This repository contains an organized collection of queries (CQL) designed to facilitate Threat Hunting tasks, incident investigation, and proactive detection of anomalous or malicious activities in environments monitored with CrowdStrike Falcon.
☆15Aug 29, 2025Updated last year
Alternatives and similar repositories for hunting-queries-crowdstrike
Users that are interested in hunting-queries-crowdstrike are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- CrowdStrike Falcon Advanced Threat Hunting Queries☆14Aug 19, 2026Updated 2 months ago
- Best Practices, queries, and packages for CQL the language of CrowdStrike's LogScale (Humio) log manager.☆15May 7, 2026Updated 5 months ago
- A collection of CQL hunting leads for CrowdStrike Falcon and LogScale, mapped to the MITRE ATT&CK framework.☆35Sep 8, 2026Updated last month
- Determine the Palo Alto PAN-OS software version of a remote GlobalProtect portal or management interface.☆16Dec 2, 2025Updated 11 months ago
- Este proyecto permite realizar monitoreo avanzado en Telegram con fines de OSINT defensivo☆15Oct 13, 2025Updated last year
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- A few XDR Scripts☆25Mar 19, 2025Updated last year
- ☆17Jan 6, 2025Updated last year
- Public Repo for an eStreamer CLI project☆11Sep 3, 2024Updated 2 years ago
- This is a script to import Cisco Talos's IP Blacklist into a Tag (Host Group) within Stealthwatch. This will also optionally create a Cu…☆11May 22, 2023Updated 3 years ago
- Directory with Bluetooth exploits that is used in BlueToolkit☆26Sep 30, 2025Updated last year
- Python client for McAfee ePolicy Orchestrator☆15Mar 12, 2021Updated 5 years ago
- AppScript code to fetch RSS and post to Google Hangouts Chat☆18Dec 18, 2023Updated 2 years ago
- This repo contains one liner web shells☆11Feb 10, 2022Updated 4 years ago
- ☆22Sep 27, 2025Updated last year
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- PAN-OS auth bypass + RCE☆45Nov 19, 2024Updated last year
- Uses a controller to create workers in AWS Lambda to conduct distributed port scans on selected targets, with automatic source IP rotatio…☆10Oct 18, 2023Updated 3 years ago
- Tiny: a tiny programming language implemented in PowerShell☆15Jun 21, 2023Updated 3 years ago
- Postman collections for interacting with Cisco Stealthwatch Enterprise APIs☆10Apr 26, 2023Updated 3 years ago
- Scan files and folders for username & password combinations.☆13Jan 8, 2020Updated 6 years ago
- Atlassian confluence unauthenticated ONGL injection remote code execution scanner (CVE-2022-26134).☆13Jan 22, 2025Updated last year
- A GUI for packet captures in Windows using pktmon☆12Apr 17, 2023Updated 3 years ago
- Windows Privilege Escalation☆18Jun 11, 2022Updated 4 years ago
- Command-line tool to identify useragents that bypasses proxy restrictions☆14Updated this week
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- This tool is a simple ffuf launcher which lets you select dynamically which wordlist and which extentions you want to fuzz.☆10Mar 16, 2026Updated 7 months ago
- All about ransomware notes and extension files.☆14Aug 26, 2023Updated 3 years ago
- Versatile tool for managing wordlists☆11Jul 15, 2021Updated 5 years ago
- ☆65Updated this week
- An ultra lightweight web screenshot tool with advanced DOM analysis features.☆48Oct 26, 2026Updated last week
- Repository for SOC analysts, queries to investigate, advanced hunting, sites for analysis, malware samples, courses to improve skills, IO…☆160Apr 13, 2026Updated 6 months ago
- CrowdStrike FCS CLI GitHub action☆23Oct 7, 2026Updated 3 weeks ago
- Remove Offensive and Profane Words from Wordlists☆17Jul 27, 2023Updated 3 years ago
- This repository contains Community and Field contributed content for LogScale☆357Updated this week
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Examples & demos show in the PowerShell for Networking Engineers webinar on Feb, Mon 13th, 2017☆13Feb 16, 2017Updated 9 years ago
- The Project can be used to integrate QRadar with MISP Threat Sharing Platform☆40May 18, 2022Updated 4 years ago
- Pulls IOCs from MISP and adds the to reference sets in QRadar☆33May 18, 2026Updated 5 months ago
- CQL Hub is an open repository of detection and hunting queries for CrowdStrike NextGen SIEM and Falcon LogScale. All queries stored here …☆86Oct 28, 2026Updated last week
- PoC's and Slides from 'Gophers, whales and.. clouds? Oh my!' BSides Wellington presentation by Glenn 'devalias' Grant☆17Mar 3, 2018Updated 8 years ago
- 🧱 A curated list of SDKs, integrations, tools, and resources for microsandbox☆21Oct 28, 2026Updated last week
- A collection of Splunk's Search Processing Language (SPL) for Threat Hunting with CrowdStrike Falcon☆220May 23, 2020Updated 6 years ago