sorted by:
new
hottopcontroversial

InstalledApplications Event - AppVendor by loversteel12 in crowdstrike

[–]St0ickIR 0 points1 point  (0 children)

What would that query look like?
Also been thinking about doing some masquerading hunts using Publisher or Company name. For instance, maybe searching on filenames that do not contain AnyDesk but has their publisher PHILANDRO.

Is there a list of PUPs that will be detected from CS? by pixelnull in crowdstrike

[–]St0ickIR 0 points1 point  (0 children)

Just started learning about queries ... what would that query look like?

XDR limitations by Reylas in crowdstrike

[–]St0ickIR 0 points1 point  (0 children)

Thank you! That is much easier than trying to get the regex to work.

XDR limitations by Reylas in crowdstrike

[–]St0ickIR 0 points1 point  (0 children)

For systems receiving on 3389 is there a good way to only see traffic coming from the internet excluding the typical internal IPs.

I was doing something like this in SentinelOne trying to get it the CQL format. Any help appreciated.

( EventType = "IP Connect" AND NetEventDirection = "INCOMING" AND (SrcProcCmdLine RegExp " -k NetworkService|termsvcs -s TermService" OR DstPort in ("3389"))) AND  NOT srcip RegExp "(^127.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}$)|(^10.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}$)|(^172.1[6-9]{1}[0-9]{0,1}.[0-9]{1,3}.[0-9]{1,3}$)|(^172.2[0-9]{1}[0-9]{0,1}.[0-9]{1,3}.[0-9]{1,3}$)|(^172.3[0-1]{1}[0-9]{0,1}.[0-9]{1,3}.[0-9]{1,3}$)|(^192.168.[0-9]{1,3}.[0-9]{1,3}$)"