CCFH-202BDemo

CrowdStrike Falcon custom dashboards can display Advanced Event Search output by creating a customized dashboard widget from the search query. A saved search, scheduled search, or scheduled workflow serves a different purpose and does not directly add the query results to a dashboard.

The NewScheduledTaskRegistered event identifies the registration of a new scheduled task, and UserName="Doris" restricts the results to tasks registered by Doris.

An IIS worker process spawning PowerShell and command-shell utilities such as whoami and net1 indicates likely post-compromise discovery activity. These commands are commonly used to enumerate the current user context and network or domain information from a compromised web server.

In CrowdStrike Falcon LogScale, a search query can be saved as a dashboard widget, preserving the query and its visualization for dashboard use. Scheduled searches and correlation rules are separate automation and detection mechanisms, not widget-creation methods.

Reviewing ScriptControl events provides the script content needed to assess its commands, behavior, and indicators of malicious activity. This is the appropriate initial triage step before containment or remediation actions.

Endpoint investigation telemetry can be used to identify patient zero and trace the earliest initial-infection activity, establishing the technical source and propagation path of a ransomware incident.

test(executionCount < 10) applies the threshold that identifies unusually infrequent execution groups, filtering for counts below 10. In Falcon LogScale, test() evaluates a Boolean expression and filters results when that expression is true.

Contextual investigation should precede containment or automated remediation when potentially suspicious activity may be authorized. Reviewing events approximately 10 minutes before and after execution can reveal the script’s download, execution, follow-on behavior, and related user activity; confirming with the IT user establishes whether the activity was authorized testing.

net user ... /add /domain creates a domain account. MITRE ATT&CK classifies this as Create Account: Domain Account (T1136.002), a Persistence tactic because the new account can maintain ongoing access to the domain.

The join() function combines two LogScale searches by matching values in specified fields or keys. It is used when both queries have a common value that can serve as the join key.

Scheduled tasks can execute a program at startup or on a recurring schedule, enabling an adversary to maintain access over time. MITRE ATT&CK maps Scheduled Task/Job to the Persistence tactic.

TargetProcessId identifies the spawning process, while the spawned process records that process as its context. Thus, a child process’s ContextProcessId matches the parent process’s TargetProcessId. CrowdStrike’s process-correlation examples join ContextProcessId to TargetProcessId to relate activity to its responsible process.

For ProcessRollup2 telemetry, FileName is the executable filename field. Filtering it for EXCEL.EXE identifies process execution records for that executable. ImageFileName can contain a full path, and CommandLine is invocation text rather than a dependable executable-name field.

A SyntheticProcessRollup2 event represents process information synthesized for a process that began before the sensor was running, allowing the sensor to report context for that already-existing process.

PsExec is commonly used for legitimate remote administration but can also be abused for lateral movement. Confirming whether the commands came from an authorized administrator performing known, approved activity distinguishes legitimate use from potentially malicious behavior.

Process-tree analysis identifies the execution lineage of cmd.exe, including its immediate and ancestral parent processes. That lineage can expose the exploit-triggered process, script, service, or other suspicious launcher that initiated reconnaissance commands, distinguishing exploitation-driven activity from normal administrative use. Microsoft Defender investigation guidance supports reviewing process trees to understand suspicious process behavior.

The Global connection heat map report visualizes Falcon-host connections by geographic location, enabling investigation of hosts that communicate with an unexpected country.

Updating a vulnerable driver to a current, non-vulnerable version removes the underlying component that can be exploited. Detection exclusions, machine-learning exclusions, and sensor-visibility exclusions may reduce alerts or telemetry, but they do not remediate the vulnerable driver or its associated risk.

The earliest encryption event identifies the first known affected system, providing the starting point for tracing preceding activity and determining the infection source. A timeline of encryption activity in Advanced Event Search is therefore the appropriate initial investigation step.

A Process Timeline search requires the target process ID to identify the process whose related events should be returned. The host’s AID is also required, but it is not one of the available choices.

The select() function retains specified fields from each event without aggregating them, making it suitable for exporting a few fields from a very large event set to CSV.

The timezone parameter specifies the target time zone used to format a Unix timestamp, such as a Central European time zone. The unit parameter only controls whether the input value is interpreted as seconds or milliseconds since the Unix epoch.

The command performs a single ping to google.com, capturing the result through a temporary batch file and an administrative C$ share, then deletes the batch file. This is consistent with Impacket-style remote command execution and is used to test network connectivity for reconnaissance. MITRE ATT&CK documents both Impacket smbexec.py use with C$ shares and ping-based connectivity checks as reconnaissance.

groupBy(UserName, function=(count(aid, as=totalLogons))) creates a per-user aggregate count named totalLogons, and test(totalLogons > 25) filters those aggregate results to users whose count exceeds 25. LogScale supports count(as=...) to name aggregate output fields and test() to compare and filter field values.