>\S+)\s.*/
| top("kernelVersion", limit=100)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Linux Kernel Version.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Linux%20Kernel%20Version.md
@sebastian · 24.7.2026
// Look for process handles opening Falcon #event_simpleName=FalconProcessHandleOpDetectInfo FileName="WerFaultSecure.exe" // Check for command line switching signal
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Hunting EDR Freeze.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Hunting%20EDR%20Freeze.md
@sebastian · 24.7.2026
#event_simpleName=ProcessRollup2
| join({#event_simpleName=FirewallSetRule}, key=ContextProcessId, field=TargetProcessId, include=[FirewallRule, FirewallRuleId])
| ImageFileName=/.*\\(?<fileName>.*\..*)/
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Firewall Rule Additions.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Firewall%20Rule%20Additions.md
@sebastian · 24.7.2026
// Get Windows UserLogonFailed events event_platform=Win #event_simpleName=UserLogonFailed2 // This line is completely optional, but converts SubStatus to hex
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Failed User Logon Thresholding.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Failed%20User%20Logon%20Thresholding.md
@sebastian · 24.7.2026
#event_simpleName=OsVersionInfo event_platform=Win | groupby(aid, function=selectLast([ProductName])) | groupBy([ProductName], function=stats([count(aid, as="endpointCount")]))
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Evaluate Operating System Prevalence.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Evaluate%20Operating%20System%20Prevalence.md
@sebastian · 24.7.2026
#event_simpleName=ProcessRollup2 UserSid=/^S-1-5-21-/ SignInfoFlags=* | bitfield:extractFlags( field=SignInfoFlags, output=[
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Decode SignInfoFlags.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Decode%20SignInfoFlags.md
@sebastian · 24.7.2026
#event_simpleName=CriticalEnvironmentVariableChanged | EnvironmentVariableName =/(SSH_CONNECTION|USER)/ | EnvironmentVariableValue=/(?<userName>\S+)\n(?<localIP>\d+\.\d+\.\d+\.\d+)\s+(?<localPort>\d+)\s+(?<remoteIP>\d+\.\d+\.\d+\.\d+)\s+(?<remotePort>\d+)$/i | table([@timestamp, aid, userName, remoteIP, remotePort, localIP, localPort])
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Critical Environment Variable Changed SSH.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Critical%20Environment%20Variable%20Changed%20SSH.md
@sebastian · 24.7.2026
id := hash([fields_to_count], limit=1000000) // Uses hash collision to increase cardinality the limit here needs to max the limit in the first groupby
| groupBy([id], limit=max, function={ groupBy([fields_to_count], function=[], limit=max)| count() }) // Count the sub groups
| sum("_count") // Sum all the counts
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Count Key-Pairs Beyond GroupBy Max Limit.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Count%20Key-Pairs%20Beyond%20GroupBy%20Max%20Limit.md
@sebastian · 24.7.2026
(#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\chrome\.exe$/i) OR (#event_simpleName=DnsRequest DomainName=/\.ru$/ event_platform=Win)
| falconPID:=TargetProcessId | falconPID:=ContextProcessId
| selfJoinFilter([aid, falconPID], where=[{#event_simpleName=ProcessRollup2}, {#event_simpleName=DnsRequest}], prefilter=true)
| groupBy([aid, falconPID], function=([collect([DomainName, UserName, ImageFileName, CommandLine])]))
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Combine ProcessRollup2 and DnsRequest Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Combine%20ProcessRollup2%20and%20DnsRequest%20Events.md
@sebastian · 24.7.2026
#event_simpleName=OsVersionInfo RFMState=*
| day := formatTime("%Y-%m-%d", field=@timestamp, locale=en_US, timezone=Z)
| groupBy([aid, day], function=(selectLast([RFMState, @timestamp])), limit=max)
| RFMState match {
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Cheat bucket Using groupBy.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Cheat%20bucket%20Using%20groupBy.md
@sebastian · 24.7.2026
//[Full post text.](https://community.crowdstrike.com/cool-query-friday-77/2023-09-20-cool-query-friday-live-from-fal-con-up-leveling-teams-with-multipurpose-text-box-driven-queries-420) //Create search to look for domain activity...
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Friday/2023-09-20 - Cool Query Friday - Up-leveling Teams With Text-box Driven Queries.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Cool-Query-Friday/2023-09-20%20-%20Cool%20Query%20Friday%20-%20Up-leveling%20Teams%20With%20Text-box%20Driven%20Queries.md
@sebastian · 24.7.2026
// Get successful Falcon console logins EventType=Event_ExternalApiEvent OperationName=userAuthenticate Success=true // Get ASN Details for OriginSourceIpAddress
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Friday/2023-06-14 - Cool Query Friday - Watching the Watchers - Profiling Falcon Console Logins via Geohashing.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Cool-Query-Friday/2023-06-14%20-%20Cool%20Query%20Friday%20-%20Watching%20the%20Watchers%20-%20Profiling%20Falcon%20Console%20Logins%20via%20Geohashing.md
@sebastian · 24.7.2026
// Get ReflectiveDotnetModuleLoad with non-null ManagedPdbBuildPath field #event_simpleName=ReflectiveDotnetModuleLoad event_platform=Win ManagedPdbBuildPath!="" // Capture FilePath and FileName Fields
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Friday/2023-09-08 - Cool Query Friday - Reflective .Net Module Loads and Program Database (PDB) File Paths.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Cool-Query-Friday/2023-09-08%20-%20Cool%20Query%20Friday%20-%20Reflective%20.Net%20Module%20Loads%20and%20Program%20Database%20%28PDB%29%20File%20Paths.md
@sebastian · 24.7.2026
#event_simpleName=AssociateTreeIdWithRoot | PatternId =~ match(file="falcon/investigate/detect_patterns.csv", column=PatternId, strict=false) | select([@timestamp, aid, ComputerName, PatternId,name,scenario,scenarioFriendly,description,severity,show_in_ui,killchain_stage,tactic,technique,objective,pattern_updated])
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/AssociateTreeIdWithRoot to Pattern Details.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/AssociateTreeIdWithRoot%20to%20Pattern%20Details.md
@sebastian · 24.7.2026
ExternalApiType=Event_DetectionSummaryEvent | format(format="%s > %s", field=[Tactic, Technique], as=MITRE) | groupBy([AgentIdString], function=([count(DetectId, as=totalDetections), sum(Severity, as=severityWeight), min(@timestamp, as=firstDetect), max(@timestamp, as=lastDetect), collect([MITRE])])) | formatTime(field=firstDetect, format="%Y-%m-%dT%H:%M:%S", as=firstDetect)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Aggregate Detection Data by Host.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Aggregate%20Detection%20Data%20by%20Host.md
@sebastian · 24.7.2026
#event_simpleName=NetworkConnectIP4 | groupBy([RemotePort], function=count(as=count), limit=max) | [sum(count, as=total), sort(field=RemotePort, order=ascending, limit=20000)] | percent := 100 * (count / total)
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Bottom 10% of NetworkConnct Port Values.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Bottom%2010%25%20of%20NetworkConnct%20Port%20Values.md
@sebastian · 24.7.2026
https://www.reddit.com/r/crowdstrike/comments/qid1tj/20211029_cool_query_friday_cpu_ram_disk_firmware/ ``` // Get 4 events of interest
Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Cool-Query-Friday/2021-10-29 - Cool Query Friday - CPU, RAM, Disk, Firmware, TPM 2.0, and Windows 11.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Cool-Query-Friday/2021-10-29%20-%20Cool%20Query%20Friday%20-%20CPU%2C%20RAM%2C%20Disk%2C%20Firmware%2C%20TPM%202.0%2C%20and%20Windows%2011.md
@sebastian · 24.7.2026
// [T1087.001] Account Discovery - Local Accounts - Win // // https://attack.mitre.org/techniques/T1087/001/ //
Detect Windows net.exe/net1.exe commands used to enumerate local users, groups, or local groups, mapped to MITRE ATT&CK T1087.001.
@sebastian · 24.7.2026
// [T1552.001] Microsoft Teams Unsecured Credentials In Files // // Reference: https://www.reddit.com/r/crowdstrike/comments/xfqtyb/20220916_cool_query_friday_microsoft_teams/ //
Detect process command lines referencing Microsoft Teams Cookies or Local Storage leveldb paths that may expose unsecured credentials, mapped to MITRE ATT&CK T1552.001.
@sebastian · 24.7.2026
// [CVE-2023-36884] Office and Windows HTML Remote Code Execution Vulnerability // // https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884 // https://www.reddit.com/r/crowdstrike/comments/14y1yei/20230712_situational_awareness_microsoft_office/
Detect Word documents written to disk with a .url extension related to CVE-2023-36884 Office and Windows HTML remote code execution activity.
@sebastian · 24.7.2026
// [CVE-2022-41082] ProxyNotShell Exchange Vulnerability // // https://www.reddit.com/r/crowdstrike/comments/xsvyn4/situational_awareness_proxynotshell_cve202240140/ // https://nvd.nist.gov/vuln/detail/CVE-2022-40140
Detect suspicious command execution from Exchange w3wp.exe related to ProxyNotShell-style activity and CVE-2022-41082.
@sebastian · 24.7.2026
// [T1087.002] Account Discovery - Domain Accounts - Win // // https://attack.mitre.org/techniques/T1087/002/ //
Detect Windows net.exe/net1.exe commands used to enumerate domain users or groups, mapped to MITRE ATT&CK T1087.002.
@sebastian · 24.7.2026
// [T1059.001] NSLookup Remote Payload - Win // // https://attack.mitre.org/techniques/T1059/001/ //
Detect PowerShell-spawned nslookup.exe queries using -q=txt, often used for remote payload retrieval, mapped to MITRE ATT&CK T1059.001.
@sebastian · 24.7.2026
"@collect.source_type"=file | /NO_CLIENT_SITE/i
For that to work the logscale collector has to retrieve the net logon file: sources: netlogon: type: file sink: logscale include: - "C:/Windows/debug/netlogon.log"
@sebastian · 24.7.2026
in(field="#windows.EventID", values=[4769,4768])
| TicketEnc := coalesce([windows.EventData.TicketEncryptionType])
| SessionKeyEnc := coalesce([windows.EventData.SessionKeyEncryptionType])
| case {
This query identifies users, service accounts, and systems that are still using RC4-based Kerberos encryption. It analyzes authentication events to detect RC4 usage in both ticket encryption and session keys, enabling the identification of dependencies on outdated cryptographic protocols. The results help to proactively locate affected accounts and systems that may experience issues after the RC4 deactivation, supporting remediation and migration to secure encryption standards such as AES.
@sebastian · 24.7.2026