DFIRVault
  LOLBAS :: CrowdStrike Hunt Query Generator
DFIR // Threat Hunting

LOLBAS::Hunter

CrowdStrike Falcon query generator for LOLBAS binaries, scripts & libraries
Loading LOLBAS dataset…
Data sourced from the LOLBAS Project (Living Off The Land Binaries, Scripts and Libraries), embedded at build time. Generated queries target Falcon’s ProcessRollup2 event and are a starting point for hunting — review and tune (parent process, user context, file paths) for your environment before relying on them operationally.
0 function(s) selected
Each selection opens its own Falcon Investigate tab. Browsers may block more than a few simultaneous pop-ups — allow pop-ups for this page if prompted.