Lightkun Yagami
@lightkun_CrowdStrikerCompletionist
2 followers0 downloads291 copies2 likes2,688 views
11 detections
Filters
Last updated
All Time
Detection languages
11
Categories
1
1
Platforms
9
1
1
Products / Services
11
CVEs
1
1
1
1
1
IDS Protocols
1
Use this query if you don't have the Falcon Spotlight in your CrowdStrike subscription. Use this to identify any PHP running in your environment. We used this to quickly identify hosts running PHP.
This query provides high-fidelity, post-exploitation hunting for CVE-2026-69730 by catching unauthorized child processes spawned from the Windows DNS Server engine (dns.exe).
Because dns.exe runs natively as NT AUTHORITY\SYSTEM and almost never executes external binaries during normal operations, filtering out known OS noise (conhost.exe and werfault.exe) flags potential RCE breakouts and privilege escalation with near-zero false positives.
Because dns.exe runs natively as NT AUTHORITY\SYSTEM and almost never executes external binaries during normal operations, filtering out known OS noise (conhost.exe and werfault.exe) flags potential RCE breakouts and privilege escalation with near-zero false positives.
This is about the article "Attacking SAM and Extracting Hashes With 7z" from Hackers Arise: https://hackers-arise.com/digital-forensics-attacking-sam-and-extracting-hashes-with-7z/
This query detects instances of 7-Zip executing with elevated administrator privileges on Windows endpoints while filtering out routine background noise. It begins by capturing both live and backfilled process creation telemetry (ProcessRollup2 and SyntheticProcessRollup2) and uses a case-insensitive regular expression to identify any standard 7-Zip executable, including the command-line, GUI, and file manager binaries (7z.exe, 7za.exe, 7zg.exe, or 7zFM.exe). To pinpoint administrative activity, it filters exclusively for processes with a high integrity level decimal of 12288, indicating the binary was elevated via UAC ("Run as administrator"). It then reduces false positives by excluding automated service accounts ending in svc, Active Directory machine accounts ending in $, and the built-in SYSTEM identity. Finally, it formats the remaining high-fidelity events into a structured table displaying the timestamp, executable path, username, integrity level, and full command-line arguments for quick triage.
This query detects instances of 7-Zip executing with elevated administrator privileges on Windows endpoints while filtering out routine background noise. It begins by capturing both live and backfilled process creation telemetry (ProcessRollup2 and SyntheticProcessRollup2) and uses a case-insensitive regular expression to identify any standard 7-Zip executable, including the command-line, GUI, and file manager binaries (7z.exe, 7za.exe, 7zg.exe, or 7zFM.exe). To pinpoint administrative activity, it filters exclusively for processes with a high integrity level decimal of 12288, indicating the binary was elevated via UAC ("Run as administrator"). It then reduces false positives by excluding automated service accounts ending in svc, Active Directory machine accounts ending in $, and the built-in SYSTEM identity. Finally, it formats the remaining high-fidelity events into a structured table displaying the timestamp, executable path, username, integrity level, and full command-line arguments for quick triage.
This helps identify legitimate DAEMON Tools binaries - DTHelper.exe, DiscSoftBusServiceLite.exe, or DTShellHlp.exe used as a communication vector to an external domain env-check.daemontools.cc, which sends shell commands to the compromised host.
Cisco Talos observed that attackers used a plugin called Pheno to conduct reconnaissance on the Windows Phone Link App on the victim's PC. IF compromised, Pheno logs the Process IDs and file paths with the filename "phonelink-<COMPUTERNAME>.txt", created in two staging folders:
C:\programdata\Microsoft\feedback\cm
%TEMP%\Microsoft\feedback\cm
C:\programdata\Microsoft\feedback\cm
%TEMP%\Microsoft\feedback\cm
---credit to @KQLWizard---
This rule is a CrowdStrike translation from KQL based on @KQLWizard's detection rule: https://detections.ai/rules/019c5143-2be7-765f-9d0b-4d41499ff6d6
This rule is a CrowdStrike translation from KQL based on @KQLWizard's detection rule: https://detections.ai/rules/019c5143-2be7-765f-9d0b-4d41499ff6d6
This searches for instances of Trivy, and communicates to the attacker controller server using the domain name and IP address.
This is to search for the new Click-Fix variant as published by Atos. See article: https://atos.net/en/lp/cybershield/investigating-a-new-click-fix-variant
IOCs used are from Secureworks CTU TIPS: Despair EDR Killer Used in Ransomware Operations
This is to search for the malicious dll loader, dwmapi.dll and the infostealer dll, inspector.dll. This search is from Microsoft's published article, "Storm-2561 users SEO poisoning to distribute fake VPN clients for credential theft". This will look for the two dll files digitally signed from Taiyuan Lihua Near Information Technology Co., Ltd.
Page 1 of 2