2_ds_crowdstrike_falcon.md

Use-Case	Activity Types/Parsers	MITRE ATT&CK® TTP	Content
Audit Tampering	audit-log-clear ↳crowdstrike-falcon-kv-log-clear-eventlogcleared process-created ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename	T1059 - Command and Scripting Interperter T1070 - Indicator Removal on Host T1070.001 - Indicator Removal on Host: Clear Windows Event Logs T1546 - Event Triggered Execution T1546.003 - T1546.003 T1562 - Impair Defenses T1562.002 - T1562.002 T1562.006 - T1562.006	8 Rules 2 Models
Compromised Credentials	app-activity ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-cef-app-activity-deleteuser ↳crowdstrike-falcon-cef-app-activity-createuser ↳crowdstrike-falcon-cef-app-activity-grantuserroles ↳crowdstrike-falcon-cef-app-activity-revokeuserroles ↳crowdstrike-falcon-cef-app-activity-useraccountadded ↳crowdstrike-falcon-sk4-app-activity-success-resetapiclientsecret ↳crowdstrike-falcon-json-app-activity-success-scriptcontrolscantelemetry ↳crowdstrike-falcon-json-app-activity-eambypassevent ↳crowdstrike-falcon-json-app-activity-idpentityriskscorechange ↳crowdstrike-falcon-json-app-activity-success-falcon_device ↳crowdstrike-falcon-sk4-app-activity-success-authactivityauditevent ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-json-service-stop-success-hostedservicestopped ↳crowdstrike-falcon-json-service-stop-success-hostedservicestopped ↳crowdstrike-falcon-json-service-stop-success-hostedservicestopped ↳crowdstrike-falcon-cef-endpoint-notification-discovererdevicetype ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-cef-app-activity-useractivityauditevent-1 ↳crowdstrike-falcon-cef-app-activity-useractivityauditevent app-login ↳crowdstrike-falcon-json-app-login-streamstarted-1 ↳crowdstrike-falcon-cef-app-login-accepteula ↳crowdstrike-falcon-json-app-login-createapi ↳crowdstrike-falcon-leef-app-login-falconhost ↳crowdstrike-falcon-json-app-login-twofactorauth ↳crowdstrike-falcon-json-app-login-streamstarted ↳crowdstrike-falcon-cef-app-login-authactivity ↳crowdstrike-falcon-json-app-login-apiactivityauditevent ↳crowdstrike-falcon-cef-app-login-success-assert-1 ↳crowdstrike-falcon-json-app-login-success-assert ↳crowdstrike-falcon-json-app-login-userauth ↳crowdstrike-falcon-json-app-login-fdritemsexplorer ↳crowdstrike-falcon-cef-app-login-success-startevent ↳crowdstrike-falcon-json-app-login-sso ↳crowdstrike-falcon-sk4-app-login-authentication ↳crowdstrike-falcon-json-app-login-authentication authentication-successful ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin batch-logon ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin failed-app-login ↳crowdstrike-falcon-json-app-login-sso ↳crowdstrike-falcon-json-app-login-streamstarted-1 ↳crowdstrike-falcon-cef-app-login-accepteula ↳crowdstrike-falcon-json-app-login-createapi ↳crowdstrike-falcon-leef-app-login-falconhost ↳crowdstrike-falcon-json-app-login-twofactorauth ↳crowdstrike-falcon-json-app-login-streamstarted ↳crowdstrike-falcon-cef-app-login-authactivity ↳crowdstrike-falcon-json-app-login-apiactivityauditevent ↳crowdstrike-falcon-json-app-login-success-assert ↳crowdstrike-falcon-json-app-login-userauth file-delete ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-executabledeleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-executabledeleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-executabledeleted file-read ↳crowdstrike-falcon-leef-file-read-success-documentsaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed-1 ↳crowdstrike-falcon-json-file-read-success-ransomware ↳crowdstrike-falcon-leef-file-read-success-documentsaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed-1 ↳crowdstrike-falcon-json-file-read-success-ransomware ↳crowdstrike-falcon-leef-file-read-success-documentsaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed-1 ↳crowdstrike-falcon-json-file-read-success-ransomware ↳crowdstrike-falcon-leef-file-read-success-documentsaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed-1 ↳crowdstrike-falcon-json-file-read-success-ransomware ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info file-write ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted local-logon ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin process-alert ↳crowdstrike-falcon-mix-alert-trigger-success-suspiciousactivity ↳crowdstrike-falcon-mix-alert-trigger-success-suspiciousactivity ↳crowdstrike-falcon-json-alert-trigger-success-processblock ↳crowdstrike-falcon-sk4-alert-trigger-userexceptiondep ↳crowdstrike-falcon-json-alert-trigger-success-processblock ↳crowdstrike-falcon-sk4-alert-trigger-userexceptiondep ↳crowdstrike-falcon-json-alert-trigger-success-processblock ↳crowdstrike-falcon-sk4-alert-trigger-userexceptiondep ↳crowdstrike-falcon-json-alert-trigger-success-processblock ↳crowdstrike-falcon-sk4-alert-trigger-userexceptiondep process-created ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename process-network ↳crowdstrike-falcon-json-network-session-success-listenip remote-access ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin remote-logon ↳crowdstrike-falcon-json-app-login-sso ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin security-alert ↳crowdstrike-falcon-json-alert-trigger-success-xdrdetection ↳crowdstrike-falcon-json-alert-trigger-success-automatedleadsummaryevent ↳crowdstrike-falcon-json-alert-trigger-success-identityprotection ↳crowdstrike-falcon-cef-alert-trigger-success-host ↳crowdstrike-falcon-mix-alert-trigger-success-detectionsummaryevent ↳crowdstrike-falcon-json-alert-trigger-success-xdrdetection ↳crowdstrike-falcon-json-alert-trigger-success-automatedleadsummaryevent ↳crowdstrike-falcon-json-alert-trigger-success-identityprotection ↳crowdstrike-falcon-cef-alert-trigger-success-host ↳crowdstrike-falcon-mix-alert-trigger-success-detectionsummaryevent ↳crowdstrike-falcon-json-alert-trigger-success-dllinjection ↳crowdstrike-falcon-json-alert-trigger-success-dllinjection ↳crowdstrike-falcon-json-alert-trigger-success-dllinjection ↳crowdstrike-falcon-json-alert-trigger-success-dllinjection ↳crowdstrike-falcon-mix-alert-trigger-success-detection ↳crowdstrike-falcon-mix-alert-trigger-success-detection ↳crowdstrike-falcon-sk4-alert-trigger-lsasshandlefromunsignedmodule ↳crowdstrike-falcon-json-alert-trigger-firewallmatchevent ↳crowdstrike-falcon-json-alert-trigger-success-reconnotification ↳crowdstrike-falcon-json-alert-trigger-success-cspmsearchstreamingevent ↳crowdstrike-falcon-sk4-alert-trigger-firewallmatchevent ↳crowdstrike-falcon-sk4-alert-trigger-success-idpdetection ↳crowdstrike-falcon-json-alert-trigger-success-cspmioastreamingevent ↳crowdstrike-falcon-json-alert-trigger-success-idpdetection ↳crowdstrike-falcon-sk4-alert-trigger-success-idpdetection ↳crowdstrike-falcon-json-alert-trigger-success-cspmioastreamingevent ↳crowdstrike-falcon-json-alert-trigger-success-idpdetection ↳crowdstrike-falcon-leef-alert-trigger-success-falconhost ↳crowdstrike-falcon-json-alert-trigger-success-mobiledetection ↳crowdstrike-falcon-json-alert-trigger-success-mobiledetection ↳crowdstrike-falcon-cef-app-activity-useractivityauditevent-1 ↳crowdstrike-falcon-cef-app-activity-useractivityauditevent service-created ↳crowdstrike-falcon-json-process-create-success-createservice ↳crowdstrike-falcon-json-process-create-success-createservice ↳crowdstrike-falcon-json-process-create-success-createservice ↳crowdstrike-falcon-json-process-create-success-createservice service-logon ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin share-access ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1003.002 - T1003.002 T1003.003 - T1003.003 T1003.005 - T1003.005 T1016 - System Network Configuration Discovery T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1040 - Network Sniffing T1078 - Valid Accounts T1078.002 - T1078.002 T1078.003 - Valid Accounts: Local Accounts T1083 - File and Directory Discovery T1133 - External Remote Services T1187 - Forced Authentication T1190 - Exploit Public Fasing Application T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1555 - Credentials from Password Stores T1558 - Steal or Forge Kerberos Tickets TA0002 - TA0002	174 Rules 72 Models
Cryptomining	process-created ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename	T1496 - Resource Hijacking	1 Rules
Data Access	app-activity ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-cef-app-activity-deleteuser ↳crowdstrike-falcon-cef-app-activity-createuser ↳crowdstrike-falcon-cef-app-activity-grantuserroles ↳crowdstrike-falcon-cef-app-activity-revokeuserroles ↳crowdstrike-falcon-cef-app-activity-useraccountadded ↳crowdstrike-falcon-sk4-app-activity-success-resetapiclientsecret ↳crowdstrike-falcon-json-app-activity-success-scriptcontrolscantelemetry ↳crowdstrike-falcon-json-app-activity-eambypassevent ↳crowdstrike-falcon-json-app-activity-idpentityriskscorechange ↳crowdstrike-falcon-json-app-activity-success-falcon_device ↳crowdstrike-falcon-sk4-app-activity-success-authactivityauditevent ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-json-service-stop-success-hostedservicestopped ↳crowdstrike-falcon-json-service-stop-success-hostedservicestopped ↳crowdstrike-falcon-json-service-stop-success-hostedservicestopped ↳crowdstrike-falcon-cef-endpoint-notification-discovererdevicetype ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-cef-app-activity-useractivityauditevent-1 ↳crowdstrike-falcon-cef-app-activity-useractivityauditevent app-login ↳crowdstrike-falcon-json-app-login-streamstarted-1 ↳crowdstrike-falcon-cef-app-login-accepteula ↳crowdstrike-falcon-json-app-login-createapi ↳crowdstrike-falcon-leef-app-login-falconhost ↳crowdstrike-falcon-json-app-login-twofactorauth ↳crowdstrike-falcon-json-app-login-streamstarted ↳crowdstrike-falcon-cef-app-login-authactivity ↳crowdstrike-falcon-json-app-login-apiactivityauditevent ↳crowdstrike-falcon-cef-app-login-success-assert-1 ↳crowdstrike-falcon-json-app-login-success-assert ↳crowdstrike-falcon-json-app-login-userauth ↳crowdstrike-falcon-json-app-login-fdritemsexplorer ↳crowdstrike-falcon-cef-app-login-success-startevent ↳crowdstrike-falcon-json-app-login-sso ↳crowdstrike-falcon-sk4-app-login-authentication ↳crowdstrike-falcon-json-app-login-authentication failed-app-login ↳crowdstrike-falcon-json-app-login-sso ↳crowdstrike-falcon-json-app-login-streamstarted-1 ↳crowdstrike-falcon-cef-app-login-accepteula ↳crowdstrike-falcon-json-app-login-createapi ↳crowdstrike-falcon-leef-app-login-falconhost ↳crowdstrike-falcon-json-app-login-twofactorauth ↳crowdstrike-falcon-json-app-login-streamstarted ↳crowdstrike-falcon-cef-app-login-authactivity ↳crowdstrike-falcon-json-app-login-apiactivityauditevent ↳crowdstrike-falcon-json-app-login-success-assert ↳crowdstrike-falcon-json-app-login-userauth file-delete ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-executabledeleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-executabledeleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-executabledeleted file-read ↳crowdstrike-falcon-leef-file-read-success-documentsaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed-1 ↳crowdstrike-falcon-json-file-read-success-ransomware ↳crowdstrike-falcon-leef-file-read-success-documentsaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed-1 ↳crowdstrike-falcon-json-file-read-success-ransomware ↳crowdstrike-falcon-leef-file-read-success-documentsaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed-1 ↳crowdstrike-falcon-json-file-read-success-ransomware ↳crowdstrike-falcon-leef-file-read-success-documentsaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed-1 ↳crowdstrike-falcon-json-file-read-success-ransomware ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info file-write ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted process-created ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename	T1003 - OS Credential Dumping T1078 - Valid Accounts T1083 - File and Directory Discovery	45 Rules 24 Models
Data Exfiltration	file-alert ↳crowdstrike-falcon-sk4-alert-trigger-success-quarantinedfilestate ↳crowdstrike-falcon-sk4-alert-trigger-success-quarantinedfilestate ↳crowdstrike-falcon-sk4-alert-trigger-success-quarantinedfilestate ↳crowdstrike-falcon-sk4-alert-trigger-success-quarantinedfilestate file-write ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted process-created ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename	T1003 - OS Credential Dumping T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1048 - Exfiltration Over Alternative Protocol T1059 - Command and Scripting Interperter T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1071.002 - Application Layer Protocol: File Transfer Protocols T1071.004 - Application Layer Protocol: DNS T1552 - Unsecured Credentials T1552.001 - T1552.001 T1560 - Archive Collected Data T1572 - Protocol Tunneling TA0002 - TA0002	9 Rules 1 Models
Data Leak	app-activity ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-cef-app-activity-deleteuser ↳crowdstrike-falcon-cef-app-activity-createuser ↳crowdstrike-falcon-cef-app-activity-grantuserroles ↳crowdstrike-falcon-cef-app-activity-revokeuserroles ↳crowdstrike-falcon-cef-app-activity-useraccountadded ↳crowdstrike-falcon-sk4-app-activity-success-resetapiclientsecret ↳crowdstrike-falcon-json-app-activity-success-scriptcontrolscantelemetry ↳crowdstrike-falcon-json-app-activity-eambypassevent ↳crowdstrike-falcon-json-app-activity-idpentityriskscorechange ↳crowdstrike-falcon-json-app-activity-success-falcon_device ↳crowdstrike-falcon-sk4-app-activity-success-authactivityauditevent ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-json-service-stop-success-hostedservicestopped ↳crowdstrike-falcon-json-service-stop-success-hostedservicestopped ↳crowdstrike-falcon-json-service-stop-success-hostedservicestopped ↳crowdstrike-falcon-cef-endpoint-notification-discovererdevicetype ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-cef-app-activity-useractivityauditevent-1 ↳crowdstrike-falcon-cef-app-activity-useractivityauditevent file-write ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted usb-insert ↳crowdstrike-falcon-mix-peripheral-storage-insert-success-removablemediavolumemounted ↳crowdstrike-falcon-mix-peripheral-storage-insert-success-removablemediavolumemounted ↳crowdstrike-falcon-mix-peripheral-storage-insert-success-removablemediavolumemounted ↳crowdstrike-falcon-mix-peripheral-storage-insert-success-removablemediavolumemounted	T1052 - Exfiltration Over Physical Medium T1052.001 - Exfiltration Over Physical Medium: Exfiltration over USB T1091 - Replication Through Removable Media T1114 - Email Collection T1114.001 - T1114.001 T1114.003 - Email Collection: Email Forwarding Rule	17 Rules 4 Models
Destruction of Data	file-delete ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-executabledeleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-executabledeleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-executabledeleted	T1070 - Indicator Removal on Host T1070.004 - Indicator Removal on Host: File Deletion T1485 - Data Destruction	1 Rules
Evasion	audit-log-clear ↳crowdstrike-falcon-kv-log-clear-eventlogcleared process-created ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename registry-write ↳crowdstrike-falcon-cef-registry-modify-asepkeyupdate ↳crowdstrike-falcon-json-registry-modify-success-reggenericvalueupdate ↳crowdstrike-falcon-cef-registry-modify-asepvalueupdate ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename service-created ↳crowdstrike-falcon-json-process-create-success-createservice ↳crowdstrike-falcon-json-process-create-success-createservice ↳crowdstrike-falcon-json-process-create-success-createservice ↳crowdstrike-falcon-json-process-create-success-createservice	T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.003 - Masquerading: Rename System Utilities T1036.005 - Masquerading: Match Legitimate Name or Location T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.005 - T1059.005 T1070 - Indicator Removal on Host T1070.001 - Indicator Removal on Host: Clear Windows Event Logs T1105 - Ingress Tool Transfer T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1140 - Deobfuscate/Decode Files or Information T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.004 - Signed Binary Proxy Execution: InstallUtil T1218.008 - T1218.008 T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1218.011 - Signed Binary Proxy Execution: Rundll32 T1484 - Group Policy Modification T1484.001 - T1484.001 T1542 - Pre-OS Boot T1542.003 - T1542.003 T1543 - Create or Modify System Process T1543.003 - Create or Modify System Process: Windows Service T1552 - Unsecured Credentials T1552.006 - T1552.006 T1562 - Impair Defenses T1562.001 - T1562.001 T1562.004 - Impair Defenses: Disable or Modify System Firewall T1562.006 - T1562.006 T1564 - Hide Artifacts T1564.001 - T1564.001 T1564.002 - T1564.002 T1564.004 - Hide Artifacts: NTFS File Attributes T1574 - Hijack Execution Flow	48 Rules 3 Models
Lateral Movement	app-login ↳crowdstrike-falcon-json-app-login-streamstarted-1 ↳crowdstrike-falcon-cef-app-login-accepteula ↳crowdstrike-falcon-json-app-login-createapi ↳crowdstrike-falcon-leef-app-login-falconhost ↳crowdstrike-falcon-json-app-login-twofactorauth ↳crowdstrike-falcon-json-app-login-streamstarted ↳crowdstrike-falcon-cef-app-login-authactivity ↳crowdstrike-falcon-json-app-login-apiactivityauditevent ↳crowdstrike-falcon-cef-app-login-success-assert-1 ↳crowdstrike-falcon-json-app-login-success-assert ↳crowdstrike-falcon-json-app-login-userauth ↳crowdstrike-falcon-json-app-login-fdritemsexplorer ↳crowdstrike-falcon-cef-app-login-success-startevent ↳crowdstrike-falcon-json-app-login-sso ↳crowdstrike-falcon-sk4-app-login-authentication ↳crowdstrike-falcon-json-app-login-authentication authentication-failed ↳crowdstrike-falcon-json-endpoint-login-fail-userlogonfail ↳crowdstrike-falcon-json-endpoint-login-fail-userlogonfail-1 ↳crowdstrike-falcon-sk4-endpoint-login-userloginfail ↳crowdstrike-falcon-json-endpoint-login-fail-userlogonfail ↳crowdstrike-falcon-json-endpoint-login-fail-userlogonfail-1 ↳crowdstrike-falcon-sk4-endpoint-login-userloginfail ↳crowdstrike-falcon-json-endpoint-login-fail-userlogonfail ↳crowdstrike-falcon-json-endpoint-login-fail-userlogonfail-1 ↳crowdstrike-falcon-sk4-endpoint-login-userloginfail ↳crowdstrike-falcon-json-endpoint-login-fail-userlogonfail ↳crowdstrike-falcon-json-endpoint-login-fail-userlogonfail-1 ↳crowdstrike-falcon-sk4-endpoint-login-userloginfail authentication-successful ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin batch-logon ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin failed-app-login ↳crowdstrike-falcon-json-app-login-sso ↳crowdstrike-falcon-json-app-login-streamstarted-1 ↳crowdstrike-falcon-cef-app-login-accepteula ↳crowdstrike-falcon-json-app-login-createapi ↳crowdstrike-falcon-leef-app-login-falconhost ↳crowdstrike-falcon-json-app-login-twofactorauth ↳crowdstrike-falcon-json-app-login-streamstarted ↳crowdstrike-falcon-cef-app-login-authactivity ↳crowdstrike-falcon-json-app-login-apiactivityauditevent ↳crowdstrike-falcon-json-app-login-success-assert ↳crowdstrike-falcon-json-app-login-userauth local-logon ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin logout-remote ↳crowdstrike-falcon-json-endpoint-logout-success-userlogoff ↳crowdstrike-falcon-json-endpoint-logout-success-userlogoff ↳crowdstrike-falcon-json-endpoint-logout-success-userlogoff ↳crowdstrike-falcon-json-endpoint-logout-success-userlogoff network-connection-failed ↳crowdstrike-falcon-kv-network-traffic-success-falconsensor ↳crowdstrike-falcon-kv-network-traffic-fail-unabletoconnect network-connection-successful ↳crowdstrike-falcon-leef-network-traffic-success-networkaccesses ↳crowdstrike-falcon-json-network-traffic-success-connectip ↳crowdstrike-falcon-kv-network-traffic-success-falconsensor ↳crowdstrike-falcon-json-network-traffic-success-networkreceiveaccept process-created ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename process-network ↳crowdstrike-falcon-json-network-session-success-listenip remote-access ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin remote-logon ↳crowdstrike-falcon-json-app-login-sso ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin security-alert ↳crowdstrike-falcon-json-alert-trigger-success-xdrdetection ↳crowdstrike-falcon-json-alert-trigger-success-automatedleadsummaryevent ↳crowdstrike-falcon-json-alert-trigger-success-identityprotection ↳crowdstrike-falcon-cef-alert-trigger-success-host ↳crowdstrike-falcon-mix-alert-trigger-success-detectionsummaryevent ↳crowdstrike-falcon-json-alert-trigger-success-xdrdetection ↳crowdstrike-falcon-json-alert-trigger-success-automatedleadsummaryevent ↳crowdstrike-falcon-json-alert-trigger-success-identityprotection ↳crowdstrike-falcon-cef-alert-trigger-success-host ↳crowdstrike-falcon-mix-alert-trigger-success-detectionsummaryevent ↳crowdstrike-falcon-json-alert-trigger-success-dllinjection ↳crowdstrike-falcon-json-alert-trigger-success-dllinjection ↳crowdstrike-falcon-json-alert-trigger-success-dllinjection ↳crowdstrike-falcon-json-alert-trigger-success-dllinjection ↳crowdstrike-falcon-mix-alert-trigger-success-detection ↳crowdstrike-falcon-mix-alert-trigger-success-detection ↳crowdstrike-falcon-sk4-alert-trigger-lsasshandlefromunsignedmodule ↳crowdstrike-falcon-json-alert-trigger-firewallmatchevent ↳crowdstrike-falcon-json-alert-trigger-success-reconnotification ↳crowdstrike-falcon-json-alert-trigger-success-cspmsearchstreamingevent ↳crowdstrike-falcon-sk4-alert-trigger-firewallmatchevent ↳crowdstrike-falcon-sk4-alert-trigger-success-idpdetection ↳crowdstrike-falcon-json-alert-trigger-success-cspmioastreamingevent ↳crowdstrike-falcon-json-alert-trigger-success-idpdetection ↳crowdstrike-falcon-sk4-alert-trigger-success-idpdetection ↳crowdstrike-falcon-json-alert-trigger-success-cspmioastreamingevent ↳crowdstrike-falcon-json-alert-trigger-success-idpdetection ↳crowdstrike-falcon-leef-alert-trigger-success-falconhost ↳crowdstrike-falcon-json-alert-trigger-success-mobiledetection ↳crowdstrike-falcon-json-alert-trigger-success-mobiledetection ↳crowdstrike-falcon-cef-app-activity-useractivityauditevent-1 ↳crowdstrike-falcon-cef-app-activity-useractivityauditevent service-logon ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin share-access ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename	T1018 - Remote System Discovery T1021 - Remote Services T1021.001 - Remote Services: Remote Desktop Protocol T1021.002 - Remote Services: SMB/Windows Admin Shares T1021.003 - T1021.003 T1021.006 - T1021.006 T1027 - Obfuscated Files or Information T1027.005 - Obfuscated Files or Information: Indicator Removal from Tools T1047 - Windows Management Instrumentation T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1071 - Application Layer Protocol T1078 - Valid Accounts T1090 - Proxy T1090.003 - Proxy: Multi-hop Proxy T1190 - Exploit Public Fasing Application T1210 - Exploitation of Remote Services T1219 - Remote Access Software T1550 - Use Alternate Authentication Material T1550.002 - Use Alternate Authentication Material: Pass the Hash T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1558 - Steal or Forge Kerberos Tickets T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1563 - Remote Service Session Hijacking T1563.002 - T1563.002 TA0008 - TA0008 TA0010 - TA0010 TA0011 - TA0011	131 Rules 42 Models
Malware	account-switch ↳crowdstrike-falcon-json-user-switch-sudocommandattempt ↳crowdstrike-falcon-json-user-switch-sudocommandattempt ↳crowdstrike-falcon-json-user-switch-sudocommandattempt ↳crowdstrike-falcon-json-user-switch-sudocommandattempt app-login ↳crowdstrike-falcon-json-app-login-streamstarted-1 ↳crowdstrike-falcon-cef-app-login-accepteula ↳crowdstrike-falcon-json-app-login-createapi ↳crowdstrike-falcon-leef-app-login-falconhost ↳crowdstrike-falcon-json-app-login-twofactorauth ↳crowdstrike-falcon-json-app-login-streamstarted ↳crowdstrike-falcon-cef-app-login-authactivity ↳crowdstrike-falcon-json-app-login-apiactivityauditevent ↳crowdstrike-falcon-cef-app-login-success-assert-1 ↳crowdstrike-falcon-json-app-login-success-assert ↳crowdstrike-falcon-json-app-login-userauth ↳crowdstrike-falcon-json-app-login-fdritemsexplorer ↳crowdstrike-falcon-cef-app-login-success-startevent ↳crowdstrike-falcon-json-app-login-sso ↳crowdstrike-falcon-sk4-app-login-authentication ↳crowdstrike-falcon-json-app-login-authentication authentication-successful ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin batch-logon ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin dns-query ↳crowdstrike-falcon-mix-dns-request-success-dnsrequest ↳crowdstrike-falcon-sk4-alert-trigger-suspiciousdnsrequest file-alert ↳crowdstrike-falcon-sk4-alert-trigger-success-quarantinedfilestate ↳crowdstrike-falcon-sk4-alert-trigger-success-quarantinedfilestate ↳crowdstrike-falcon-sk4-alert-trigger-success-quarantinedfilestate ↳crowdstrike-falcon-sk4-alert-trigger-success-quarantinedfilestate file-write ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted image-loaded ↳crowdstrike-falcon-json-process-create-success-classifiedmoduleload ↳crowdstrike-falcon-json-dll-load-imagehash ↳crowdstrike-falcon-json-process-create-success-classifiedmoduleload ↳crowdstrike-falcon-json-dll-load-imagehash ↳crowdstrike-falcon-json-process-create-success-classifiedmoduleload ↳crowdstrike-falcon-json-dll-load-imagehash ↳crowdstrike-falcon-json-process-create-success-classifiedmoduleload ↳crowdstrike-falcon-json-dll-load-imagehash local-logon ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin network-connection-failed ↳crowdstrike-falcon-kv-network-traffic-success-falconsensor ↳crowdstrike-falcon-kv-network-traffic-fail-unabletoconnect network-connection-successful ↳crowdstrike-falcon-leef-network-traffic-success-networkaccesses ↳crowdstrike-falcon-json-network-traffic-success-connectip ↳crowdstrike-falcon-kv-network-traffic-success-falconsensor ↳crowdstrike-falcon-json-network-traffic-success-networkreceiveaccept process-alert ↳crowdstrike-falcon-mix-alert-trigger-success-suspiciousactivity ↳crowdstrike-falcon-mix-alert-trigger-success-suspiciousactivity ↳crowdstrike-falcon-json-alert-trigger-success-processblock ↳crowdstrike-falcon-sk4-alert-trigger-userexceptiondep ↳crowdstrike-falcon-json-alert-trigger-success-processblock ↳crowdstrike-falcon-sk4-alert-trigger-userexceptiondep ↳crowdstrike-falcon-json-alert-trigger-success-processblock ↳crowdstrike-falcon-sk4-alert-trigger-userexceptiondep ↳crowdstrike-falcon-json-alert-trigger-success-processblock ↳crowdstrike-falcon-sk4-alert-trigger-userexceptiondep process-created ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename process-network ↳crowdstrike-falcon-json-network-session-success-listenip registry-write ↳crowdstrike-falcon-cef-registry-modify-asepkeyupdate ↳crowdstrike-falcon-json-registry-modify-success-reggenericvalueupdate ↳crowdstrike-falcon-cef-registry-modify-asepvalueupdate ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename remote-access ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin remote-logon ↳crowdstrike-falcon-json-app-login-sso ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin security-alert ↳crowdstrike-falcon-json-alert-trigger-success-xdrdetection ↳crowdstrike-falcon-json-alert-trigger-success-automatedleadsummaryevent ↳crowdstrike-falcon-json-alert-trigger-success-identityprotection ↳crowdstrike-falcon-cef-alert-trigger-success-host ↳crowdstrike-falcon-mix-alert-trigger-success-detectionsummaryevent ↳crowdstrike-falcon-json-alert-trigger-success-xdrdetection ↳crowdstrike-falcon-json-alert-trigger-success-automatedleadsummaryevent ↳crowdstrike-falcon-json-alert-trigger-success-identityprotection ↳crowdstrike-falcon-cef-alert-trigger-success-host ↳crowdstrike-falcon-mix-alert-trigger-success-detectionsummaryevent ↳crowdstrike-falcon-json-alert-trigger-success-dllinjection ↳crowdstrike-falcon-json-alert-trigger-success-dllinjection ↳crowdstrike-falcon-json-alert-trigger-success-dllinjection ↳crowdstrike-falcon-json-alert-trigger-success-dllinjection ↳crowdstrike-falcon-mix-alert-trigger-success-detection ↳crowdstrike-falcon-mix-alert-trigger-success-detection ↳crowdstrike-falcon-sk4-alert-trigger-lsasshandlefromunsignedmodule ↳crowdstrike-falcon-json-alert-trigger-firewallmatchevent ↳crowdstrike-falcon-json-alert-trigger-success-reconnotification ↳crowdstrike-falcon-json-alert-trigger-success-cspmsearchstreamingevent ↳crowdstrike-falcon-sk4-alert-trigger-firewallmatchevent ↳crowdstrike-falcon-sk4-alert-trigger-success-idpdetection ↳crowdstrike-falcon-json-alert-trigger-success-cspmioastreamingevent ↳crowdstrike-falcon-json-alert-trigger-success-idpdetection ↳crowdstrike-falcon-sk4-alert-trigger-success-idpdetection ↳crowdstrike-falcon-json-alert-trigger-success-cspmioastreamingevent ↳crowdstrike-falcon-json-alert-trigger-success-idpdetection ↳crowdstrike-falcon-leef-alert-trigger-success-falconhost ↳crowdstrike-falcon-json-alert-trigger-success-mobiledetection ↳crowdstrike-falcon-json-alert-trigger-success-mobiledetection ↳crowdstrike-falcon-cef-app-activity-useractivityauditevent-1 ↳crowdstrike-falcon-cef-app-activity-useractivityauditevent service-created ↳crowdstrike-falcon-json-process-create-success-createservice ↳crowdstrike-falcon-json-process-create-success-createservice ↳crowdstrike-falcon-json-process-create-success-createservice ↳crowdstrike-falcon-json-process-create-success-createservice service-logon ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin share-access ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename	T1003 - OS Credential Dumping T1003.002 - T1003.002 T1012 - Query Registry T1021 - Remote Services T1021.002 - Remote Services: SMB/Windows Admin Shares T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1036 - Masquerading T1036.004 - T1036.004 T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.003 - T1053.003 T1053.005 - Scheduled Task/Job: Scheduled Task T1055 - Process Injection T1055.001 - Process Injection: Dynamic-link Library Injection T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1059.005 - T1059.005 T1059.007 - T1059.007 T1071 - Application Layer Protocol T1072 - Software Deployment Tools T1078 - Valid Accounts T1083 - File and Directory Discovery T1105 - Ingress Tool Transfer T1112 - Modify Registry T1113 - Screen Capture T1123 - Audio Capture T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134 - Access Token Manipulation T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1134.002 - T1134.002 T1135 - Network Share Discovery T1190 - Exploit Public Fasing Application T1197 - BITS Jobs T1202 - Indirect Command Execution T1203 - Exploitation for Client Execution T1204 - User Execution T1204.002 - T1204.002 T1210 - Exploitation of Remote Services T1218 - Signed Binary Proxy Execution T1218.001 - Signed Binary Proxy Execution: Compiled HTML File T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.004 - Signed Binary Proxy Execution: InstallUtil T1218.005 - T1218.005 T1218.007 - Signed Binary Proxy Execution: Msiexec T1218.008 - T1218.008 T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1218.011 - Signed Binary Proxy Execution: Rundll32 T1482 - Domain Trust Discovery T1490 - Inhibit System Recovery T1505 - Server Software Component T1505.003 - Server Software Component: Web Shell T1543 - Create or Modify System Process T1543.003 - Create or Modify System Process: Windows Service T1546 - Event Triggered Execution T1546.001 - T1546.001 T1546.003 - T1546.003 T1546.011 - T1546.011 T1547 - Boot or Logon Autostart Execution T1547.001 - T1547.001 T1547.002 - T1547.002 T1550 - Use Alternate Authentication Material T1550.003 - Use Alternate Authentication Material: Pass the Ticket T1555 - Credentials from Password Stores T1558 - Steal or Forge Kerberos Tickets T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1562 - Impair Defenses T1562.004 - Impair Defenses: Disable or Modify System Firewall T1563 - Remote Service Session Hijacking T1563.002 - T1563.002 T1568 - Dynamic Resolution T1568.002 - Dynamic Resolution: Domain Generation Algorithms T1569 - System Services T1569.002 - T1569.002 T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.010 - T1574.010 T1574.011 - T1574.011 T1583 - T1583 T1583.001 - T1583.001 TA0002 - TA0002 TA0010 - TA0010 TA0011 - TA0011	216 Rules 46 Models
Phishing	process-created ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename	T1566 - Phishing T1566.001 - T1566.001	1 Rules
Privilege Abuse	account-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted account-switch ↳crowdstrike-falcon-json-user-switch-sudocommandattempt ↳crowdstrike-falcon-json-user-switch-sudocommandattempt ↳crowdstrike-falcon-json-user-switch-sudocommandattempt ↳crowdstrike-falcon-json-user-switch-sudocommandattempt app-activity ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-cef-app-activity-deleteuser ↳crowdstrike-falcon-cef-app-activity-createuser ↳crowdstrike-falcon-cef-app-activity-grantuserroles ↳crowdstrike-falcon-cef-app-activity-revokeuserroles ↳crowdstrike-falcon-cef-app-activity-useraccountadded ↳crowdstrike-falcon-sk4-app-activity-success-resetapiclientsecret ↳crowdstrike-falcon-json-app-activity-success-scriptcontrolscantelemetry ↳crowdstrike-falcon-json-app-activity-eambypassevent ↳crowdstrike-falcon-json-app-activity-idpentityriskscorechange ↳crowdstrike-falcon-json-app-activity-success-falcon_device ↳crowdstrike-falcon-sk4-app-activity-success-authactivityauditevent ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-json-service-stop-success-hostedservicestopped ↳crowdstrike-falcon-json-service-stop-success-hostedservicestopped ↳crowdstrike-falcon-json-service-stop-success-hostedservicestopped ↳crowdstrike-falcon-cef-endpoint-notification-discovererdevicetype ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-cef-app-activity-useractivityauditevent-1 ↳crowdstrike-falcon-cef-app-activity-useractivityauditevent app-activity-failed ↳crowdstrike-falcon-cef-app-activity-deleteuser ↳crowdstrike-falcon-cef-app-activity-createuser ↳crowdstrike-falcon-cef-app-activity-grantuserroles ↳crowdstrike-falcon-cef-app-activity-revokeuserroles ↳crowdstrike-falcon-cef-app-activity-useraccountadded app-login ↳crowdstrike-falcon-json-app-login-streamstarted-1 ↳crowdstrike-falcon-cef-app-login-accepteula ↳crowdstrike-falcon-json-app-login-createapi ↳crowdstrike-falcon-leef-app-login-falconhost ↳crowdstrike-falcon-json-app-login-twofactorauth ↳crowdstrike-falcon-json-app-login-streamstarted ↳crowdstrike-falcon-cef-app-login-authactivity ↳crowdstrike-falcon-json-app-login-apiactivityauditevent ↳crowdstrike-falcon-cef-app-login-success-assert-1 ↳crowdstrike-falcon-json-app-login-success-assert ↳crowdstrike-falcon-json-app-login-userauth ↳crowdstrike-falcon-json-app-login-fdritemsexplorer ↳crowdstrike-falcon-cef-app-login-success-startevent ↳crowdstrike-falcon-json-app-login-sso ↳crowdstrike-falcon-sk4-app-login-authentication ↳crowdstrike-falcon-json-app-login-authentication batch-logon ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin failed-app-login ↳crowdstrike-falcon-json-app-login-sso ↳crowdstrike-falcon-json-app-login-streamstarted-1 ↳crowdstrike-falcon-cef-app-login-accepteula ↳crowdstrike-falcon-json-app-login-createapi ↳crowdstrike-falcon-leef-app-login-falconhost ↳crowdstrike-falcon-json-app-login-twofactorauth ↳crowdstrike-falcon-json-app-login-streamstarted ↳crowdstrike-falcon-cef-app-login-authactivity ↳crowdstrike-falcon-json-app-login-apiactivityauditevent ↳crowdstrike-falcon-json-app-login-success-assert ↳crowdstrike-falcon-json-app-login-userauth file-alert ↳crowdstrike-falcon-sk4-alert-trigger-success-quarantinedfilestate ↳crowdstrike-falcon-sk4-alert-trigger-success-quarantinedfilestate ↳crowdstrike-falcon-sk4-alert-trigger-success-quarantinedfilestate ↳crowdstrike-falcon-sk4-alert-trigger-success-quarantinedfilestate file-delete ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-executabledeleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-executabledeleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-executabledeleted file-download ↳crowdstrike-falcon-cef-file-download-success-loadconfirmation ↳crowdstrike-falcon-json-file-download-success-bitsjobcreated ↳crowdstrike-falcon-cef-file-download-success-loadconfirmation ↳crowdstrike-falcon-json-file-download-success-bitsjobcreated ↳crowdstrike-falcon-cef-file-download-success-loadconfirmation ↳crowdstrike-falcon-json-file-download-success-bitsjobcreated ↳crowdstrike-falcon-cef-file-download-success-loadconfirmation ↳crowdstrike-falcon-json-file-download-success-bitsjobcreated file-read ↳crowdstrike-falcon-leef-file-read-success-documentsaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed-1 ↳crowdstrike-falcon-json-file-read-success-ransomware ↳crowdstrike-falcon-leef-file-read-success-documentsaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed-1 ↳crowdstrike-falcon-json-file-read-success-ransomware ↳crowdstrike-falcon-leef-file-read-success-documentsaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed-1 ↳crowdstrike-falcon-json-file-read-success-ransomware ↳crowdstrike-falcon-leef-file-read-success-documentsaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed-1 ↳crowdstrike-falcon-json-file-read-success-ransomware ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info file-write ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted local-logon ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin process-created ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename remote-access ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin remote-logon ↳crowdstrike-falcon-json-app-login-sso ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin service-created ↳crowdstrike-falcon-json-process-create-success-createservice ↳crowdstrike-falcon-json-process-create-success-createservice ↳crowdstrike-falcon-json-process-create-success-createservice ↳crowdstrike-falcon-json-process-create-success-createservice service-logon ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin	T1021 - Remote Services T1047 - Windows Management Instrumentation T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1078 - Valid Accounts T1078.002 - T1078.002 T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1136 - Create Account T1136.001 - Create Account: Create: Local Account T1531 - Account Access Removal T1543 - Create or Modify System Process T1543.003 - Create or Modify System Process: Windows Service	34 Rules 15 Models
Privilege Escalation	account-switch ↳crowdstrike-falcon-json-user-switch-sudocommandattempt ↳crowdstrike-falcon-json-user-switch-sudocommandattempt ↳crowdstrike-falcon-json-user-switch-sudocommandattempt ↳crowdstrike-falcon-json-user-switch-sudocommandattempt app-activity ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-cef-app-activity-deleteuser ↳crowdstrike-falcon-cef-app-activity-createuser ↳crowdstrike-falcon-cef-app-activity-grantuserroles ↳crowdstrike-falcon-cef-app-activity-revokeuserroles ↳crowdstrike-falcon-cef-app-activity-useraccountadded ↳crowdstrike-falcon-sk4-app-activity-success-resetapiclientsecret ↳crowdstrike-falcon-json-app-activity-success-scriptcontrolscantelemetry ↳crowdstrike-falcon-json-app-activity-eambypassevent ↳crowdstrike-falcon-json-app-activity-idpentityriskscorechange ↳crowdstrike-falcon-json-app-activity-success-falcon_device ↳crowdstrike-falcon-sk4-app-activity-success-authactivityauditevent ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-json-service-stop-success-hostedservicestopped ↳crowdstrike-falcon-json-service-stop-success-hostedservicestopped ↳crowdstrike-falcon-json-service-stop-success-hostedservicestopped ↳crowdstrike-falcon-cef-endpoint-notification-discovererdevicetype ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-cef-app-activity-useractivityauditevent-1 ↳crowdstrike-falcon-cef-app-activity-useractivityauditevent local-logon ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin process-created ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename remote-access ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin remote-logon ↳crowdstrike-falcon-json-app-login-sso ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin service-created ↳crowdstrike-falcon-json-process-create-success-createservice ↳crowdstrike-falcon-json-process-create-success-createservice ↳crowdstrike-falcon-json-process-create-success-createservice ↳crowdstrike-falcon-json-process-create-success-createservice share-access ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename	T1003 - OS Credential Dumping T1007 - System Service Discovery T1012 - Query Registry T1016 - System Network Configuration Discovery T1018 - Remote System Discovery T1021 - Remote Services T1021.002 - Remote Services: SMB/Windows Admin Shares T1027 - Obfuscated Files or Information T1027.004 - Obfuscated Files or Information: Compile After Delivery T1033 - System Owner/User Discovery T1036 - Masquerading T1036.004 - T1036.004 T1047 - Windows Management Instrumentation T1049 - System Network Connections Discovery T1053 - Scheduled Task/Job T1053.002 - Scheduled Task/Job: At (Windows) T1053.005 - Scheduled Task/Job: Scheduled Task T1057 - Process Discovery T1059 - Command and Scripting Interperter T1059.001 - Command and Scripting Interperter: PowerShell T1059.003 - T1059.003 T1068 - Exploitation for Privilege Escalation T1078 - Valid Accounts T1082 - System Information Discovery T1087 - Account Discovery T1087.001 - Account Discovery: Local Account T1087.002 - Account Discovery: Domain Account T1098 - Account Manipulation T1098.002 - Account Manipulation: Exchange Email Delegate Permissions T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild T1134 - Access Token Manipulation T1134.001 - Access Token Manipulation: Token Impersonation/Theft T1134.002 - T1134.002 T1135 - Network Share Discovery T1218 - Signed Binary Proxy Execution T1218.002 - Signed Binary Proxy Execution: Control Panel T1218.003 - Signed Binary Proxy Execution: CMSTP T1218.010 - Signed Binary Proxy Execution: Regsvr32 T1218.011 - Signed Binary Proxy Execution: Rundll32 T1222 - File and Directory Permissions Modification T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification T1482 - Domain Trust Discovery T1484 - Group Policy Modification T1484.001 - T1484.001 T1518 - Software Discovery T1518.001 - T1518.001 T1543 - Create or Modify System Process T1543.003 - Create or Modify System Process: Windows Service T1547 - Boot or Logon Autostart Execution T1547.002 - T1547.002 T1548 - Abuse Elevation Control Mechanism T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control T1552 - Unsecured Credentials T1552.006 - T1552.006 T1555 - Credentials from Password Stores T1555.005 - T1555.005 T1558 - Steal or Forge Kerberos Tickets T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1574 - Hijack Execution Flow T1574.002 - Hijack Execution Flow: DLL Side-Loading T1574.011 - T1574.011	66 Rules 17 Models
Privileged Activity	account-switch ↳crowdstrike-falcon-json-user-switch-sudocommandattempt ↳crowdstrike-falcon-json-user-switch-sudocommandattempt ↳crowdstrike-falcon-json-user-switch-sudocommandattempt ↳crowdstrike-falcon-json-user-switch-sudocommandattempt app-activity ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-cef-app-activity-deleteuser ↳crowdstrike-falcon-cef-app-activity-createuser ↳crowdstrike-falcon-cef-app-activity-grantuserroles ↳crowdstrike-falcon-cef-app-activity-revokeuserroles ↳crowdstrike-falcon-cef-app-activity-useraccountadded ↳crowdstrike-falcon-sk4-app-activity-success-resetapiclientsecret ↳crowdstrike-falcon-json-app-activity-success-scriptcontrolscantelemetry ↳crowdstrike-falcon-json-app-activity-eambypassevent ↳crowdstrike-falcon-json-app-activity-idpentityriskscorechange ↳crowdstrike-falcon-json-app-activity-success-falcon_device ↳crowdstrike-falcon-sk4-app-activity-success-authactivityauditevent ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-json-process-create-success-installedapplication ↳crowdstrike-falcon-json-process-create-success-configstateupdate ↳crowdstrike-falcon-json-process-create-success-currentsystemtags ↳crowdstrike-falcon-json-process-create-success-deliverlocalfxtocloud ↳crowdstrike-falcon-json-process-create-success-agentconnect ↳crowdstrike-falcon-json-app-activity-scriptcontrolscaninfo ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-sk4-endpoint-notification-timestamp ↳crowdstrike-falcon-json-service-stop-success-hostedservicestopped ↳crowdstrike-falcon-json-service-stop-success-hostedservicestopped ↳crowdstrike-falcon-json-service-stop-success-hostedservicestopped ↳crowdstrike-falcon-cef-endpoint-notification-discovererdevicetype ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-cef-app-activity-useractivityauditevent-1 ↳crowdstrike-falcon-cef-app-activity-useractivityauditevent app-activity-failed ↳crowdstrike-falcon-cef-app-activity-deleteuser ↳crowdstrike-falcon-cef-app-activity-createuser ↳crowdstrike-falcon-cef-app-activity-grantuserroles ↳crowdstrike-falcon-cef-app-activity-revokeuserroles ↳crowdstrike-falcon-cef-app-activity-useraccountadded app-login ↳crowdstrike-falcon-json-app-login-streamstarted-1 ↳crowdstrike-falcon-cef-app-login-accepteula ↳crowdstrike-falcon-json-app-login-createapi ↳crowdstrike-falcon-leef-app-login-falconhost ↳crowdstrike-falcon-json-app-login-twofactorauth ↳crowdstrike-falcon-json-app-login-streamstarted ↳crowdstrike-falcon-cef-app-login-authactivity ↳crowdstrike-falcon-json-app-login-apiactivityauditevent ↳crowdstrike-falcon-cef-app-login-success-assert-1 ↳crowdstrike-falcon-json-app-login-success-assert ↳crowdstrike-falcon-json-app-login-userauth ↳crowdstrike-falcon-json-app-login-fdritemsexplorer ↳crowdstrike-falcon-cef-app-login-success-startevent ↳crowdstrike-falcon-json-app-login-sso ↳crowdstrike-falcon-sk4-app-login-authentication ↳crowdstrike-falcon-json-app-login-authentication failed-app-login ↳crowdstrike-falcon-json-app-login-sso ↳crowdstrike-falcon-json-app-login-streamstarted-1 ↳crowdstrike-falcon-cef-app-login-accepteula ↳crowdstrike-falcon-json-app-login-createapi ↳crowdstrike-falcon-leef-app-login-falconhost ↳crowdstrike-falcon-json-app-login-twofactorauth ↳crowdstrike-falcon-json-app-login-streamstarted ↳crowdstrike-falcon-cef-app-login-authactivity ↳crowdstrike-falcon-json-app-login-apiactivityauditevent ↳crowdstrike-falcon-json-app-login-success-assert ↳crowdstrike-falcon-json-app-login-userauth file-alert ↳crowdstrike-falcon-sk4-alert-trigger-success-quarantinedfilestate ↳crowdstrike-falcon-sk4-alert-trigger-success-quarantinedfilestate ↳crowdstrike-falcon-sk4-alert-trigger-success-quarantinedfilestate ↳crowdstrike-falcon-sk4-alert-trigger-success-quarantinedfilestate file-delete ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-executabledeleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-executabledeleted ↳crowdstrike-falcon-json-file-delete-success-deleted ↳crowdstrike-falcon-json-file-delete-success-executabledeleted file-download ↳crowdstrike-falcon-cef-file-download-success-loadconfirmation ↳crowdstrike-falcon-json-file-download-success-bitsjobcreated ↳crowdstrike-falcon-cef-file-download-success-loadconfirmation ↳crowdstrike-falcon-json-file-download-success-bitsjobcreated ↳crowdstrike-falcon-cef-file-download-success-loadconfirmation ↳crowdstrike-falcon-json-file-download-success-bitsjobcreated ↳crowdstrike-falcon-cef-file-download-success-loadconfirmation ↳crowdstrike-falcon-json-file-download-success-bitsjobcreated file-read ↳crowdstrike-falcon-leef-file-read-success-documentsaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed-1 ↳crowdstrike-falcon-json-file-read-success-ransomware ↳crowdstrike-falcon-leef-file-read-success-documentsaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed-1 ↳crowdstrike-falcon-json-file-read-success-ransomware ↳crowdstrike-falcon-leef-file-read-success-documentsaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed-1 ↳crowdstrike-falcon-json-file-read-success-ransomware ↳crowdstrike-falcon-leef-file-read-success-documentsaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed ↳crowdstrike-falcon-json-file-read-success-criticalfileaccessed-1 ↳crowdstrike-falcon-json-file-read-success-ransomware ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info file-write ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted local-logon ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin process-created ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename remote-access ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin remote-logon ↳crowdstrike-falcon-json-app-login-sso ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin security-alert ↳crowdstrike-falcon-json-alert-trigger-success-xdrdetection ↳crowdstrike-falcon-json-alert-trigger-success-automatedleadsummaryevent ↳crowdstrike-falcon-json-alert-trigger-success-identityprotection ↳crowdstrike-falcon-cef-alert-trigger-success-host ↳crowdstrike-falcon-mix-alert-trigger-success-detectionsummaryevent ↳crowdstrike-falcon-json-alert-trigger-success-xdrdetection ↳crowdstrike-falcon-json-alert-trigger-success-automatedleadsummaryevent ↳crowdstrike-falcon-json-alert-trigger-success-identityprotection ↳crowdstrike-falcon-cef-alert-trigger-success-host ↳crowdstrike-falcon-mix-alert-trigger-success-detectionsummaryevent ↳crowdstrike-falcon-json-alert-trigger-success-dllinjection ↳crowdstrike-falcon-json-alert-trigger-success-dllinjection ↳crowdstrike-falcon-json-alert-trigger-success-dllinjection ↳crowdstrike-falcon-json-alert-trigger-success-dllinjection ↳crowdstrike-falcon-mix-alert-trigger-success-detection ↳crowdstrike-falcon-mix-alert-trigger-success-detection ↳crowdstrike-falcon-sk4-alert-trigger-lsasshandlefromunsignedmodule ↳crowdstrike-falcon-json-alert-trigger-firewallmatchevent ↳crowdstrike-falcon-json-alert-trigger-success-reconnotification ↳crowdstrike-falcon-json-alert-trigger-success-cspmsearchstreamingevent ↳crowdstrike-falcon-sk4-alert-trigger-firewallmatchevent ↳crowdstrike-falcon-sk4-alert-trigger-success-idpdetection ↳crowdstrike-falcon-json-alert-trigger-success-cspmioastreamingevent ↳crowdstrike-falcon-json-alert-trigger-success-idpdetection ↳crowdstrike-falcon-sk4-alert-trigger-success-idpdetection ↳crowdstrike-falcon-json-alert-trigger-success-cspmioastreamingevent ↳crowdstrike-falcon-json-alert-trigger-success-idpdetection ↳crowdstrike-falcon-leef-alert-trigger-success-falconhost ↳crowdstrike-falcon-json-alert-trigger-success-mobiledetection ↳crowdstrike-falcon-json-alert-trigger-success-mobiledetection ↳crowdstrike-falcon-cef-app-activity-useractivityauditevent-1 ↳crowdstrike-falcon-cef-app-activity-useractivityauditevent service-created ↳crowdstrike-falcon-json-process-create-success-createservice ↳crowdstrike-falcon-json-process-create-success-createservice ↳crowdstrike-falcon-json-process-create-success-createservice ↳crowdstrike-falcon-json-process-create-success-createservice	T1021 - Remote Services T1053 - Scheduled Task/Job T1053.005 - Scheduled Task/Job: Scheduled Task T1068 - Exploitation for Privilege Escalation T1078 - Valid Accounts T1078.002 - T1078.002 T1482 - Domain Trust Discovery T1543 - Create or Modify System Process T1543.003 - Create or Modify System Process: Windows Service	26 Rules 8 Models
Ransomware	app-login ↳crowdstrike-falcon-json-app-login-streamstarted-1 ↳crowdstrike-falcon-cef-app-login-accepteula ↳crowdstrike-falcon-json-app-login-createapi ↳crowdstrike-falcon-leef-app-login-falconhost ↳crowdstrike-falcon-json-app-login-twofactorauth ↳crowdstrike-falcon-json-app-login-streamstarted ↳crowdstrike-falcon-cef-app-login-authactivity ↳crowdstrike-falcon-json-app-login-apiactivityauditevent ↳crowdstrike-falcon-cef-app-login-success-assert-1 ↳crowdstrike-falcon-json-app-login-success-assert ↳crowdstrike-falcon-json-app-login-userauth ↳crowdstrike-falcon-json-app-login-fdritemsexplorer ↳crowdstrike-falcon-cef-app-login-success-startevent ↳crowdstrike-falcon-json-app-login-sso ↳crowdstrike-falcon-sk4-app-login-authentication ↳crowdstrike-falcon-json-app-login-authentication authentication-failed ↳crowdstrike-falcon-json-endpoint-login-fail-userlogonfail ↳crowdstrike-falcon-json-endpoint-login-fail-userlogonfail-1 ↳crowdstrike-falcon-sk4-endpoint-login-userloginfail ↳crowdstrike-falcon-json-endpoint-login-fail-userlogonfail ↳crowdstrike-falcon-json-endpoint-login-fail-userlogonfail-1 ↳crowdstrike-falcon-sk4-endpoint-login-userloginfail ↳crowdstrike-falcon-json-endpoint-login-fail-userlogonfail ↳crowdstrike-falcon-json-endpoint-login-fail-userlogonfail-1 ↳crowdstrike-falcon-sk4-endpoint-login-userloginfail ↳crowdstrike-falcon-json-endpoint-login-fail-userlogonfail ↳crowdstrike-falcon-json-endpoint-login-fail-userlogonfail-1 ↳crowdstrike-falcon-sk4-endpoint-login-userloginfail authentication-successful ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin failed-app-login ↳crowdstrike-falcon-json-app-login-sso ↳crowdstrike-falcon-json-app-login-streamstarted-1 ↳crowdstrike-falcon-cef-app-login-accepteula ↳crowdstrike-falcon-json-app-login-createapi ↳crowdstrike-falcon-leef-app-login-falconhost ↳crowdstrike-falcon-json-app-login-twofactorauth ↳crowdstrike-falcon-json-app-login-streamstarted ↳crowdstrike-falcon-cef-app-login-authactivity ↳crowdstrike-falcon-json-app-login-apiactivityauditevent ↳crowdstrike-falcon-json-app-login-success-assert ↳crowdstrike-falcon-json-app-login-userauth file-write ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-cef-file-success-info ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-machofilewritten ↳crowdstrike-falcon-json-file-write-success-modifyservicebinary ↳crowdstrike-falcon-json-file-write-success-pefilewritten ↳crowdstrike-falcon-json-file-write-success-dwgfilewritten ↳crowdstrike-falcon-mix-file-write-success-directorycreate ↳crowdstrike-falcon-leef-file-write-success-executableswritten ↳crowdstrike-falcon-json-file-write-success-directorycreate ↳crowdstrike-falcon-json-file-write-success-olefilewritten ↳crowdstrike-falcon-json-file-write-success-renamed ↳crowdstrike-falcon-json-file-write-success-ooxmlfilewritten ↳crowdstrike-falcon-json-file-write-success-dmpfilewritten ↳crowdstrike-falcon-cef-file-write-success-unmounted ↳crowdstrike-falcon-json-file-write-success-pdffilewritten ↳crowdstrike-falcon-cef-file-write-success-critialfilemodified ↳crowdstrike-falcon-json-file-write-success-scriptfilewritteninfo ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted ↳crowdstrike-falcon-json-file-write-success-written ↳crowdstrike-falcon-sk4-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-written ↳crowdstrike-falcon-cef-file-write-success-fsvolumemounted process-created ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-processroll ↳crowdstrike-falcon-json-process-create-success-syntheticprocessroll ↳crowdstrike-falcon-json-process-create-success-processrollup ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-success-servicestarted ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-json-process-create-processrollup2stats ↳crowdstrike-falcon-json-process-create-syntheticprocessrollup2 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename ↳crowdstrike-falcon-sk4-app-activity-eventsimplename-1 ↳crowdstrike-falcon-sk4-app-activity-eventsimplename remote-logon ↳crowdstrike-falcon-json-app-login-sso ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin ↳crowdstrike-falcon-mix-endpoint-login-success-userlogon ↳crowdstrike-falcon-json-endpoint-login-userlogin	T1003 - OS Credential Dumping T1003.001 - T1003.001 T1059 - Command and Scripting Interperter T1059.003 - T1059.003 T1070 - Indicator Removal on Host T1070.001 - Indicator Removal on Host: Clear Windows Event Logs T1078 - Valid Accounts T1218 - Signed Binary Proxy Execution T1218.011 - Signed Binary Proxy Execution: Rundll32 T1222 - File and Directory Permissions Modification T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification T1486 - Data Encrypted for Impact T1490 - Inhibit System Recovery	6 Rules