CRT

CrowdStrike Reporting Tool for Azure CRT This tool queries the following configurations in the Azure AD/O365 tenant which can shed light on hard-to-find permissions and configuration settings in order to assist organizations in securing these environments. Exchange Online O365: Federation...

Threat-Remediation-Scripts

Introduction Since 2021, I have developed a number of scripts to assist me with my investigations and remediation efforts. I figured, why not share them to the public, in hopes it helps you. How do these scripts work? The scripts I developed are intended to work with Crowdstrike Endpoint Detectio...

RedTeamCCode

RedTeamCCode Red Team C code repo Want to know what is the syscall ID been used by your system getsyscall.exe ntdll.dll NtProtectVirtualMemory ntdll.dll!NtProtectVirtualMemory at 0x00007FFDE568D010 NtProtectVirtualMemory syscall ID 0x00000050 80 CrowdStrike hooked ntdll.dll APIs...

crowdstrike-falcon-queries

crowdstrike-falcon-queries A collection of Splunk's Search Processing Language SPL for Threat Hunting with CrowdStrike Falcon Developed and maintained by Intelligent Response team, i-secure co., Ltd. crowdstrike-falcon-queries Execution of Renamed Executables List of Living Off The Land Binaries...

sccmhound

SCCMHound SCCMHound is a C BloodHound collector for Microsoft Configuration Manager MCM. If you're looking for a way to collect BloodHound session information from Configuration Manager's users and computers then this is the tool for you! Highly recommend importing collected data with another...

MoveEdr

MoveEDR If you're admin you can force Windows to delete or move folders and files around immediately after booting before services are started. This can be used to disable EDRs. Usage !CAUTION There is an issue with CrowdStrike which results in a bootloop with the message "INACCESSIBLEBOOTDEVICE"...

Query-Hub

CQL-Hub | CrowdStrike SIEM & LogScale Queries Welcome to the CQL-Hub Backend Repository This repository powers cql-hub.com: A free, community-driven hub for CrowdStrike Falcon SIEM queries. All queries stored here are automatically published and made visible on the CQL-Hub website, making it easi...

Threat-Hunting

Threat-Hunting | Detection Engineering Collection of threat hunting and detection queries for: CrowdStrike Falcon using CQL – CrowdStrike Query Language Microsoft Defender XDR using KQL – Kusto Query Language Aimed at surfacing suspicious processes, anomalous network behaviors, living-off-the-lan...

Security-Detections-MCP

Security Detections MCP An MCP Model Context Protocol server that lets LLMs query a unified database of Sigma , Splunk ESCU , Elastic , KQL , Sublime , and CrowdStrike CQL security detection rules. New here? Start with theSetup Guide -- covers macOS, Windows WSL & native, and Linux step by step...

CorelightForCrowdStrike

CorelightForCrowdStrike Corelight app for CrowdStrike LogScale and Next-Gen SIEM...

Vectored-Exception-Handling-Squared

Vectored Exception Handling Squared A Rust Proof of Concept. Read more on my blog, all original research by CrowdStrike, this is just the POC for it! Unless I am blind; there does not seem to be much out there POC's etc relating to the discovery made by CrowdStrike researchers, called Vectored...

CVE-2024-49138-POC

CVE-2024-49138-POC Fix Error Decombine C:\Program Files\Microsoft Visual Studio\2022\Professional\MSBuild\Microsoft\VC\v170\Microsoft.CppBuild.targets456,5: error MSB8020: The build tools for Visual Studio 2019 Platform Toolset = 'v142' cannot be found. To build using the v142 build tools, please...

CVE-2022-44721-CsFalconUninstaller

CVE-2022-44721 Crowdstrike Falcon Uninstaller CrowdStrike Falcon is a cloud-powered endpoint detection and response EDR and antivirus AV solution. On each end-device a kernel level managed sensor is deployed and makes use of the cloud-based capabilities. The sensor can be configured with an...

Threat_Hunting

ThreatHunting Some Crowdstrike threat hunting queries useful for blue teamers and threat hunters...

8 Top Red Teaming Service Providers for Enterprise Adversary Emulation

Compare 8 top red teaming providers for enterprise adversary emulation, from DeepSeas and Mandiant to CrowdStrike, IBM, SpecterOps, TrustedSec and NCC Group...

PT-2026-102966

Name of the Vulnerable Software and Affected Versions AiSOC versions 7.2.0 through 11.x Description The actions service contains a flaw when building CrowdStrike Real Time Response command strings by interpolating unescaped action parameters within crowdstrike rtr.py and endpoint.py. Authenticate...

FalconFlank

FalconFlank Crowdstrike Falcon 0day Privilege Escalation Vulnerability FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in Crowdstrike Falcon Sensor, obviously by the time I drop this Crowdstrike would already have detections for it so if you want to...

CVE-2026-40058

CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft...

CVE-2026-40058 Vulnerability Affecting Office Macro Removal in CrowdStrike Falcon Sensor for Windows

CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft...

EUVD-2026-79123

CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft...