LogScale · CQL

CQL Knowledge Base

$

Ready-to-use CQL queries for threat hunting, detection, and SOC triage. Copy, filter, and search in seconds.

154 queries8 categories
Powered bySofistic·created bydarkreitor
K
20queries
PAID

ALPHV BlackCat Ransomware - Windows Defender Disablement via PowerShell and Registry

Detects PowerShell and service control commands used by ALPHV BlackCat ransomware operators to disable Windows Defender and related AV services before deploying ransomware payload, consistent with pre-encryption TTPs documented in the DOJ BlackCat disruption case where two operators pleaded guilty to targeting multiple U.S. victims

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)(powershell\.exe|reg\.exe|sc\.exe)/
| CommandLine=/(?i)(Set-MpPreference.*-Disable|DisableAntiSpyware|DisableRealtimeMonitoring|DisableBehaviorMonitoring|DisableBlockAtFirstSeen|ForceDefenderPassiveMode|sc\s+config\s+WinDefend\s+start|Set-MpPreference.*ExclusionPath)/
Malwarealphvblackcat
Advanced
PAID

APT Network Discovery Sequence — 5 or More Tools Within 30-Minute Window

Identifies hosts running 5 or more distinct network reconnaissance binaries (ping, nslookup, nltest, arp, route, netstat, ipconfig, tracert) within a 30-minute window. This multi-tool burst pattern is a high-fidelity indicator of hands-on-keyboard APT operators performing internal network mapping after initial compromise, consistent with APT TTPs analyzed in Azeria Labs and CrowdStrike threat intelligence reporting.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)(net\.exe|net1\.exe|ping\.exe|nslookup\.exe|nltest\.exe|arp\.exe|route\.exe|netstat\.exe|ipconfig\.exe|tracert\.exe|nbtstat\.exe)/
| groupBy([ComputerName, UserName], function=[count(as=recon_total), count(FileName, distinct=true, as=unique_tools), collect(FileName, limit=20), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)])
Threat Huntingaptnetwork-discovery
Advanced
PAID

APT3 Multi-Stage Windows Command Shell Reconnaissance Chain

Detects hosts where cmd.exe or PowerShell execute 3 or more inline reconnaissance commands (whoami, hostname, net, systeminfo, nltest) within a session. A high-fidelity hands-on-keyboard indicator attributed to APT3 and similar threat actors documented in CrowdStrike Falcon IR investigations.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)(cmd\.exe|powershell\.exe)/
| CommandLine=/(?i)(\/[cC]\s+(whoami|hostname|ipconfig|net\s+(user|group|localgroup|view)|nltest|systeminfo|tasklist|netstat|arp|nslookup|dsquery|quser))/
Threat Huntingapt3cmd-shell
Advanced
FREE

Browser Spawns Scripting Interpreter — Fake Update Delivery Indicator

Detects when a web browser directly spawns a scripting interpreter such as PowerShell, cmd.exe, or wscript.exe. This execution chain does not occur during normal user activity and is the primary delivery mechanism used by SocGholish and FakeUpdates campaigns distributing ransomware and banking trojans through compromised websites presenting fake browser update prompts.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)(chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe)/
| FileName=/(?i)(powershell\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe)/
EDRfake-updatebrowser-spawn
Beginner
FREE

CMD.exe Inline APT Reconnaissance — Basic Detection

Detects cmd.exe executing common APT reconnaissance commands inline via the /C flag, including whoami, hostname, net user, net group, systeminfo, ipconfig /all, and nltest. A beginner-friendly detection rule aligned with APT3 T1059.003 tradecraft and suitable as a baseline for new analysts building their first Falcon detection queries.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)cmd\.exe/
| CommandLine=/(?i)\/[cC]\s+(whoami|hostname|net\s+(user|group|localgroup)|systeminfo|ipconfig\s*\/all|nltest|quser)/
EDRaptcmd-exe
Beginner
PAID

F5 BIG-IP APM Exploitation - Web Service Process Spawning Interactive Shell

Detects suspicious child process spawning from F5 BIG-IP web service and management plane processes, indicative of active exploitation of CVE-2025-53521 added to CISA KEV, where APM authentication bypass enables remote code execution through web shell deployment or command injection against the BIG-IP management interface

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)(httpd|nginx|tmm|mcpd|restjavad|node)/
| FileName=/(?i)(bash|sh|python3?|perl|curl|wget|nc|ncat|socat|whoami|id|uname|ifconfig)/
Vulnerabilityf5-bigipcve-2025-53521
Intermediate
PAID

Fake Browser Update — Scripting Interpreter Spawned by Browser Process

Detects when Chrome, Firefox, or Edge spawns a scripting interpreter or proxy execution binary, the primary delivery mechanism in SocGholish and FakeUpdates campaigns. These campaigns distribute ransomware and banking malware families including IcedID, Dridex, and Cobalt Strike beacons via compromised or malicious websites serving fake update pages.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)(chrome\.exe|firefox\.exe|msedge\.exe|brave\.exe|opera\.exe)/
| FileName=/(?i)(powershell\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe)/
Malwarefake-browser-updatesocgholish
Intermediate
PAID

IIS w3wp.exe Spawning LOLBins - ViewState Deserialization RCE Detection

Detects IIS Application Pool Worker Process (w3wp.exe) spawning Living-off-the-Land binaries and scripting engines, the primary execution chain for successful ViewState deserialization attacks such as CVE-2025-53690 in Sitecore where exposed ASP.NET machineKey values enable .NET object injection leading to unauthenticated remote code execution on internet-facing web applications

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)(w3wp\.exe)/
| FileName=/(?i)(cmd\.exe|powershell\.exe|certutil\.exe|mshta\.exe|wscript\.exe|cscript\.exe|regsvr32\.exe|rundll32\.exe|msiexec\.exe|bitsadmin\.exe|curl\.exe|wget\.exe)/
Vulnerabilityiisviewstate
Intermediate
PAID

Play Ransomware ESXi Variant - Virtual Machine Shutdown Detection

Detects execution of ESXi-specific management binaries used by the Play ransomware ESXi variant to enumerate and forcibly power off virtual machines before encrypting VMDK files, behavior documented in the CISA StopRansomware advisory on Play ransomware targeting VMware ESXi infrastructure

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)(esxcli|vim-cmd|esxcfg-scsidevs|vmkfstools)/
| CommandLine=/(?i)(vm\s+process\s+kill|vmsvc\/power\.off|vmsvc\/getallvms|storage\s+filesystem\s+list|vmfs\s+volume\s+list)/
Malwareplay-ransomwareesxi
Advanced
PAID

Multi-Stage Ransomware Kill Chain Correlation - Pre-Encryption Activity Clustering

Correlates multiple distinct ransomware preparation behaviors executed by the same user on the same host within a detection window, identifying the combination of VSS deletion, boot recovery disablement, and backup service termination that consistently precedes encryption in ALPHV, Play, LockBit, and Akira ransomware deployments observed in CrowdStrike IR investigations

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)(vssadmin\.exe|bcdedit\.exe|wbadmin\.exe|wmic\.exe|sc\.exe|net\.exe|taskkill\.exe)/
| CommandLine=/(?i)(delete\s+shadows|recoveryenabled\s+no|shadowcopy.*delete|backup\s+delete|bootstatuspolicy\s+ignoreallfailures|stop\s+(vss|swprv|backup|SQLWriter|MSSQLServer|ReportServer)|\/im\s+(sql|backup|veeam|synology))/
Threat Huntingransomwarethreat-hunting
Advanced
PAID

Ransomware Pre-Encryption Stage — Shadow Copy and Recovery Inhibition

Detects execution of commands targeting Volume Shadow Copies and Windows recovery mechanisms, a universal pre-encryption step across virtually all ransomware families. Covers vssadmin delete shadows, wmic shadowcopy delete, bcdedit recoveryenabled no, wbadmin delete catalog, and cipher wipe. Early detection of this stage enables response before file encryption begins.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| CommandLine=/(?i)(vssadmin.{0,60}delete|wmic.{0,60}shadowcopy.{0,30}delete|bcdedit.{0,60}(recoveryenabled.{0,10}no|bootstatuspolicy.{0,20}ignoreallfailures)|wbadmin.{0,60}delete.{0,30}catalog|cipher\s+\/w)/
| groupBy([ComputerName, UserName, FileName, CommandLine], function=[count(as=hit_count)])
Malwareransomwareshadow-copy
Intermediate
FREE

VSS Shadow Copy Deletion - Basic Ransomware Pre-Encryption Indicator

Detects deletion of Windows Volume Shadow Copies via vssadmin.exe or wmic.exe, the most universally performed ransomware preparation step executed by virtually all modern ransomware families including WannaCry, ALPHV, Play, LockBit, and Akira to eliminate local snapshot recovery options before encrypting files — essential beginner detection for any Windows endpoint monitoring program

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)(vssadmin\.exe|wmic\.exe)/
| CommandLine=/(?i)(delete\s+shadows|shadowcopy.*delete)/
EDRshadow-copyvssadmin
Beginner
PAID

WMIC Abuse for APT Reconnaissance and Remote Execution

Detects anomalous wmic.exe usage with high-risk arguments typical of nation-state APT actors: remote process execution via /node:, Shadow Copy deletion, and system/network enumeration. Based on TTPs documented by Intel 471 for APT groups abusing WMI for stealthy operations that evade traditional security controls.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)wmic\.exe/
| CommandLine=/(?i)(process\s+call\s+create|\/node\s*:|shadowcopy\s+delete|os\s+get|nicconfig\s+get|computersystem\s+get|startup\s+list|product\s+get)/
Threat Huntingwmicwmi-abuse
Advanced
PAID

APT3 Reconnaissance Chain via cmd.exe

Detects reconnaissance command execution via cmd.exe with arguments typical of APT3 operators, excluding legitimate OS parent processes. Inspired by the APT3 TTP profile that abuses Windows Command Shell to run whoami, net, ipconfig, and systeminfo on compromised systems.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)cmd\.exe/
| CommandLine=/(?i)\/[cC]\s+(whoami|net\s+(user|group|localgroup)|hostname|ipconfig|systeminfo|tasklist|netstat)/
Threat Huntingapt3cmd-shell
Advanced
FREE

Basic Detection: cmd.exe Executing whoami (APT3 TTP)

Beginner-level query to detect cmd.exe executions invoking whoami — the first technique documented in the public APT3 profile per T1059.003 and T1033. Ideal for SOC analysts new to threat hunting with CQL who want to get familiar with basic Falcon LogScale syntax using FDR process events.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)cmd\.exe/
| CommandLine=/(?i)\/c\s+whoami/
EDRcmdwhoami
Beginner
PAID

Code Execution from Archive Tool (WinRAR/7-Zip Style CVE-2023-38831)

Detects command interpreter and script execution as direct child processes of archive applications. Technique similar to CVE-2023-38831 where user interaction with a malicious file triggers code execution through WinRAR, 7-Zip, or other archive utilities common in corporate environments.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)(winrar\.exe|7zfm\.exe|winzip32\.exe|peazip\.exe|bandizip\.exe)/
| FileName=/(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe)/
Malwarewinrararchive-exploitation
Intermediate
FREE

Archive Tool Shell Spawn - Code Execution via Compressed File

Detects when archive tools (WinRAR, 7-Zip, PeaZip, Bandizip, native Windows extractor) spawn command interpreters or loaders as a direct child process. High-fidelity pattern for detecting active 2025 archive exploitation vulnerabilities that execute hidden payloads when manipulated compressed files are opened.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)^(winrar\.exe|7z\.exe|7zfm\.exe|peazip\.exe|bandizip\.exe|zipfldr\.dll)$/
| FileName=/(?i)^(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe)$/
Malwarewinrararchive
Beginner
PAID

LOLBAS Process Spawned from Web Browser (Keitaro Malvertising)

Detects popular web browsers spawning child processes that are known LOLBAS binaries, a pattern consistent with Keitaro malvertising campaigns that infect users through malicious ads and phishing pages to deliver multi-stage malware. Covers Chrome, Edge, Firefox, Opera, Brave, and Vivaldi with exclusions for internal browser processes.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| ParentBaseFileName=/(?i)(chrome\.exe|msedge\.exe|firefox\.exe|iexplore\.exe|opera\.exe|brave\.exe|vivaldi\.exe)/
| FileName=/(?i)(powershell\.exe|cmd\.exe|wscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe|certutil\.exe|bitsadmin\.exe|csc\.exe|installutil\.exe)/
Malwaremalvertisinglolbas
Advanced
FREE

CMD Discovery Recon - APT3 Basic Enumeration Detection

Detects native Windows enumeration tools invoked from cmd.exe, following the basic reconnaissance pattern documented in the APT3 TTP profile. Covers use of whoami, net, ipconfig, systeminfo, and other LOLBins utilities to map the environment after initial intrusion.

#repo="base_sensor" #event_simpleName=ProcessRollup2
| FileName=/(?i)^(whoami|hostname|ipconfig|systeminfo|net|arp|netstat|tasklist|quser)\.exe$/
| ParentBaseFileName=/(?i)^cmd\.exe$/
Threat Huntingdiscoverycmd
Beginner
PAID

Compromised Identity Multi-Host Lateral Movement via Admin Protocols

Detects potentially compromised identities performing lateral movement by identifying users with connections to multiple distinct hosts via remote administration protocols (SMB, RDP, WinRM, SSH). Inspired by CrowdStrike IR use of Falcon Identity Threat Protection to identify active hands-on-keyboard adversaries abusing valid credentials.

#repo="base_sensor" #event_simpleName=NetworkConnectIP4
| LocalPort=/^(445|3389|5985|5986|22)$/
| NOT RemoteAddressIP4=/^(127\.|169\.254\.)/
Identitylateral-movementidentity
Advanced