LogScale · CQL

CQL Knowledge Base

Ready-to-use CQL queries for threat hunting, detection, and SOC triage. Copy, filter, and search in seconds.

151 queries8 categories
Powered bySofistic·created bydarkreitor
K
20 queries
NEW
PAID

APT Lateral Movement via Remote Administrative Protocols

Detects APT lateral movement using remote administration protocols (SMB, WMI, WinRM) initiated from command-line tools on end-user hosts. Correlates administrative processes with outbound connections to management ports.

#repo="base_sensor" event_simpleName=NetworkConnectIP4
| RemotePort in [135, 139, 445, 5985, 5986, 47001]
| FileName in ["wmic.exe", "powershell.exe", "cmd.exe", "sc.exe", "net.exe", "net1.exe", "wbemtest.exe", "mmc.exe"]
EDRaptlateral-movement
Advanced
NEW
PAID

APT Chained WMIC Reconnaissance Detection

Detects suspicious chained use of wmic.exe by APT actors for system reconnaissance: hardware inventory, user accounts, running processes, and network config. Filters legitimate parents like WmiPrvSE and msiexec to reduce false positives.

#repo="base_sensor" event_simpleName=ProcessRollup2
| FileName="wmic.exe"
| CommandLine=/(shadowcopy|process\s+call\s+create|useraccount\s+get|group\s+get|startup\s+get|nicconfig|product\s+get|bios\s+get|os\s+get|computersystem\s+get)/i
Threat Huntingaptwmic
Advanced
NEW
PAID

Archive Tool Spawning Shell Processes (Compressed File Exploitation)

Detects shell or LOLBin processes directly spawned by archiving utilities like WinRAR or 7-Zip, behavior associated with code execution via malicious archives similar to WinRAR CVE-2023-38831.

#repo="base_sensor" event_simpleName=ProcessRollup2
| ParentBaseFileName = /^(WinRAR\.exe|7z\.exe|7zG\.exe|7zFM\.exe|PeaZip\.exe|WinZip32\.exe|WinZip64\.exe)$/i
| FileName = /^(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe)$/i
Malwarewinrararchive
Intermediate
NEW
PAID

Credential Spray and Authentication Bypass on Network Logon

Detects credential spraying attacks and potential authentication bypass attempts exploiting incomplete access control implementations. Identifies high-frequency network logons from the same source IP and classifies by risk level.

#repo="base_sensor" event_simpleName=UserLogon
| LogonType in [3, 10]
| UserName!=""
Identitycredential-sprayauthentication-bypass
Intermediate
NEW
PAID

AWS IAM Abuse for Establishing Persistence

Detects AWS IAM operations indicative of APT persistence: user creation, administrative policy attachment, access key generation, role creation, and trust policy modification. Designed for environments with Falcon Cloud Security integrated.

#repo="base_sensor" event_simpleName=CloudAuditEvent
| CloudProvider="AWS"
| ApiName in ["CreateUser", "AttachUserPolicy", "CreateAccessKey", "PutUserPolicy", "CreateRole", "AttachRolePolicy", "AddUserToGroup", "CreateLoginProfile", "UpdateAssumeRolePolicy"]
Cloudawsiam
Advanced
NEW
FREE

Web Browser Spawning a Command Interpreter Process

Detects when a web browser process directly spawns a command interpreter or scripting engine. Highly anomalous behavior associated with browser exploitation, advanced social engineering, or drive-by download attacks.

#repo="base_sensor" event_simpleName=ProcessRollup2
| ParentBaseFileName = /^(chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe|opera\.exe|brave\.exe|MicrosoftEdge\.exe)$/i
| FileName = /^(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe)$/i
EDRbrowsercmd
Beginner
NEW
PAID

CMD Shell Reconnaissance Commands APT-3 Style

Detects cmd.exe executions with system enumeration commands associated with APT-3 group, including whoami, net user, ipconfig, systeminfo, and nltest for domain trust reconnaissance.

#repo="base_sensor" event_simpleName=ProcessRollup2
| FileName = /^cmd\.exe$/i
| CommandLine = /(?i)(whoami|net user|net group|net localgroup|ipconfig|systeminfo|tasklist|netstat|nltest)/
EDRapt3cmd
Intermediate
NEW
PAID

Linux GTFOBins Abuse for Privilege Escalation

Detects abuse of native Linux binaries listed in GTFOBins to escape restricted environments, read sensitive system files, or spawn elevated shells. Covers LOTL techniques actively used by threat actors in Linux and macOS environments.

#repo="base_sensor" event_simpleName=ProcessRollup2
| FileName in ["find", "perl", "python3", "python", "awk", "tee", "nmap", "vim", "curl", "wget", "ruby", "lua", "less", "man"]
| CommandLine=/(--exec\s+\/bin\/|NOPASSWD|\/etc\/sudoers|setuid|\/bin\/bash\s+-p|os\.execl|subprocess|system\(|exec\s+\/bin\/sh|\/etc\/passwd|\/etc\/shadow)/i
Threat Huntinglotlgtfobins
Intermediate
NEW
PAID

Shell Process Spawned by Node.js (Potential React2Shell Exploitation)

Detects shell or scripting processes spawned by Node.js, a potential indicator of CVE-2025-55182 (React2Shell) exploitation — an insecure deserialization vulnerability in the React Server Components Flight protocol enabling remote code execution.

#repo="base_sensor" event_simpleName=ProcessRollup2
| ParentBaseFileName = /^node(\.exe)?$/i
| FileName = /^(cmd\.exe|powershell\.exe|sh|bash|python(\.exe|3)?)$/i
Malwarenodejsreact
Advanced
NEW
FREE

PowerShell Remote Download Cradle Detection

Identifies PowerShell executions containing typical remote download patterns (IEX, Net.WebClient, BitsTransfer), techniques used in early APT compromise stages to download and execute in-memory payloads without touching disk.

#repo="base_sensor" event_simpleName=ProcessRollup2
| FileName = /^powershell(\.exe)?$/i
| CommandLine = /(?i)(IEX|Invoke-Expression|New-Object Net\.WebClient|DownloadString|DownloadFile|WebRequest|Start-BitsTransfer|Invoke-WebRequest)/
EDRpowershelldownload-cradle
Beginner
NEW
FREE

Basic Detection: Child Processes Spawned by WMI Provider Host

Basic query to detect any process spawned by WmiPrvSE.exe. Unexpected child process generation from the WMI Provider Host may indicate remote command execution or persistence. Ideal for SOC analysts starting with threat hunting in CrowdStrike Falcon.

#repo="base_sensor" event_simpleName=ProcessRollup2
| ParentBaseFileName="WmiPrvSE.exe"
| FileName!="WmiPrvSE.exe"
EDRwmiprocess-creation
Beginner
NEW
PAID

WMIC Abuse via Non-Standard Parent Process (APT-Style)

Detects WMIC.exe executions spawned by unusual parent processes matching APT reconnaissance and lateral movement techniques. Excludes legitimate management tools and classifies risk by frequency.

#repo="base_sensor" event_simpleName=ProcessRollup2
| FileName = /^wmic\.exe$/i
| CommandLine = /(?i)(process call create|useraccount (list|get)|computersystem get|os get caption|nicconfig list)/
Threat Huntingwmicapt
Advanced
NEW
PAID

Impossible Travel Detection via RDP Logon Sequences

Detects impossible travel by analyzing consecutive RDP logons from the same user across different countries using neighbor() to compare adjacent events in time.

// ──────────────────────────────────────────────────────────
// Stage 1: Get RDP logon events with external source IPs
// LogonType=10 = RemoteInteractive (RDP)
Identityimpossible-travelrdp
Advanced
NEW
PAID

Lateral Movement Scoring via SMB + Process Correlation

Detects lateral movement by correlating outbound SMB connections with remote process execution on the destination host, assigning a composite risk score per behavior.

// ──────────────────────────────────────────────────────────
// Stage 1: Find hosts making outbound SMB connections (port 445)
// to non-RFC1918 targets OR internal hosts they've never connected to before
EDRlateral-movementsmb
Advanced
NEW
PAID

Process Injection Chain Detection with Risk Scoring

Identifies process injection chains by correlating CreateRemoteThread, WriteProcessMemory, and post-injection behavior using correlate() to link the 3-step sequence.

// ──────────────────────────────────────────────────────────
// APPROACH: Use correlate() to link a 3-step injection sequence:
//   1. Suspicious process spawns (known injection parents)
EDRprocess-injectiondefense-evasion
Advanced
NEW
PAID

APT 3 - Multi-Tool Discovery via CMD Shell (T1059.003)

Detects multiple native Windows discovery tools launched from cmd.exe by the same user on the same host. Characteristic pattern of APT 3 (Gothic Panda) using Windows Command Shell (T1059.003) to run commands like whoami, ipconfig, and systeminfo during initial compromise phases.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)(whoami\.exe|ipconfig\.exe|net\.exe|systeminfo\.exe|hostname\.exe|nltest\.exe|nslookup\.exe|arp\.exe|tasklist\.exe)$/
| ParentBaseFileName=/(?i)cmd\.exe$/
Threat Huntingapt3cmd-shell
Intermediate
NEW
PAID

Browser Engine Exploit Indicator — Suspicious Shell Spawned from Browser Process

Detects when a web browser process (Chrome, Edge, Firefox) directly spawns a command interpreter or LOLBin, anomalous behavior that may indicate exploitation of critical browser engine vulnerabilities such as type-confusion V8 zero-days

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)(chrome\.exe|msedge\.exe|brave\.exe|opera\.exe|firefox\.exe)$/
| FileName=/(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe)$/
Vulnerabilitybrowser-exploitchrome
Advanced
NEW
PAID

Shell Spawned from Browser Renderer Process - CVE-2025-10585 Pattern

Detects shell or scripting processes spawned as children of popular browsers (Chrome, Edge, Firefox, Brave), a pattern associated with JavaScript engine type confusion exploits like CVE-2025-10585 (Chrome V8 zero-day). A compromised renderer can escape the browser sandbox and execute arbitrary OS commands.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)(chrome\.exe|msedge\.exe|firefox\.exe|brave\.exe|chromium\.exe)$/
| FileName=/(?i)(cmd\.exe|powershell\.exe|mshta\.exe|wscript\.exe|cscript\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe)$/
EDRbrowser-exploitv8
Intermediate
NEW
PAID

Corporate Endpoint FTP and SMTP Data Exfiltration Detection

Identifies outbound connections to FTP (21, 990) and SMTP (25, 465, 587) ports from endpoints to external public IPs, indicative of possible data exfiltration using unauthorized file transfer or email protocols outside security policy

#repo="base_sensor" #event_simpleName=NetworkConnectIP4
| (RemotePort=21 OR RemotePort=25 OR RemotePort=587 OR RemotePort=465 OR RemotePort=990)
| not RemoteAddressIP4=/^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/
Networkexfiltrationftp
Intermediate
NEW
PAID

Suspicious IIS Child Process - Possible ViewState Deserialization Exploitation

Detects shell or scripting processes spawned as direct children of w3wp.exe or iisexpress.exe, a high-fidelity indicator of deserialization vulnerability exploitation such as CVE-2025-53690 in Sitecore. This pattern occurs when an attacker exploits .NET ViewState to achieve remote code execution on IIS servers and runs OS commands.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)(w3wp\.exe|iisexpress\.exe)$/
| FileName=/(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|certutil\.exe|bitsadmin\.exe|regsvr32\.exe|rundll32\.exe)$/
Malwareiiswebshell
Advanced