CrowdStrike Automated Leads: Enhancing Threat Detection with AI-Driven Analytics

---
title: Potential Command and Control via PowerShell
description: Detects PowerShell processes establishing network connections, a common behavior in automated attack chains used by eCrime actors.
id: 8b0a4e1a-fc3c-4b5e-9e1a-2b3c4d5e6f7a
status: experimental
references:
 - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2024/05/20
tags:
 - attack.execution
 - attack.t1059.001
logsource:
 category: network_connection
 product: windows
detection:
 selection:
   Image|endswith:
     - '\powershell.exe'
     - '\pwsh.exe'
   Initiated: true
 condition: selection
falsepositives:
 - legitimate administrative scripts using network modules
level: medium
---
title: Suspicious Child Process of MS Office
description: Detects Microsoft Office applications spawning child processes like PowerShell or CMD, often associated with macro-based malware delivery.
id: 9c1b5f2b-0d4e-5c6f-0f1b-3c4d5e6f7a8b
status: experimental
references:
 - https://attack.mitre.org/techniques/T1566/001/
author: Security Arsenal
date: 2024/05/20
tags:
 - attack.initial_access
 - attack.t1566.001
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   ParentImage|contains:
     - '\WINWORD.EXE'
     - '\EXCEL.EXE'
     - '\POWERPNT.EXE'
   Image|endswith:
     - '\powershell.exe'
     - '\cmd.exe'
     - '\wscript.exe'
     - '\cscript.exe'
 condition: selection
falsepositives:
 - Legitimate macro usage for business automation
level: high


**KQL (Microsoft Sentinel / Defender):**

// Hunt for correlations between suspicious process creation and network connections
// mimicking the logic of automated lead generation
let SuspiciousProcesses = 
  DeviceProcessEvents
  | where Timestamp > ago(1d)
  | where InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "mshta.exe")
  | where ProcessCommandLine matches regex @"(?:-(?:c|e|enc|command)\s+""[^"]+"") or ProcessCommandLine contains "http";
let NetworkConnections = 
  DeviceNetworkEvents
  | where Timestamp > ago(1d)
  | where InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "mshta.exe");
SuspiciousProcesses
| join kind=inner NetworkConnections on DeviceId, InitiatingProcessId
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp desc


**Velociraptor VQL:**

-- Hunt for processes with unsigned binaries or suspicious parents
-- indicating potential execution chains that Automated Leads would flag
SELECT
  Pid,
  Ppid,
  Name,
  Exe,
  CommandLine,
  Username,
  StartTime
FROM pslist()
WHERE NOT Signed
   OR Exe =~ "C:\Windows\Temp\.*"
   OR CommandLine =~ "-enc "
-- Group by parent to see potential chains
| group Ppid


**Remediation Script (PowerShell):**

*Note: As Automated Leads is a platform feature, remediation involves ensuring agents are up-to-date and policies are configured correctly. This script checks the Falcon Sensor status.*

# Check CrowdStrike Falcon Sensor Status
Write-Host "Checking CrowdStrike Falcon Sensor connectivity and version..." -ForegroundColor Cyan

# Check for the running service
$service = Get-Service -Name "CSFalconService" -ErrorAction SilentlyContinue

if ($service.Status -eq "Running") {
    Write-Host "[SUCCESS] CrowdStrike Sensor service is running." -ForegroundColor Green
    
    # Check sensor version (Requires access to the sensor directory)
    $sensorPath = "C:\Program Files\CrowdStrike\CSFalconService"
    if (Test-Path $sensorPath) {
        $versionInfo = Get-Item "$sensorPath\CSFalconService.exe" -ErrorAction SilentlyContinue
        if ($versionInfo) {
            Write-Host "Sensor Version: $($versionInfo.VersionInfo.FileVersion)" -ForegroundColor Yellow
            
            # Check connectivity to CrowdStrike Cloud (Generic check)
            try {
                $testConnection = Test-NetConnection -ComputerName "api.crowdstrike.com" -Port 443 -InformationLevel Quiet -WarningAction SilentlyContinue
                if ($testConnection) {
                    Write-Host "[SUCCESS] Connectivity to CrowdStrike Cloud confirmed." -ForegroundColor Green
                } else {
                    Write-Host "[WARNING] Unable to reach CrowdStrike Cloud on port 443." -ForegroundColor Red
                }
            } catch {
                Write-Host "[WARNING] Connectivity check failed." -ForegroundColor Red
            }
        }
    }
} else {
    Write-Host "[ERROR] CrowdStrike Sensor service is not running or not installed." -ForegroundColor Red
}