Splunk + Crowdstrike (DnsRequest+ImageFileName join)

[splunkb0y]

Hello,

I got this query from Crowdstrike Documentation https[://]www[.]crowdstrike[. ]com/blog/tech-center/hunt-threat-activity-falcon-endpoint-protection/

Under "Events App: Step-By-Step Procedure" Step no. 4, there is this query:

aid=* event_simpleName="DnsRequest" | rename ContextProcessId as TargetProcessId | join TargetProcessId [search aid=* event_simpleName="ProcessRollup2" ImageFileName="*notepad.exe"] | table ImageFileName DomainName

Individually, the main search or the sub search works fine. If I join them like in the above and change notepad.exe to *chrome.exe, I am able to see all DnsRequests events from chrome.exe process. But if I only say ImageFileName=".exe" in the subset, the resulting table has the correct DomainName column but the ImageFileName column contains only a single process (.e,.g \Device\HarddiskVolume2\Program Files\AppSense\Performance Manager\Agent\PmAgentAssist.exe). How come the search is only picking up this one process "pmAgentAssist.exe"?

Any idea how to solve this? My goal is to locate all DNS requests made in all machines and determine the process/programs which sent the requests.

[swebb07g]

The explanation for this is that there is a limit on how many results can be returned in a sub-search (right-side of a join). I believe 50k results is the limit. So try to make sure your search is as narrow as possible.

[splunkb0y]

typo, ImageFileName=".exe" should be "ImageFileName="*.exe"

[slw07gdev]

I'm experiencing the same issue. Did you ever find a solution?

I can say (not sure when this changed) that TargetProcessId and ContextProcessId are now TargetProcessId_decimal and ContextProcessId_decimal.

[splunkb0y]

Actually, this is the ImageFileName I get, if I don't specify a ComputerName on both Main and Sub search:
\Device\HarddiskVolume2\Windows\System32\dllhost.exe