Detection rules for CrowdStrike Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 17 detection rules.

Rule Example

Below is an example of a rule definition for Critical Role Modification (Privilege Escalation) (view in repository):

name: "Critical Role Modification (Privilege Escalation)"
description: "New roles have been granted or updated for a user within the CrowdStrike administration console."
category: "Privilege Escalation"
technique: "Account Manipulation: Additional Cloud Roles"
references:
  - "https://attack.mitre.org/techniques/T1098/003/"
dataTypes:
  - crowdstrike
adversary: origin
impact:
  confidentiality: 3
  integrity: 3
  availability: 1
where: >
  exists("log.eventOperationName") && 
  oneOf("log.eventOperationName", ["grantUserRoles", "updateUserRoles"])
groupBy:
  - lastEvent.log.eventUserId
  - lastEvent.log.eventOperationName

Rule Details

Critical Role Modification (Privilege Escalation)

Within the CrowdStrike administration console, a user has been assigned new roles or had existing roles changed.

• Category: Privilege Escalation

• Technique: Account Manipulation: Additional Cloud Roles

• Impact: C:3 / I:3 / A:1

• Rule file: critical_role_modification.yml

• Reference: https://attack.mitre.org/techniques/T1098/003/

CrowdStrike Hunting: Windows Event Log Clearing

Detection identified raw process execution trying to clear Windows Event Logs. Attackers employ this method to hide their activity following host compromise.

• Category: Defense Evasion

• Technique: Indicator Removal: Clear Windows Event Logs

• Impact: C:0 / I:3 / A:2

• Rule file: windows_event_log_clearing.yml

• Reference: https://attack.mitre.org/techniques/T1070/001/

Custom Indicator of Compromise (IoC) Detected

The sensor observed activity matching an IoC (Hash, Domain, IP) that the client provided and entered.

• Category: Threat Detection

• Technique: User Execution

• Impact: C:3 / I:3 / A:1

• Rule file: custom_indicator_of_compromise_(IoC)_detected.yml

• Reference: https://attack.mitre.org/techniques/T1204/

Deletion or Deactivation of User Account

A user account in the Falcon console has been deactivated or deleted by an administrator. This points to account manipulation.

• Category: Account Manipulation

• Technique: Account Manipulation

• Impact: C:0 / I:3 / A:3

• Rule file: deletion_or_deactivation_of_user_account.yml

• Reference: https://attack.mitre.org/techniques/T1098/

Endpoint Network Containment Action

A request has been made to contain a host on the network, or containment that was previously in place has been released.

• Category: Impact

• Technique: Account Access Removal

• Impact: C:0 / I:2 / A:3

• Rule file: endpoint_network_containment_action.yml

• Reference: https://attack.mitre.org/techniques/T1531/

Endpoint or XDR Detection Alert

Falcon EPP or XDR has produced a critical detection summary that points to malicious activity or attack patterns.

• Category: Threat Detection

• Technique: Command and Scripting Interpreter

• Impact: C:3 / I:3 / A:2

• Rule file: endpoint_or_XDR_detection_alert.yml

• Reference: https://attack.mitre.org/techniques/T1059/

IP Whitelisting Modification

The CrowdStrike whitelist has seen IP addresses added or removed. An attacker could exploit this to bypass network blocking.

• Category: Defense Evasion

• Technique: Impair Defenses: Disable or Modify Cloud Firewall

• Impact: C:1 / I:3 / A:2

• Rule file: ip_whitelisting_modification.yml

• Reference: https://attack.mitre.org/techniques/T1562/007/

Inhibit System Recovery (Shadow Copy Deletion)

Command line activity that tried to delete Volume Shadow Copies or turn off recovery options was detected by the Falcon agent. This is a highly reliable sign of impending Ransomware encryption.

• Category: Impact

• Technique: Inhibit System Recovery

• Impact: C:0 / I:3 / A:3

• Rule file: inhibit_system_recovery.yml

• Reference: https://attack.mitre.org/techniques/T1490/

Major Incident Generated (CrowdScore)

Multiple detections have been consolidated by the CrowdScore engine into a critical incident, which may indicate Lateral Movement or a widespread intrusion.

• Category: Lateral Movement

• Technique: Lateral Tool Transfer

• Impact: C:3 / I:3 / A:3

• Rule file: major_incident_generated.yml

• Reference: https://attack.mitre.org/techniques/T1570/

• Reference: https://attack.mitre.org/tactics/TA0008/

Multiple Authentication Failures (Possible Brute Force Attack)

Within a brief time frame, multiple authentication attempts on the CrowdStrike Falcon console have failed from a user or IP address.

• Category: Credential Access

• Technique: Brute Force: Password Guessing

• Impact: C:3 / I:0 / A:0

• Rule file: multiple_authentication_failures_(possible_brute_force_attack).yml

• Reference: https://attack.mitre.org/techniques/T1110/001/

OS Credential Dumping Activity

Activity typically linked to OS Credential Dumping was observed by the endpoint agent. This includes attempts to read or dump LSASS memory with known tools.

• Category: Credential Access

• Technique: OS Credential Dumping: LSASS Memory

• Impact: C:3 / I:1 / A:0

• Rule file: os_credential_dumping_activity.yml

• Reference: https://attack.mitre.org/techniques/T1003/001/

Real-Time Response (RTR) Session Execution

A remote response (RTR) session on an endpoint has been started by a user or API. This provides extensive access to the host.

• Category: Execution

• Technique: Remote Services

• Impact: C:3 / I:3 / A:1

• Rule file: real_time_response_rtr_session_execution.yml

• Reference: https://attack.mitre.org/techniques/T1021/

Security Defenses Impaired or Policy Disabled

On the endpoint, an action caused a critical sensor process or security policy to be disabled locally. This is a strong indication of defense evasion tampering.

• Category: Defense Evasion

• Technique: Impair Defenses: Disable or Modify Tools

• Impact: C:0 / I:3 / A:3

• Rule file: security_defenses_impaired_or_policy_disabled.yml

• Reference: https://attack.mitre.org/techniques/T1562/001/

Security Policy Disabled or Deleted

A security prevention policy in Falcon has been disabled or deleted by an administrator or actor, potentially leaving endpoints exposed.

• Category: Defense Evasion

• Technique: Impair Defenses: Disable or Modify Tools

• Impact: C:1 / I:3 / A:3

• Rule file: security_policy_disabled_or_deleted.yml

• Reference: https://attack.mitre.org/techniques/T1562/001/

Suspicious Downloader Execution (Linux/macOS)

On a Linux or macOS endpoint, native downloaders such as curl or wget were detected executing HTTP connections, which may signal Ingress Tool Transfer by an adversary.

• Category: Command and Control

• Technique: Ingress Tool Transfer

• Impact: C:2 / I:2 / A:0

• Rule file: suspicious_downloader_execution_linux_macos.yml

• Reference: https://attack.mitre.org/techniques/T1105/

Suspicious Encoded PowerShell Execution

A PowerShell process was launched with arguments that indicate base64 encoded commands (-enc, -EncodedCommand). Malware and threat actors frequently rely on this to avoid string-based detection.

• Category: Execution

• Technique: Command and Scripting Interpreter: PowerShell

• Impact: C:3 / I:2 / A:1

• Rule file: suspicious_encoded_powershell_execution.yml

• Reference: https://attack.mitre.org/techniques/T1059/001/

Suspicious Native Downloaders (LoLBin)

Native binaries such as certutil, bitsadmin, curl, or wget were detected executing and making external connections, which may indicate Ingress Tool Transfer by an adversary.

• Category: Command and Control

• Technique: Ingress Tool Transfer

• Impact: C:2 / I:2 / A:0

• Rule file: suspicious_native_downloaders.yml

• Reference: https://attack.mitre.org/techniques/T1105/