ds_crowdstrike_falcon.md

Vendor: CrowdStrike

Product: Falcon

Rules	Models	MITRE TTPs	Event Types	Parsers
777	186	121	26	26

Use-Case	Event Types/Parsers	MITRE TTP	Content
Abnormal Authentication & Access	app-activity ↳cef-crowdstrike-app-activity ↳crowdstrike-app-activity-9 ↳crowdstrike-app-activity-8 ↳crowdstrike-app-activity-7 ↳crowdstrike-app-activity ↳crowdstrike-app-activity-4 ↳crowdstrike-app-activity-3 ↳crowdstrike-app-activity-2 ↳crowdstrike-app-activity-11 ↳crowdstrike-app-activity-1 ↳crowdstrike-app-activity-10 app-activity-failed ↳crowdstrike-config-change app-login ↳s-crowdstrike-app-login-5 ↳s-crowdstrike-app-login-1 ↳cef-crowdstrike-app-login ↳s-crowdstrike-app-login ↳s-crowdstrike-app-login-4 ↳s-crowdstrike-app-login-7 ↳s-crowdstrike-app-login-6 ↳s-crowdstrike-app-login-9 ↳s-crowdstrike-app-login-8 ↳leef-crowdstrike-app-login authentication-failed ↳crowdstrike-auth-failed-1 ↳crowdstrike-auth-failed-2 batch-logon ↳crowdstrike-logon ↳crowdstrike-logon-2 computer-logon ↳crowdstrike-service-created-1 ↳crowdstrike-service-created ↳crowdstrike-process-created-2 ↳crowdstrike-process-created-1 ↳crowdstrike-process-created dlp-alert ↳crowdstrike-win-task-created dlp-email-alert-out-failed ↳crowdstrike-logon ↳crowdstrike-logon-2 failed-app-login ↳cef-crowdstrike-app-activity ↳crowdstrike-app-activity-9 ↳crowdstrike-app-activity-8 ↳crowdstrike-app-activity-7 ↳crowdstrike-app-activity ↳crowdstrike-app-activity-4 ↳crowdstrike-app-activity-3 ↳crowdstrike-app-activity-2 ↳crowdstrike-app-activity-11 ↳crowdstrike-app-activity-1 ↳crowdstrike-app-activity-10 file-alert ↳crowdstrike-network-connection file-delete ↳crowdstrike-file-read-2 ↳crowdstrike-file-read-3 ↳s-crowdstrike-app-ransomware ↳crowdstrike-file-read ↳crowdstrike-file-operations-1 file-download ↳crowdstrike-file-alert file-read ↳crowdstrike-file-download ↳crowdstrike-file-download-1 file-write ↳crowdstrike-file-delete-1 ↳crowdstrike-file-operations-1 local-logon ↳falcon-dns-request ↳crowdstrike-logon ↳crowdstrike-logon-2 network-connection-failed ↳crowdstrike-process-network network-connection-successful ↳crowdstrike-usb-connect ↳crowdstrike-usb-insert process-alert ↳s-crowdstrike-app-login-1 ↳cef-crowdstrike-app-login ↳s-crowdstrike-app-login-3 ↳s-crowdstrike-app-login-2 ↳s-crowdstrike-app-login ↳s-crowdstrike-app-login-4 ↳s-crowdstrike-app-login-7 ↳s-crowdstrike-app-login-6 ↳s-crowdstrike-app-login-9 ↳s-crowdstrike-app-login-8 ↳s-crowdstrike-app-login-10 ↳leef-crowdstrike-app-login process-created ↳crowdstrike-file-write-9 ↳crowdstrike-modify-binary ↳crowdstrike-file-write-4 ↳crowdstrike-file-write-10 ↳crowdstrike-file-write-3 ↳crowdstrike-file-write-11 ↳crowdstrike-file-write-2 ↳crowdstrike-file-write-12 ↳crowdstrike-file-write-1 ↳crowdstrike-file-write-13 ↳crowdstrike-file-write-14 ↳crowdstrike-file-write-8 ↳crowdstrike-file-write-7 ↳crowdstrike-file-write-6 ↳crowdstrike-file-write ↳crowdstrike-file-write-5 ↳crowdstrike-file-operations-1 process-network ↳crowdstrike-usb-alert remote-access ↳crowdstrike-logon ↳crowdstrike-logon-2 ↳crowdstrike-host-info ↳crowdstrike-user-identity remote-logon ↳crowdstrike-logon ↳crowdstrike-logon-2 security-alert ↳crowdstrike-file-process-alert-2 ↳s-crowdstrike-process-alert ↳q-crowdstrike-process-alert-1 service-logon ↳crowdstrike-logon ↳crowdstrike-logon-2 usb-activity ↳crowdstrike-security-alert-2 ↳s-crowdstrike-app-dll-alert ↳crowdstrike-security-alert-6 ↳leef-crowdstrike-dnsrequests ↳crowdstrike-security-alert-4 ↳crowdstrike-security-alert-5 ↳leef-crowdstrike-networkaccesses ↳leef-crowdstrike-documentsaccessed ↳cef-crowdstrike-alert ↳leef-crowdstrike-executableswritten ↳crowdstrike-security-alert ↳leef-crowdstrike-detectionsummaryevent ↳s-crowdstrike-security-alert ↳leef-crowdstrike-alert usb-insert ↳crowdstrike-usb-disconnect	T1021 - Remote Services T1078 - Valid Accounts T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services	72 Rules 31 Models
Account Manipulation	app-activity ↳cef-crowdstrike-app-activity ↳crowdstrike-app-activity-9 ↳crowdstrike-app-activity-8 ↳crowdstrike-app-activity-7 ↳crowdstrike-app-activity ↳crowdstrike-app-activity-4 ↳crowdstrike-app-activity-3 ↳crowdstrike-app-activity-2 ↳crowdstrike-app-activity-11 ↳crowdstrike-app-activity-1 ↳crowdstrike-app-activity-10 app-activity-failed ↳crowdstrike-config-change app-login ↳s-crowdstrike-app-login-5 ↳s-crowdstrike-app-login-1 ↳cef-crowdstrike-app-login ↳s-crowdstrike-app-login ↳s-crowdstrike-app-login-4 ↳s-crowdstrike-app-login-7 ↳s-crowdstrike-app-login-6 ↳s-crowdstrike-app-login-9 ↳s-crowdstrike-app-login-8 ↳leef-crowdstrike-app-login authentication-failed ↳crowdstrike-auth-failed-1 ↳crowdstrike-auth-failed-2 batch-logon ↳crowdstrike-logon ↳crowdstrike-logon-2 computer-logon ↳crowdstrike-service-created-1 ↳crowdstrike-service-created ↳crowdstrike-process-created-2 ↳crowdstrike-process-created-1 ↳crowdstrike-process-created dlp-alert ↳crowdstrike-win-task-created dlp-email-alert-out-failed ↳crowdstrike-logon ↳crowdstrike-logon-2 failed-app-login ↳cef-crowdstrike-app-activity ↳crowdstrike-app-activity-9 ↳crowdstrike-app-activity-8 ↳crowdstrike-app-activity-7 ↳crowdstrike-app-activity ↳crowdstrike-app-activity-4 ↳crowdstrike-app-activity-3 ↳crowdstrike-app-activity-2 ↳crowdstrike-app-activity-11 ↳crowdstrike-app-activity-1 ↳crowdstrike-app-activity-10 file-alert ↳crowdstrike-network-connection file-delete ↳crowdstrike-file-read-2 ↳crowdstrike-file-read-3 ↳s-crowdstrike-app-ransomware ↳crowdstrike-file-read ↳crowdstrike-file-operations-1 file-download ↳crowdstrike-file-alert file-read ↳crowdstrike-file-download ↳crowdstrike-file-download-1 file-write ↳crowdstrike-file-delete-1 ↳crowdstrike-file-operations-1 local-logon ↳falcon-dns-request ↳crowdstrike-logon ↳crowdstrike-logon-2 network-connection-failed ↳crowdstrike-process-network network-connection-successful ↳crowdstrike-usb-connect ↳crowdstrike-usb-insert process-alert ↳s-crowdstrike-app-login-1 ↳cef-crowdstrike-app-login ↳s-crowdstrike-app-login-3 ↳s-crowdstrike-app-login-2 ↳s-crowdstrike-app-login ↳s-crowdstrike-app-login-4 ↳s-crowdstrike-app-login-7 ↳s-crowdstrike-app-login-6 ↳s-crowdstrike-app-login-9 ↳s-crowdstrike-app-login-8 ↳s-crowdstrike-app-login-10 ↳leef-crowdstrike-app-login process-created ↳crowdstrike-file-write-9 ↳crowdstrike-modify-binary ↳crowdstrike-file-write-4 ↳crowdstrike-file-write-10 ↳crowdstrike-file-write-3 ↳crowdstrike-file-write-11 ↳crowdstrike-file-write-2 ↳crowdstrike-file-write-12 ↳crowdstrike-file-write-1 ↳crowdstrike-file-write-13 ↳crowdstrike-file-write-14 ↳crowdstrike-file-write-8 ↳crowdstrike-file-write-7 ↳crowdstrike-file-write-6 ↳crowdstrike-file-write ↳crowdstrike-file-write-5 ↳crowdstrike-file-operations-1 process-network ↳crowdstrike-usb-alert remote-access ↳crowdstrike-logon ↳crowdstrike-logon-2 ↳crowdstrike-host-info ↳crowdstrike-user-identity remote-logon ↳crowdstrike-logon ↳crowdstrike-logon-2 security-alert ↳crowdstrike-file-process-alert-2 ↳s-crowdstrike-process-alert ↳q-crowdstrike-process-alert-1 service-logon ↳crowdstrike-logon ↳crowdstrike-logon-2 usb-activity ↳crowdstrike-security-alert-2 ↳s-crowdstrike-app-dll-alert ↳crowdstrike-security-alert-6 ↳leef-crowdstrike-dnsrequests ↳crowdstrike-security-alert-4 ↳crowdstrike-security-alert-5 ↳leef-crowdstrike-networkaccesses ↳leef-crowdstrike-documentsaccessed ↳cef-crowdstrike-alert ↳leef-crowdstrike-executableswritten ↳crowdstrike-security-alert ↳leef-crowdstrike-detectionsummaryevent ↳s-crowdstrike-security-alert ↳leef-crowdstrike-alert usb-insert ↳crowdstrike-usb-disconnect	T1003 - OS Credential Dumping T1047 - Windows Management Instrumentation T1078 - Valid Accounts T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1175 - T1175 T1531 - Account Access Removal	22 Rules 9 Models
Next Page -->>

ATT&CK Matrix for Enterprise

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
External Remote Services Valid Accounts Exploit Public Fasing Application Phishing	Windows Management Instrumentation Command and Scripting Interperter Scheduled Task/Job Scripting System Services Exploitation for Client Execution User Execution Scheduled Task/Job: Scheduled Task Command and Scripting Interperter: PowerShell Scheduled Task/Job: At (Windows)	Pre-OS Boot Create Account Create or Modify System Process External Remote Services Valid Accounts Hijack Execution Flow Server Software Component: Web Shell Account Manipulation BITS Jobs Create or Modify System Process: Windows Service Scheduled Task/Job Server Software Component Event Triggered Execution Traffic Signaling Boot or Logon Autostart Execution Create Account: Create: Local Account Account Manipulation: Exchange Email Delegate Permissions	Access Token Manipulation: Token Impersonation/Theft Create or Modify System Process Valid Accounts Access Token Manipulation Exploitation for Privilege Escalation Hijack Execution Flow Process Injection Scheduled Task/Job Abuse Elevation Control Mechanism Event Triggered Execution Boot or Logon Autostart Execution Process Injection: Dynamic-link Library Injection Abuse Elevation Control Mechanism: Bypass User Account Control	Hide Artifacts Indirect Command Execution Impair Defenses Indicator Removal on Host: Clear Windows Event Logs Traffic Signaling Trusted Developer Utilities Proxy Execution Masquerading: Match Legitimate Name or Location Masquerading: Rename System Utilities File and Directory Permissions Modification: Windows File and Directory Permissions Modification Obfuscated Files or Information: Compile After Delivery Obfuscated Files or Information: Indicator Removal from Tools Hijack Execution Flow: DLL Side-Loading Indicator Removal on Host: File Deletion Masquerading Valid Accounts Modify Registry BITS Jobs Use Alternate Authentication Material Hide Artifacts: NTFS File Attributes Use Alternate Authentication Material: Pass the Hash Indicator Removal on Host Pre-OS Boot File and Directory Permissions Modification XSL Script Processing Deobfuscate/Decode Files or Information Abuse Elevation Control Mechanism Impair Defenses: Disable or Modify System Firewall Obfuscated Files or Information Signed Binary Proxy Execution: Compiled HTML File Access Token Manipulation Exploitation for Defense Evasion Hijack Execution Flow Process Injection Valid Accounts: Local Accounts Signed Binary Proxy Execution: Msiexec Signed Binary Proxy Execution Signed Binary Proxy Execution: Regsvcs/Regasm Signed Binary Proxy Execution: CMSTP Signed Binary Proxy Execution: Control Panel Signed Binary Proxy Execution: InstallUtil Signed Binary Proxy Execution: Regsvr32 Trusted Developer Utilities Proxy Execution: MSBuild Signed Binary Proxy Execution: Rundll32	OS Credential Dumping Input Capture Unsecured Credentials Man-in-the-Middle Steal or Forge Kerberos Tickets Steal or Forge Kerberos Tickets: Kerberoasting Network Sniffing	Network Service Scanning Account Discovery Domain Trust Discovery Account Discovery: Local Account Account Discovery: Domain Account File and Directory Discovery Network Sniffing System Information Discovery Network Share Discovery Query Registry Process Discovery System Owner/User Discovery System Network Configuration Discovery	Exploitation of Remote Services Remote Services Remote Services: SMB/Windows Admin Shares Use Alternate Authentication Material Remote Services: Remote Desktop Protocol	Email Collection Input Capture Audio Capture Archive Collected Data Man-in-the-Middle Email Collection: Email Forwarding Rule	Non-Standard Port Data Encoding Data Encoding: Standard Encoding Remote Access Software Dynamic Resolution Traffic Signaling Ingress Tool Transfer Dynamic Resolution: Domain Generation Algorithms Proxy: Multi-hop Proxy Proxy: External Proxy Application Layer Protocol Proxy	Exfiltration Over Alternative Protocol Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol Exfiltration Over Physical Medium: Exfiltration over USB Exfiltration Over Physical Medium Automated Exfiltration	Account Access Removal Resource Hijacking Data Encrypted for Impact Inhibit System Recovery