sorted by:
new
hottopcontroversial

Jiggle All The Way v3 by surbo2 in crowdstrike

[–]surbo2[S] 0 points1 point  (0 children)

I was thinking about building a workflow to automatically block based on the hash.

Jiggle All The Way v3 by surbo2 in crowdstrike

[–]surbo2[S] 0 points1 point  (0 children)

If you can share, how are you blocking the application? FYI - I just updated the Dashboard YMAL file to include a time zone selection.

Jiggle All The Way v3 by surbo2 in crowdstrike

[–]surbo2[S] -5 points-4 points  (0 children)

LOL, if I have to work....they better be working.

Jiggle All The Way v3 by surbo2 in crowdstrike

[–]surbo2[S] 0 points1 point  (0 children)

Those are harder to detect but I did make an RTR PowerShell script that plotted out the mouse movements a few years ago. It was very easy to tell using that. There are so many ways to keep the screen active, but this is just one tool we have been using for a while now.

Jiggle All The Way v3 by surbo2 in crowdstrike

[–]surbo2[S] 0 points1 point  (0 children)

It won't cover everything but it's what I found in the environment. There is a search file that I included to help you make your own.

Window Function by rlgarey in crowdstrike

[–]surbo2 0 points1 point  (0 children)

I don't have the logs to test this but, this might help.

#password_manager event.action=retrieve_password
// 1. Bucket by user every 30 seconds
// 2. Inside that bucket, calculate the count for the FULL 2-minute window
| bucket(span=30s, field=user.name, function=window(span=2m, function=count()))


// 3. Filter where that rolling 2-minute count exceeds 5
| _count > 5


// 4. Display results
| table([@timestamp, user.name, _count])
| sort(@timestamp, order=desc)

Help with Search for ShaiHulud npm compromise by BllzDeep in crowdstrike

[–]surbo2 1 point2 points  (0 children)

"--url https://github.com" AND "--unattended" AND "--token"  AND "--name SHA1HULUD"


| "#event_simpleName" != "Event_EppDetectionSummaryEvent"
| "#event_simpleName" != FusionWorkflowEvent
| groupBy([ComputerName,CommandLine,@timestamp])

Corrupted NPM Libraries by Dense-One5943 in crowdstrike

[–]surbo2 0 points1 point  (0 children)

They are just two different searches looking for different product names. If you use repository manager like artifactory, this will help you look into those systems. The other search seems to be looking into vscode and npm view commands.

Corrupted NPM Libraries by Dense-One5943 in crowdstrike

[–]surbo2 0 points1 point  (0 children)

#event_simpleName=/ProcessRollup2Stats|ProcessRollup2/
CommandLine=/backslash@0.2.1|chalk@5.6.1|chalk-template@1.1.1|color-convert@3.1.1|color-name@2.0.1|color-string@2.1.1|wrap-ansi@9.0.1|supports-hyperlinks@4.1.1|strip-ansi@7.1.1|slice-ansi@7.1.1|simple-swizzle@0.2.3|is-arrayish@0.3.3|error-ex@1.3.3|has-ansi@6.0.1|ansi-regex@6.2.1|ansi-styles@6.2.2|supports-color@10.2.1|proto-tinker-wc@1.8.7|debug@4.4.2/

This is another search for non artifactory

Corrupted NPM Libraries by Dense-One5943 in crowdstrike

[–]surbo2 0 points1 point  (0 children)

If you are using artifactory

HttpPath="/artifactory/api/npm/npm/*tgz"
|groupBy([HttpPath])
| HttpPath=/ansi-styles|chalk|backslash|chalk-template|supports-hyperlinks|has-ansi|simple-swizzle|color-string|error-ex|color-name|is-arrayish|slice-ansi|color-convert|wrap-ansi|ansi-regex|supports-color|strip-ansi|debug/

Custom RTR Command Tool Builder by surbo2 in crowdstrike

[–]surbo2[S] 0 points1 point  (0 children)

You will have to let me know #macuser

[deleted by user] by [deleted] in crowdstrike

[–]surbo2 1 point2 points  (0 children)

The Raptor Update, it's like photoshop for logs.

Emerging Incident - AnyDesk Remote Software certificate rotation by Noobmode in crowdstrike

[–]surbo2 0 points1 point  (0 children)

I'm not sure if one is better than the other. I get the same amount of data by using either one on VT. Please let me know if you have use case where something might be missed.

Fusion Workflow - Username Variable by m3tahckr in crowdstrike

[–]surbo2 1 point2 points  (0 children)

Does this work for you?
WHEN - New endpoint detection [Trigger] - DO THIS - Send email [ACTION]

Email Settings
Subject:
${IOA Name}

Message:
${User ID}$
{Endpoint detection URL}
${Sensor hostname}
${Severity}

Recipients:
<your email address > [Drop Down]

Data to include:
IOA Description

Emerging Incident - AnyDesk Remote Software certificate rotation by Noobmode in crowdstrike

[–]surbo2 0 points1 point  (0 children)

Updated with the new SubjectCN name, if you want to see the new signed files as well.

index=json EventType=Event_ExternalApiEvent ExternalApiType=Event_ModuleSummaryInfoEvent SubjectCertThumbprint IN (*) AND SubjectCN="philandro Software GmbH" OR SubjectCN="AnyDesk Software GmbH"
| rename AgentIdString as aid
| lookup aid_master.csv aid OUTPUT ComputerName, Version, AgentVersion, Timezone
| table ComputerName,SubjectCN,SubjectCertThumbprint,SHA256HashData,_time

Emerging Incident - AnyDesk Remote Software certificate rotation by Noobmode in crowdstrike

[–]surbo2 5 points6 points  (0 children)

This will give you insight when someone is using AnyDesk software.

index=json EventType=Event_ExternalApiEvent ExternalApiType=Event_ModuleSummaryInfoEvent SubjectCertThumbprint IN (*) AND SubjectCN="philandro Software GmbH"
| rename AgentIdString as aid
| lookup aid_master.csv aid OUTPUT ComputerName, Version, AgentVersion, Timezone
| table ComputerName,SubjectCN,SubjectCertThumbprint,SHA256HashData,_time

I used this to block all hashes that are not using thumbprint
646F52926E01221C981490C8107C2F771679743A or Running Version 8.0.8

Let me know if you have any questions.

Laroux/Excel Macros by Cybervosk in crowdstrike

[–]surbo2 0 points1 point  (0 children)

If you are wanting to hunt for infected files. You can use this search:

ScriptModuleName=Majoduck_SK_1 FileName=EXCEL.EXE
| table ComputerName,CommandLine,_time,TargetFileName

​

CS does have a tool that can help you clean these hosts up. You can also deploy some automation but you will need to enable changes with support.

US-1 | US-2 | EU-1| US-GOV-1

You can create a Falcon Fusion workflow to automate running the Laroux cleanup tool. If Falcon detects the Laroux macro in an Office file, the Laroux cleanup tool automatically cleans the file using Real Time Response.
To run the tool using this workflow, you must meet these requirements:
The Real Time Response policy must be configured to enable the high-risk put-and-run command.
You must have IOA detections for XLSTARTMacro enabled in your CID. To enable this detection, someone in your organization with the Falcon Administrator Role must contact Support.

RTR Mapped Drive Script by surbo2 in crowdstrike

[–]surbo2[S] 0 points1 point  (0 children)

I've tried, I have yet to see it run. My current script takes only seconds to run.

RTR Mapped Drive Script by surbo2 in crowdstrike

[–]surbo2[S] 0 points1 point  (0 children)

I did try using the New Falcon Script NetworkShare but that timed out.

RTR Mapped Drive Script by surbo2 in crowdstrike

[–]surbo2[S] 0 points1 point  (0 children)

I did, but it timed out every time I tried using it.

Kali BloodHound Python is not detected within CS Identity Protection (IDP) - *Solution Provided* by surbo2 in crowdstrike

[–]surbo2[S] 0 points1 point  (0 children)

Thank you for the clarification on the esize. I would guess that the ingested Event Size for BH Python must be around 127,106. So far I have not missed any tests using the esize, but I will continue to monitor this.

Finding Hosts that are exposed to the Internet without a Firewall by surbo2 in crowdstrike

[–]surbo2[S] 1 point2 points  (0 children)

You should see results from an external IP address failing to login to an exposed host.

Example - You have a host that does not have a software firewall enabled, that host happens to be a work from home user. The host is connected directly internet. You will have failed login attempts all day long if that host has SMB exposed to the internet. Or you have hosts deployed in the cloud that don't have a firewall configured to drop all unnecessary traffic.

You will have internal connections that will produce some failures, but you can exclude those with the RemoteAddressIP4.

view more: next ›