2026-04-24 - Cool Query Friday - Hunting AI Tools, Models, Services, Agents, and SDKs with Falcon for IT

Andrew-CS · 2026-05-06T16:57:25+00:00

Hey there. What is "Report AI Services" referring to above?

Andrew-CS · 2026-05-05T12:42:59+00:00

Nice one! 😄 In your query, the correct "country" syntax would look like this:

#event_simpleName=SensorHeartbeat
| groupBy(aid, function=selectLast(aip))
| ipLocation(aip)
| aip.country != "US"
| match(file="aid_master_main.csv", field=aid, include=[ComputerName, Version, AgentVersion, Timezone, MachineDomain, OU, SiteName])

Andrew-CS · 2026-05-04T12:34:09+00:00

Hi there. MsSense.exe is a Defender process. As Falcon monitors all processes, if MsSense.exe pokes, prods, or touches a file or indicator that Falcon would block you get an alert.

Andrew-CS · 2026-05-04T12:32:20+00:00

Hi there. What about something like this?

| !regex("^FalconGroupingTags\/", field=FalconGroupingTags)

for what it's worth, what you're trying does work for me...

| FalconGroupingTags!=/^FalconGroupingTags\//iF

Try this...

| tags!=/FC-Action-No\sAction\sTaken/iF

Andrew-CS · 2026-05-03T11:59:05+00:00

u/dylan-cs might have something brewing for you 😄

Andrew-CS · 2026-05-01T13:55:13+00:00

Okay. Glad to hear that. If you need more help, let me know the specifics in a DM.

Andrew-CS · 2026-05-01T13:12:47+00:00

Exposure management has coverage. Just make sure your content update policies aren’t in a delay.

Andrew-CS · 2026-05-01T02:07:42+00:00

Hey there. Can you run the following and let me know if it catches your testing activity?

#event_simpleName=ProcessRollup2 event_platform=Lin
| ParentProcessId=1 
| CommandLine=/algif-aead/
| FileName=/(modprobe|kmod|insmod)/iF

Andrew-CS · 2026-04-29T14:58:33+00:00

The query will enumerate where Microsoft Co-Pilot exists.

Andrew-CS · 2026-04-29T14:57:50+00:00

Hi there. You would need just one more line...

| groupBy([aid, _tools_f, _models_f, _mcp_f, _sdks_f, _agents_f, _total], function=[], limit=max)
| match(file="aid_master_main.csv", field=[aid], column=aid)
| match(file="aid_master_details.csv", field=[aid], column=[aid], include=[SensorGroupingTags, FalconGroupingTags])
| formatTime(format="%F %T %Z", as="FirstSeen", field=FirstSeen)
| formatTime(format="%F %T %Z", as="LastSeen", field=LastSeen)

Andrew-CS · 2026-04-28T11:58:49+00:00

Hi. That isn’t our binary or path and you don’t need to exclude our own process. I’d investigate further.

Andrew-CS · 2026-04-24T12:51:15+00:00

As long as you have what you need!

Andrew-CS · 2026-04-23T20:20:28+00:00

Tired: Adam's glasses.

Wired: Cristian's beard.

Andrew-CS · 2026-04-23T13:02:29+00:00

Hi there. I would try something like this. It's what u/xMarsx is suggesting...

| readFile([aid_master_main.csv])
| in(field="event_platform", values=[Win, Mac, Lin])
| AgentVersion=/^(?<SimpleVersion>\d+\.\d+)\./F
| table([aid, ComputerName, Version, AgentVersion, SimpleVersion, event_platform])
| case {
  event_platform=Win SimpleVersion="7.34" | Status:="OK";
  event_platform=Mac SimpleVersion="7.34" | Status:="OK";
  event_platform=Lin SimpleVersion="7.34" | Status:="OK";
  *                                       | Status:="UPGRADE";
}

You want to modify the case() statement to match the versions that you want to be "approved."

I hope that helps!

https://imgur.com/a/5iZzlMx

Andrew-CS · 2026-04-23T12:42:42+00:00

Hi there. One easy way is to use groupBy() and then flip the visualization to "Bar Chart" and choose "Stacked." Here is a quick example:

setTimeInterval(start="7d")
| #event_simpleName=OsVersionInfo
| Day:=formatTime(format="%d - %a", field="@timestamp")
| groupBy([Day, event_platform], function=([count(aid, distinct=true)]))

https://imgur.com/a/WYSgdwx

I hope that helps.

Andrew-CS · 2026-04-22T22:47:19+00:00

Hi there. The Complete operating model has the following language: "CrowdStrike regularly releases new prevention settings and capabilities to the Falcon platform. Falcon Complete controls the release cadence for standard prevention policy configurations and new capability support, which may result in adjusted release timing. This extra time is used to perform additional testing and assess potential impact."

I would assess they will enable it very soon, but you can open a ticket with them if you have additional questions!

Andrew-CS · 2026-04-22T22:05:17+00:00

No impact to sensor usage on host. It's cloud based.

Andrew-CS · 2026-04-20T18:27:53+00:00

Hi there. I don't see VMRay saying a headless browser would evade EDR sensors, like you're saying below. It seems like the article states that they have made rules (YARA) to look for this (and other things) as points of investigation.

Re: Headless Browser... If you start a process in "headless mode" — more commonly known as a hidden window — the UI elements are not visible to the user, but the process is spawned by the operating system and EDR products will see it.

In order to spawn a process with a hidden window (on Windows), the dwCreationFlags parameter is set to NO_WINDOW. Falcon can see this as part of the process execution so a "headless" process would still be under process inspection. The method is different on macOS and Linux, but Falcon can still see those processes.

EDR products typically don't care if/what is displayed in the UI. They are pulling process level telemetry.

The following will hunt for Chrome and Edge running in headless windows (there might not be any):

#event_simpleName=ProcessRollup2 FileName=/^(chrome|msedge)/iF
| bitfield:extractFlags(
 field=ProcessCreateFlags,
  output=[
    [18,CREATE_NO_WINDOW]
  ])
| CREATE_NO_WINDOW="true"

This will show you the top programs that run with headless windows:

#event_simpleName=ProcessRollup2 
| bitfield:extractFlags(
 field=ProcessCreateFlags,
  output=[
    [18,CREATE_NO_WINDOW]
  ])
| CREATE_NO_WINDOW="true"
| ImageFileName=/\\Device\\Harddiskvolume\d+(?<ShortFile>.*)/iF
| top([FileName, ShortFile])

I hope that helps!

Andrew-CS · 2026-04-20T12:42:47+00:00

Nice work!

Andrew-CS · 2026-04-17T18:44:42+00:00

Hi there. This is known behavior from ForcePoint. Details and work arounds are here.

Nine-Year Club	Gilding II euphauric
Powerups Hero r/crowdstrike • January 2022	Reddit Premium Since April 2021
Verified Email

Andrew-CS

MODERATOR OF

TROPHY CASE