Hybrid Submit

Hybrid Analysis Batch Submission Script This Python script recursively scans a folder and submits executable, script, document, and other relevant files to Hybrid Analysis Falcon Sandbox for automated malware analysis. Features Recursively walks through directories Submits only supported file typ...

Detection

About This repository contains detection rules and IOCs that we were able to extract and use in the context of our DFIR projects and malware analyses. Contact Follow us on Twitter: https://twitter.com/SIFalconTeam...

crowdstrike-falcon-queries

crowdstrike-falcon-queries A collection of Splunk's Search Processing Language SPL for Threat Hunting with CrowdStrike Falcon Developed and maintained by Intelligent Response team, i-secure co., Ltd. crowdstrike-falcon-queries Execution of Renamed Executables List of Living Off The Land Binaries...

Query-Hub

CQL-Hub | CrowdStrike SIEM & LogScale Queries Welcome to the CQL-Hub Backend Repository This repository powers cql-hub.com: A free, community-driven hub for CrowdStrike Falcon SIEM queries. All queries stored here are automatically published and made visible on the CQL-Hub website, making it easi...

Threat-Hunting

Threat-Hunting | Detection Engineering Collection of threat hunting and detection queries for: CrowdStrike Falcon using CQL – CrowdStrike Query Language Microsoft Defender XDR using KQL – Kusto Query Language Aimed at surfacing suspicious processes, anomalous network behaviors, living-off-the-lan...

CVE-2022-44721-CsFalconUninstaller

CVE-2022-44721 Crowdstrike Falcon Uninstaller CrowdStrike Falcon is a cloud-powered endpoint detection and response EDR and antivirus AV solution. On each end-device a kernel level managed sensor is deployed and makes use of the cloud-based capabilities. The sensor can be configured with an...

CVE-2026-42801

A flaw was found in ASR Crane and Falcon. This vulnerability, located in the asrrc module on Linux, is a NULL pointer dereference. An attacker could potentially exploit this to manipulate pointers, which may lead to unpredictable system behavior or a denial of service. Mitigation Mitigation for...

CVE-2026-42801

NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux asrrc module allows Pointer Manipulation. This vulnerability is associated with program file 3g.mod/lib/src/urrsir.c...

CVE-2026-42801

A NULL pointer dereference vulnerability exists in the as_rrc module of ASR Crane, Falcon on Linux . The flaw is located in the program file 3g.mod/lib/src/urrsir.c and can lead to Pointer Manipulation . The vulnerability has a HIGH base severity score of 7.4. No specific exploit information or r...

EUVD-2026-85171

NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux asrrc module allows Pointer Manipulation. This vulnerability is associated with program file 3g.mod/lib/src/urrsir.c...

CVE-2026-42801 Deference after null check in as_rrc

NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux asrrc module allows Pointer Manipulation. This vulnerability is associated with program file 3g.mod/lib/src/urrsir.c...

CVE-2026-42801 Deference after null check in as_rrc

NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux asrrc module allows Pointer Manipulation. This vulnerability is associated with program file 3g.mod/lib/src/urrsir.c...

CVE-2026-42801: NULL Pointer Dereference

NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux asrrc module allows Pointer Manipulation. This vulnerability is associated with program file 3g.mod/lib/src/urrsir.c...

PT-2026-97243

Name of the Vulnerable Software and Affected Versions ASR Crane, Falcon on Linux affected versions not specified Description A NULL pointer dereference in the as rrc module allows for pointer manipulation. This issue is associated with the program file 3g.mod/lib/src/urrsir.c. A NULL pointer...

Domain Specific Post Quantum Signatures for Blockchains

Blockchains need more than post quantum single signer signatures. They need consensus profiled authentication objects with canonical bytes, priced invalid input rejection, stable transaction identifiers, hybrid downgrade resistance, public aggregation, merge semantics, accountable signer evidence...

FalconFlank

FalconFlank Crowdstrike Falcon 0day Privilege Escalation Vulnerability FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in Crowdstrike Falcon Sensor, obviously by the time I drop this Crowdstrike would already have detections for it so if you want to...

CVE-2026-40058

CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft...

CVE-2026-40058 Vulnerability Affecting Office Macro Removal in CrowdStrike Falcon Sensor for Windows

CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft...

CVE-2026-40058 Vulnerability Affecting Office Macro Removal in CrowdStrike Falcon Sensor for Windows

CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft...

EUVD-2026-79123

CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft...