edr:crowdstrike ProcessRollup2
ProcessRollup2
Stands in for win:sysmon 1 (full), win:security 4688 (full), linux:auditd EXECVE (full), linux:auditd SYSCALL:execve (full), linux:sysmon 1 (full)
- Log source
- CrowdStrike Falcon sensor telemetry (FDR event_simpleName)
- Host type
- EDR sensors (product telemetry, cross-platform)
- How to enable
- Falcon sensor deployed; raw events via Falcon Data Replicator (requires the FDR entitlement).
- Tier, host type
- Minimum
- Techniques
- 0
- Rules depending on it
- Splunk 478
Why this tier
ATT&CK via equivalence to win:sysmon 1; ATT&CK via equivalence to win:security 4688; ATT&CK via equivalence to linux:auditd EXECVE
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstationEDR path | Minimum | |
| Windows member serverEDR path | Minimum | |
| Windows domain controllerEDR path | Minimum | |
| Windows web server (IIS), internet-facingEDR path | Minimum | |
| Linux serverEDR path | Minimum | |
| Linux web server, internet-facingEDR path | Minimum | |
| macOS endpointEDR path | Minimum |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
400 of 478 rules are listed here: the dataset names at most this many per entry. The counts by vendor are complete.
Splunk 400 listed of 478
- 7zip CommandLine To SMB Share Path
- Add or Set Windows Defender Exclusion
- Advanced IP or Port Scanner Execution
- Allow File And Printing Sharing In Firewall
- Allow Network Discovery In Firewall
- Anomalous usage of 7zip
- Attacker Tools On Endpoint
- BCDEdit Failure Recovery Modification
- BITS Job Persistence
- BITSAdmin Download File
- Bcdedit Command Back To Normal Mode Boot
- CMD Carry Out String Command Parameter
- CMD Echo Pipe - Escalation
- CSC Net On The Fly Compilation
- CertUtil With Decode Argument
- Certutil exe certificate extraction
- Change To Safe Mode With Network Config
- Check Elevated CMD using whoami
- Clear Unallocated Sector Using Cipher App
- Clop Common Exec Parameter
- Conti Common Exec parameter
- Control Loading from World Writable Directory
- Create or delete windows shares using net exe
- Creation of Shadow Copy
- Creation of Shadow Copy with wmic and powershell
- Credential Dumping via Copy Command from Shadow Copy
- Credential Dumping via Symlink to Shadow Copy
- Curl Execution with Percent Encoded URL
- DNS Exfiltration Using Nslookup App
- DSQuery Domain Discovery
- Deleting Shadow Copies
- Detect AzureHound Command-Line Arguments
- Detect Certify Command Line Arguments
- Detect HTML Help Spawn Child Process
- Detect HTML Help URL in Command Line
- Detect HTML Help Using InfoTech Storage Handlers
- Detect MSHTA Url in Command Line
- Detect Path Interception By Creation Of program exe
- Detect Prohibited Applications Spawning cmd exe
- Detect PsExec With accepteula Flag
- Detect RClone Command-Line Usage
- Detect RTLO In Process
- Detect Rare Executables
- Detect Regasm Spawning a Process
- Detect Regasm with no Command Line Arguments
- Detect Regsvcs Spawning a Process
- Detect Regsvcs with No Command Line Arguments
- Detect Regsvr32 Application Control Bypass
- Detect Remote Access Software Usage Process
- Detect Rundll32 Inline HTA Execution
- Detect SharpHound Command-Line Arguments
- Detect SharpHound Usage
- Detect Use of cmd exe to Launch Script Interpreters
- Detect mshta inline hta execution
- Disable Logs Using WevtUtil
- Disable Schedule Task
- Disabling Firewall with Netsh
- Domain Account Discovery with Dsquery
- Domain Account Discovery with Wmic
- Domain Controller Discovery with Nltest
- Domain Controller Discovery with Wmic
- Domain Group Discovery With Dsquery
- Domain Group Discovery With Wmic
- Dump LSASS via comsvcs DLL
- Dump LSASS via procdump
- Elevated Group Discovery With Wmic
- Esentutl SAM Copy
- Excessive Attempt To Disable Services
- Excessive Usage Of Cacls App
- Excessive Usage Of Taskkill
- Excessive Usage of NSLOOKUP App
- Excessive distinct processes from Windows Temp
- Excessive number of service control start as disabled
- Excessive number of taskhost processes
- Execute Javascript With Jscript COM CLSID
- Execution of File with Multiple Extensions
- File Download or Read to Pipe Execution
- Firewall Allowed Program Enable
- First Time Seen Child Process of Zoom
- FodHelper UAC Bypass
- Fsutil Zeroing File
- Get ADDefaultDomainPasswordPolicy with Powershell
- Get ADUser with PowerShell
- Get ADUserResultantPasswordPolicy with Powershell
- Get DomainPolicy with Powershell
- Get DomainUser with PowerShell
- Get WMIObject Group Discovery
- Get-DomainTrust with PowerShell
- Get-ForestTrust with PowerShell
- GetAdComputer with PowerShell
- GetAdGroup with PowerShell
- GetCurrent User with PowerShell
- GetDomainComputer with PowerShell
- GetDomainController with PowerShell
- GetDomainGroup with PowerShell
- GetLocalUser with PowerShell
- GetNetTcpconnection with PowerShell
- GetWmiObject DS User with PowerShell
- GetWmiObject Ds Computer with PowerShell
- GetWmiObject Ds Group with PowerShell
- GetWmiObject User Account with PowerShell
- Headless Browser Mockbin or Mocky Request
- Headless Browser Usage
- Hiding Files And Directories With Attrib exe
- Hunting 3CXDesktopApp Software
- ICACLS Grant Command
- Icacls Deny Command
- Impacket Lateral Movement Commandline Parameters
- Impacket Lateral Movement WMIExec Commandline Parameters
- Impacket Lateral Movement smbexec CommandLine Parameters
- Inline PHP Code Execution
- Local Account Discovery With Wmic
- MSBuild Suspicious Spawned By Script Process
- Malicious PowerShell Process - Encoded Command
- Malicious PowerShell Process - Execution Policy Bypass
- Mimikatz PassTheTicket CommandLine Parameters
- Mmc LOLBAS Execution Process Spawn
- Modify ACL permission To Files Or Folder
- Mshta spawning Rundll32 OR Regsvr32 Process
- NLTest Domain Trust Discovery
- Network Connection Discovery With Arp
- Network Connection Discovery With Netstat
- Network Discovery Using Route Windows App
- Nishang PowershellTCPOneLine
- Notepad with no Command Line Arguments
- Ntdsutil Export NTDS
- Permission Modification using Takeown App
- Potential System Network Configuration Discovery Activity
- Potential Telegram API Request Via CommandLine
- PowerShell Get LocalGroup Discovery
- PowerShell Start-BitsTransfer
- Powershell Defender Threat Actions Set to Allow
- Powershell Disable Security Monitoring
- Prevent Automatic Repair Mode using Bcdedit
- Process Execution via WMI
- Process Kill Base On File Path
- Recursive Delete of Directory In Batch CMD
- Reg exe Manipulating Windows Services Registry Keys
- Regsvr32 Silent and Install Param Dll Loading
- Remote Desktop Process Running On System
- Remote Process Instantiation via DCOM and PowerShell
- Remote Process Instantiation via WMI
- Remote Process Instantiation via WMI and PowerShell
- Remote Process Instantiation via WinRM and PowerShell
- Remote Process Instantiation via WinRM and Winrs
- Remote System Discovery with Dsquery
- Remote System Discovery with Wmic
- Remote WMI Command Attempt
- Resize ShadowStorage volume
- Revil Common Exec Parameter
- Rubeus Command Line Parameters
- RunDLL Loading DLL By Ordinal
- Runas Execution in CommandLine
- Rundll32 Control RunDLL Hunt
- Rundll32 Control RunDLL World Writable Directory
- Rundll32 LockWorkStation
- Rundll32 Shimcache Flush
- Ryuk Wake on LAN Command
- SLUI RunAs Elevated
- SLUI Spawning a Process
- Scheduled Task Creation on Remote Endpoint using At
- Scheduled Task Deleted Or Created via CMD
- Scheduled Task Initiation on Remote Endpoint
- Schtasks Run Task On Demand
- Schtasks scheduling job on remote system
- Schtasks used for forcing a reboot
- Script Execution via WMI
- Sdelete Application Execution
- SecretDumps Offline NTDS Dumping Tool
- ServicePrincipalNames Discovery with SetSPN
- Services Escalate Exe
- Services LOLBAS Execution Process Spawn
- Shim Database Installation With Suspicious Parameters
- Single Letter Process On Endpoint
- Spoolsv Spawning Rundll32
- Suspicious Copy on System32
- Suspicious Curl Network Connection
- Suspicious DLLHost no Command Line Arguments
- Suspicious GPUpdate no Command Line Arguments
- Suspicious IcedID Rundll32 Cmdline
- Suspicious MSBuild Spawn
- Suspicious PlistBuddy Usage
- Suspicious Process Executed From Container File
- Suspicious Reg exe Process
- Suspicious Regsvr32 Register Suspicious Path
- Suspicious Rundll32 PluginInit
- Suspicious Rundll32 StartW
- Suspicious Rundll32 dllregisterserver
- Suspicious Rundll32 no Command Line Arguments
- Suspicious SQLite3 LSQuarantine Behavior
- Suspicious Scheduled Task from Public Directory
- Suspicious SearchProtocolHost no Command Line Arguments
- Suspicious microsoft workflow compiler usage
- Suspicious msbuild path
- Suspicious mshta child process
- Suspicious mshta spawn
- Suspicious wevtutil Usage
- System Info Gathering Using Dxdiag Application
- System Information Discovery Detection
- System Processes Run From Unexpected Locations
- System User Discovery With Query
- System User Discovery With Whoami
- USN Journal Deletion
- Uninstall App Using MsiExec
- Unload Sysmon Filter Driver
- Unusually Long Command Line
- User Discovery With Env Vars PowerShell
- Verclsid CLSID Execution
- WBAdmin Delete System Backups
- WMIC XSL Execution via URL
- Wermgr Process Spawned CMD Or Powershell Process
- WinRAR Spawning Shell Application
- WinRM Spawning a Process
- Windows AdFind Exe
- Windows Advanced Installer MSIX with AI_STUBS Execution
- Windows Apache Benchmark Binary
- Windows AppCertDLL Modification Via Command Line
- Windows Application Whitelisting Bypass Attempt via Rundll32
- Windows Archive Collected Data via Rar
- Windows Attempt To Stop Security Service
- Windows Audit Policy Auditing Option Disabled via Auditpol
- Windows Audit Policy Cleared via Auditpol
- Windows Audit Policy Disabled via Auditpol
- Windows Audit Policy Disabled via Legacy Auditpol
- Windows Audit Policy Excluded Category via Auditpol
- Windows Audit Policy Restored via Auditpol
- Windows Audit Policy Security Descriptor Tampering via Auditpol
- Windows AutoIt3 Execution
- Windows Azure Storage Utility Execution Via CLI
- Windows Binary Execution from an Archive
- Windows Binary Proxy Execution Mavinject DLL Injection
- Windows BitLocker Suspicious Command Usage
- Windows Bypass UAC via Pkgmgr Tool
- Windows COM Hijacking InprocServer32 Modification
- Windows Cabinet File Extraction Via Expand
- Windows Cached Domain Credentials Reg Query
- Windows Certutil Root Certificate Addition
- Windows Change File Association Command To Notepad
- Windows Chrome Enable Extension Loading via Command-Line
- Windows Chromium Browser Launched with Small Window Size
- Windows Chromium Browser No Security Sandbox Process
- Windows Chromium Browser with Custom User Data Directory
- Windows Chromium Process Launched with Logging Disabled
- Windows Chromium Process Loaded Extension via Command-Line
- Windows Chromium Process with Disabled Extensions
- Windows Chromium process Launched with Disable Popup Blocking
- Windows Cisco Secure Endpoint Stop Immunet Service Via Sfc
- Windows Cisco Secure Endpoint Unblock File Via Sfc
- Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc
- Windows Cmdline Tool Execution From Non-Shell Process
- Windows Command Obfuscation with Environment Variable Substrings
- Windows Command and Scripting Interpreter Hunting Path Traversal
- Windows Command and Scripting Interpreter Path Traversal Exec
- Windows Compatibility Telemetry Suspicious Child Process
- Windows ConHost with Headless Argument
- Windows Create Local Administrator Account Via Net
- Windows Credential Dumping LSASS Memory Createdump
- Windows Credentials from Password Stores Creation
- Windows Credentials from Password Stores Deletion
- Windows Credentials from Password Stores Query
- Windows Credentials in Registry Reg Query
- Windows Crowdstrike RTR Script Execution
- Windows Curl Download to Suspicious Path
- Windows Curl Upload to Remote Destination
- Windows DISM Remove Defender
- Windows DLL Search Order Hijacking with iscsicpl
- Windows DLL Side-Loading Process Child Of Calc
- Windows DNS Gather Network Info
- Windows Debugger Tool Execution
- Windows Default Group Policy Object Modified with GPME
- Windows Defender ASR or Threat Configuration Tamper
- Windows Delete or Modify System Firewall
- Windows Devtunnels Execution
- Windows Dir Piped to Findstr Activity
- Windows Disable Internet Explorer Addons
- Windows Disable Windows Event Logging Disable HTTP Logging
- Windows Disable or Modify Tools Via Taskkill
- Windows DiskCryptor Usage
- Windows Diskshadow Proxy Execution
- Windows DotNet Binary in Non Standard Path
- Windows EDRSilencer Execution
- Windows EFI Volume Mount Attempt Via Mountvol
- Windows ESX Admins Group Creation via Net
- Windows Entra User Management Via Azure CLI
- Windows EventLog Recon Activity Using Log Query Utilities
- Windows Eventlog Cleared Via Wevtutil
- Windows Excel Spawning Microsoft Project Application
- Windows Excessive Service Stop Attempt
- Windows Excessive Usage Of Net App
- Windows Execute Arbitrary Commands with MSDT
- Windows Execution of Microsoft MSC File In Suspicious Path
- Windows FFmpeg Audio and Video Device Discovery
- Windows FFmpeg DirectShow Video Capture
- Windows File Association Modification via Ftype
- Windows File Collection Via Copy Utilities
- Windows File Download Via CertUtil
- Windows File Download Via PowerShell
- Windows Files and Dirs Access Rights Modification Via Icacls
- Windows Findstr GPP Discovery
- Windows Finger.exe Connecting to a Remote Host
- Windows Gdrive Binary Activity
- Windows Get-Variable.EXE Execution from WindowsApps Folder
- Windows Global Object Access Audit List Cleared Via Auditpol
- Windows Group Discovery Via Net
- Windows Guest Account Enabled Via Net.EXE
- Windows IIS Components Add New Module
- Windows IOBit Unlocker Extension DLL Registration via Regsvr32
- Windows Identify Protocol Handlers
- Windows Impair Defense Add Xml Applocker Rules
- Windows Indicator Removal Via Rmdir
- Windows Indirect Command Execution Via Series Of Forfiles
- Windows Information Discovery Fsutil
- Windows Ingress Tool Transfer Using Explorer
- Windows InstallUtil URL in Command Line
- Windows InstallUtil Uninstall Option
- Windows InstallUtil in Non Standard Path
- Windows Ldifde Directory Object Behavior
- Windows List ENV Variables Via SET Command From Uncommon Parent
- Windows Local LLM Framework Execution
- Windows MOF Event Triggered Execution via WMI
- Windows MSC EvilTwin Directory Path Manipulation
- Windows MSIExec DLLRegisterServer
- Windows MSIExec Remote Download
- Windows MSIExec Spawn Discovery Command
- Windows MSIExec Spawn WinDBG
- Windows MSIExec Unregister DLLRegisterServer
- Windows MSTSC RDP Commandline
- Windows Masquerading Explorer As Child Process
- Windows Masquerading Msdtc Process
- Windows Metasploit Confluence Plugin Execution
- Windows Mimikatz Binary Execution
- Windows Modify Registry Regedit Silent Reg Import
- Windows Modify System Firewall with Notable Process Path
- Windows MpCmdRun RemoveDefinitions Execution
- Windows MsiExec HideWindow Rundll32 Execution
- Windows Mustang Panda USB Tool Execution
- Windows Net System Service Discovery
- Windows Netspy Network Scanner Execution
- Windows Network Connection Discovery Via Net
- Windows Network Share Interaction Via Net
- Windows Network Sniffing Tool Executed
- Windows New Deny Permission Set On Service SD Via Sc.EXE
- Windows New Service Security Descriptor Set Via Sc.EXE
- Windows Ngrok Reverse Proxy Usage
- Windows Node.exe Executing JS Script In Immediate Folder
- Windows NorthStar C2 Agent Execution
- Windows Odbcconf Hunting
- Windows Odbcconf Load DLL
- Windows Odbcconf Load Response File
- Windows Office Product Spawned Child Process For Download
- Windows Office Product Spawned Control
- Windows Office Product Spawned MSDT
- Windows Office Product Spawned Rundll32 With No DLL
- Windows Office Product Spawned Uncommon Process
- Windows OneDrive Share Mounted via Net
- Windows PaperCut NG Spawn Shell
- Windows Parent PID Spoofing with Explorer
- Windows Password Managers Discovery
- Windows Password Policy Discovery with Net
- Windows Phishing PDF File Executes URL Link
- Windows Potato Privilege Escalation Tool Execution
- Windows Potential Cloudflared Tunnel Execution
- Windows PowGoop Beacon Decoding
- Windows PowerShell FakeCAPTCHA Clipboard Execution
- Windows PowerShell Process Implementing Manual Base64 Decoder
- Windows PowerShell Process With Malicious String
- Windows PowerShell Script From WindowsApps Directory
- Windows Powershell RemoteSigned File
- Windows Private Keys Discovery
- Windows Privilege Escalation Attempt Via MSI Rollback
- Windows Process Accessing IronLanguages Repository On GitHub
- Windows Process Commandline Discovery
- Windows Process Execution From ProgramData
- Windows Process Execution From RDP Share
- Windows Process Execution in Temp Dir
- Windows Process Injection In Non-Service SearchIndexer
- Windows Process Injection Wermgr Child Process
- Windows Process With NamedPipe CommandLine
- Windows Process With NetExec Command Line Parameters
- Windows Protocol Tunneling with Plink
- Windows Proxy Via Netsh
- Windows PsTools Recon Usage
- Windows PuTTY Suite Utility Execution
- Windows RDP File Execution
- Windows Raccine Scheduled Task Deletion
- Windows Rasautou DLL Execution
- Windows Registry Entries Exported Via Reg
- Windows Registry Entries Restored Via Reg
- Windows Remote Assistance Spawning Process
- Windows Remote Create Service
- Windows Remote Service Rdpwinst Tool Execution
- Windows Remote Services Allow Rdp In Firewall
- Windows Renamed Command Interpreter was Executed
- Windows Renamed LOLBAS Binary was Executed
- Windows Renamed Popular 3rd Party Software was Executed
- Windows Renamed Python Binary was Executed
- Windows Rundll32 Apply User Settings Changes
- Windows Rundll32 Execution With Log.DLL
- Windows Rundll32 WebDAV Request
- Windows Rundll32 with Non-Standard File Extension