Custom Hunting with CrowdStrike Falcon: Behaviour and Correlation
CrowdStrike Falcon hunting tests your ability to turn endpoint telemetry into a defensible conclusion. Falcon records process, network, file, registry and DNS events from the sensor, and hunting means querying those events rather than waiting for a detection.
Telemetry and interfaces
Event Search and Investigate expose raw events, while Process Explorer renders the process tree. Useful event_simpleName values include ProcessRollup2, DnsRequest, NetworkConnectIP4, FileWritten, RegKeyWritten, UserLogon and ScriptControlScanTelemetry. Fields include ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData, RemoteAddressIP4 and DomainName. Falcon Data Replicator streams raw events to your own store for long-retention correlation, FalconPy drives the API, and Real Time Response collects artefacts.
IOAs versus IOCs
Indicators of attack are behavioural and are matched by the platform against activity such as credential dumping or suspicious parentage. Indicators of compromise are hashes, domains and IPs you upload and search for. Custom IOAs let you encode your own behavioural logic.
Worked example
Hunt for LSASS dumping without a known hash: query event_simpleName=ProcessRollup2 FileName=rundll32.exe CommandLine=*comsvcs*MiniDump*. Reasoning: comsvcs.dll MiniDump through rundll32 is a living-off-the-land technique (T1003.001). Confirm by checking ParentBaseFileName for an unusual parent, then look for FileWritten events ending in .dmp and any NetworkConnectIP4 from the same host that could be exfiltration.
Traps
- Using the wrong field, for example
FileNamewhere the value actually sits inImageFileName. - Assuming
ProcessRollup2covers every process start; synthetic and suppressed events exist. - Forgetting that retention windows limit how far back you can retro-hunt.
- Treating an IOA hit as proof instead of as a lead requiring corroboration.