GitHub - DoubtfulTurnip/falcon-queries: CrowdStrike Falcon hunting queries for threat detection and incident response

Name		Name	Last commit message	Last commit date
Latest commit History 15 Commits
Audit Linux SSH Connections		Audit Linux SSH Connections
Check for NMAP in Command Line		Check for NMAP in Command Line
Command History Hunt		Command History Hunt
Command creating file in Temp		Command creating file in Temp
Detect In-Memory .Net Assembly Modules Loaded from C2 Frameworks such as SilverC2, Metasploit		Detect In-Memory .Net Assembly Modules Loaded from C2 Frameworks such as SilverC2, Metasploit
Detect RDP Default Port Change		Detect RDP Default Port Change
Detect Renamed Executable - Masquerading		Detect Renamed Executable - Masquerading
Detect the persistent activities in Registry Run Key		Detect the persistent activities in Registry Run Key
Hunting pwnkit Local Privilege Escalation in Linux (CVE-2021-4034)		Hunting pwnkit Local Privilege Escalation in Linux (CVE-2021-4034)
LOLBas Query		LOLBas Query
Look for Processes and Users Starting Powershell		Look for Processes and Users Starting Powershell
Rare PowerShell Commands		Rare PowerShell Commands
Suspicious PowerShell Process, Spawned from Explorer, with Network Connections		Suspicious PowerShell Process, Spawned from Explorer, with Network Connections
Unusual Executions from Productivity Apps		Unusual Executions from Productivity Apps

Folders and files