I got this query from Crowdstrike Documentation https[://]www[.]crowdstrike[. ]com/blog/tech-center/hunt-threat-activity-falcon-endpoint-protection/
Under "Events App: Step-By-Step Procedure" Step no. 4, there is this query:
aid=* event_simpleName="DnsRequest" | rename ContextProcessId as TargetProcessId | join TargetProcessId [search aid=* event_simpleName="ProcessRollup2" ImageFileName="*notepad.exe"] | table ImageFileName DomainName
Individually, the main search or the sub search works fine. If I join them like in the above and change notepad.exe to *chrome.exe, I am able to see all DnsRequests events from chrome.exe process. But if I only say ImageFileName=".exe" in the subset, the resulting table has the correct DomainName column but the ImageFileName column contains only a single process (.e,.g \Device\HarddiskVolume2\Program Files\AppSense\Performance Manager\Agent\PmAgentAssist.exe). How come the search is only picking up this one process "pmAgentAssist.exe"?
Any idea how to solve this? My goal is to locate all DNS requests made in all machines and determine the process/programs which sent the requests.
... View more