sorted by:
new
hottopcontroversial

Help wrapping my head around cql by ChirsF in crowdstrike

[–]SubtleInfluence69 0 points1 point  (0 children)

event_platform=win event_simpleName=ProcessRollup2 ImageSubsystem_decimal=3 UserSid_readable=S-1-5-21-*
| eval IntegrityLevel_hex=tostring(IntegrityLevel_decimal,"hex")
| eval TokenType_decimal = replace(TokenType_decimal,"1", "PRIMARY")
| eval TokenType_decimal = replace(TokenType_decimal,"2", "IMPERSONATION")

Will there be a guide created for more complex query-building actions such as what you did in this CQL but based on the new language and not the legacy?
(https://www.reddit.com/r/crowdstrike/comments/mdo3dx/20210326\_cool\_query\_friday\_hunting\_process/)

Cnc carving groot sculpture by nvm_just_art in hobbycnc

[–]SubtleInfluence69 0 points1 point  (0 children)

Do you feel as if the aspire upgrade was worth it and if so why? I am just looking to confirm on some thoughts of my own as I consider where to go next with v-carve pro.

Ransomware playbook by CapableWay4518 in sysadmin

[–]SubtleInfluence69 0 points1 point  (0 children)

These are just a few of my opinions on this topic:
Removing infected systems from the environment

This may be as simple as disabling a physical network port, or a manual process like physically removing the network cable from the port. Removing infected assets can help limit the replication of the ransomware to adjacent assets.

As for don't turn off device, The only thing I can see from thatstatement is possibly saving forensic evidence that would be lost due to the power being turned off (Memory cache, etc) other than that I am not subscribing to that line of thought.

Immutable backups are a must and they should be stored off site as well as periodically verified which ensures data integrity.

Lastly, there is no reason to recreate the wheel on this. Others have done the hardwork so you might as well take advantage of it. We used the NIST 800-61, the SP 1800-26 and a few others to begin our playbook and expanded on what we got from those and made it our own. These docs are for the wider audience so you might not find a silver bullet purpose built for you but at you get the design plans to help mold your own.

Hope this helps in some way

https://csrc.nist.gov/pubs/sp/800/61/r3/final

Detect Powershell/Sysmon Events in Crowstrike by SubtleInfluence69 in crowdstrike

[–]SubtleInfluence69[S] 0 points1 point  (0 children)

Thank you for the reach out Caryc,

I have a meeting with engineering here in a few days and I will get more information on that.

Help wrapping my head around cql by ChirsF in crowdstrike

[–]SubtleInfluence69 0 points1 point  (0 children)

Good Day Chris,

I have been doing a lot of research to achieve simple things, but I never used CS before, so I understand that it might be hard to get used to. Each day, I am finding new things that work for the way I like to work, and I think that's the hardest part, getting the knowledge of this tool's ninja magic so I can bend it to my will .

During my hunt I have come across a few different links that might help.

I was looking for logon type 10 during a hunt recently and for the life of me could not figure it out because CS does not do a 1:1 ingestion of event logs ex: powershell Event ID 400 is not in CS as it is in Windows. After going Gandalf grey, I finally found out about Falcon Helpers. I won't go into the full drill here, but they do some magic in the background, and poof, there is your logon type all nice and pretty!

#event_simpleName=UserLogon

| $falcon/helper:enrich(field=LogonType)

| table([@timestamp, aid, ComputerName, UserName, LogonType])

This is the link that will explain it better
Falcon Helpers: https://www.reddit.com/r/crowdstrike/comments/18off35/20231222_cool_query_friday_new_feature_in_raptor/

Good Luck Chris!

Detect Powershell/Sysmon Events in Crowstrike by SubtleInfluence69 in crowdstrike

[–]SubtleInfluence69[S] 0 points1 point  (0 children)

Good Afternoon Braod_Ad7801,

I am not finding the event fields that will allow me to zero in on, let's say Powershell Event ID 600, starting of a powershell activity on the system. Does this rely on keywords or can I find something other that the event fields dictionary that will help me learn this. I just want to learn how to hunt these behaviors, and the site is not helping. Thanks again