CQL Knowledge Base
Ready-to-use CQL queries for threat hunting, detection, and SOC triage. Copy, filter, and search in seconds.
PowerShell LOTL with Base64-Encoded Payload (-EncodedCommand)
Detects PowerShell executions using the -EncodedCommand parameter to conceal the actual payload, a primary LOTL technique documented by CISA where adversaries abuse native PowerShell to evade signature-based detection. Critical for detecting post-initial infection stages in ransomware and APT campaigns that prefer LOTL over custom binaries.
Linux Sudo Privilege Escalation Pattern - CVE-2025-32463
Detects suspicious sudo binary invocations originating from command interpreters or network tools with privilege escalation flags. Covers the CVE-2025-32463 (CVSS 7.8) pattern that allows unauthorized escalation to root on Linux by manipulating the sudo command from illegitimate parent processes.
WinRAR/7-Zip Archive Exploitation - Child Executable Detection
Detects execution of binaries or scripts originating from archive tools (WinRAR, 7-Zip, unrar) outside legitimate system paths. Covers the pattern of active 2025 archive vulnerabilities similar to CVE-2023-38831 that allow code execution when interacting with socially-engineered manipulated compressed files.
WMIC Discovery Chain - APT3 TTP Reconnaissance Detection
Detects wmic.exe usage for reconnaissance queries following documented APT3 TTPs: enumeration of processes, accounts, services, installed products, network shares, and patches. Characteristic pattern of hands-on-keyboard operators identified in CrowdStrike IR investigations.
Basic Reconnaissance with Native Windows Tools
Detects execution of common Windows reconnaissance commands such as whoami, ipconfig, net user, and systeminfo, frequently used in the initial phase of a Living Off the Land (LOTL) attack
Windows Executables Making Suspicious Outbound Connections
Basic query to detect Windows executables located in temporary or download directories establishing outbound network connections, useful for identifying newly downloaded malware contacting command and control servers
Compromised Identity with Rapid Lateral Movement
Detects suspicious authentication patterns where an account authenticates remotely to multiple hosts in a short time window, indicative of a compromised identity used for lateral movement as observed in CrowdStrike hands-on-keyboard IR scenarios
Lateral Movement Post-Firewall Compromise — Interlock Ransomware Pattern
Detects remote execution of administration tools after perimeter device compromise, consistent with Interlock ransomware TTPs that exploit enterprise firewalls as an initial access vector as documented by Amazon threat intelligence
Deno Runtime-Based Loader — LeakNet Ransomware Indicator
Detects execution of the Deno runtime on corporate endpoints, a technique adopted by the LeakNet ransomware group as a malicious loader after initial access via ClickFix — a legitimate JavaScript runtime rarely present in enterprise environments
Suspicious Access to Linux Shadow File
Detects read attempts against the /etc/shadow file on Linux systems, a technique used by attackers to extract password hashes and perform offline cracking after gaining initial access to the system
Linux Privilege Escalation via Suspicious Sudo Execution
Detects suspicious sudo execution patterns on Linux systems that may indicate exploitation of CVE-2025-32463 (CVSS 7.8) or sudoers misconfigurations, including interactive shell spawning and interpreter execution as root
LOLBAS Remote Download Cradle Execution Chain
Detects native Windows binaries (certutil, bitsadmin, mshta, regsvr32, cmstp) used with arguments indicative of remote download and execution, a key Living Off the Land technique documented in the LOLBAS project for bypassing security controls
Living-off-the-Land Persistence via Suspicious Scheduled Task Creation
Identifies scheduled task creation via schtasks.exe with suspicious parameters such as encoded execution, temporary path references, or remote download, a LOTL technique documented in The Hacker Recipes for maintaining post-exploitation persistence
Keitaro Malvertising — Browser Spawning Encoded PowerShell
Detects execution chains where a web browser spawns PowerShell processes with Base64-encoded commands, a pattern associated with malvertising campaigns such as Keitaro that distribute malware through malicious ads and phishing pages
React2Shell CVE-2025-55182 — Node.js Process Spawning System Shell
Detects exploitation of CVE-2025-55182 in React Server Components by monitoring Node.js processes that spawn system command interpreters, indicative of remote code execution via malicious deserialization in the Flight protocol
Windows Token Impersonation Tool Detection
Detects execution of Potato family tools and other Windows token impersonation utilities used to escalate privileges to SYSTEM via named pipe abuse and COM service exploitation
APT3-Style Remote Execution Pattern via cmd.exe
Detects cmd.exe with the /C parameter executing discovery commands typical of the APT3 profile (whoami, net user, systeminfo, nltest) when the parent process is unusual, indicating possible remote execution or lateral movement via command shell (T1059.003) as documented in APT3 TTP analysis
Basic Windows Net Command Enumeration
Detects use of the net.exe command to enumerate users, groups, and shared resources, one of the most abused native Windows tools in Living-off-the-Land attacks according to multiple CISA and CrowdStrike reports
Basic PowerShell Encoded Command Detection
Query for junior SOC analysts that detects PowerShell executions with the -EncodedCommand flag, a common LotL technique for obfuscating malicious commands and evading plaintext signature-based detections
Basic whoami.exe Execution Monitor
Simple query to detect any whoami.exe execution on endpoints, a tool frequently used as the first command by attackers after gaining initial access to verify user context and privileges, referenced in multiple APT profiles including APT3 and APT28