CrowdStrike Rapid IOC Hunting v2 Deprecated Hidden

Deprecated. Use CrowdStrike Falcon instead.

FalconHost (Deprecated) · 17 tasks · 0 inputs · 0 outputs

Commands used

cs-device-ran-on cs-device-search send-mail

Flowchart

yes yes yes yes yes yes Start Start Are there domains to hunt? - Exists Are there domains to hunt? Exists Are there MD5s to hunt? - Exists Are there MD5s to hunt? Exists Are there SHA1s to hunt? - Exists Are there SHA1s to hunt? Exists Are there SHA256s to hunt? - Exists Are there SHA256s to hunt? Exists Hunt for devices accessing bad domains - cs-device-ran-on Hunt for devices accessin... cs-device-ran-on Hunt for devices running MD5 - cs-device-ran-on Hunt for devices running MD5 cs-device-ran-on Hunt for devices accessing SHA1 - cs-device-ran-on Hunt for devices accessin... cs-device-ran-on Hunt for devices accessing SHA256 - cs-device-ran-on Hunt for devices accessin... cs-device-ran-on Get device details and email Get device details and email Get device details - cs-device-search Get device details cs-device-search Notify analyst to review information - send-mail Notify analyst to review ... send-mail Analyst - review information Analyst - review information Found any devices? - Exists Found any devices? Exists Done Done Is FalconHost enabled? - Exists Is FalconHost enabled? Exists Hunt for indicators Hunt for indicators