[Nicholas-devsec]

Please test query in console at runtime as it is quite lengthy and might contain syntax errors. I do not work in a CrowdStrike environment anymore to be able to do this.

Also, please feel free to make any suggestions with the query to make it more efficient. This is something I built a while ago, and could possibly have some improvements made to it.

Thanks!

[dweissbacher]

Hi @Nicholas-devsec , thanks a lot for this submission!

Since you mentioned you can't test anymore, we reviewed and tested it on our side. It looks like a number of backslashes got lost on the way into the file (the pattern matches what Markdown escaping does to \\, \. and \(), so the version in the PR doesn't run. I've pushed a commit to your branch that fixes this. The main changes:

1. Escaping: restored the backslashes in the path and dropper regexes. The dropper pattern /\(curl|...).exe$/i was rejected by the API, and the InstanceID filter couldn't match the real ScreenConnect Client (id) folder, so the query returned no rows.
2. p=, y= and e= extraction: the regex("...") strings ended early at the " inside the character class. They're now regex literals inside case, with - as the fallback.
3. Correlation window: the MOTW and dropper subqueries only kept the latest event per host, so any later download on the same host hid the real one. Each event is now checked against the host's first ScreenConnect execution before aggregating. This also limits the MOTW search to hosts that run ScreenConnect, which helps performance.
4. Small things: removed the aid=?aid parameter (it showed up as an input box and the join already covers aid), added the missing * in the last DropperScore branch, and renamed it to "Suspicious ScreenConnect Internet Download".
5. Explanation: added that the query requires MotwWritten telemetry (a few environments don't send it, and then the query silently returns nothing), that it should run over a window longer than 7 days, and a note on the domain threshold for small fleets.

Testing: the fixed query runs cleanly in Falcon, and the MOTW part behaves as intended on real data. None of our environments currently has ScreenConnect, so we tested the extraction and dropper stages with synthetic events built from a standard install path and command line. Instance ID, relay, port and session fields extract correctly, all six dropper types classify and score correctly, and lookalikes like ScreenConnect.WindowsClient.exe or a benign powershell -File are dropped.

If the changes look good to you, we'll merge it. Thanks again!

[Nicholas-devsec]

Changes look good to me, and thank you for your extra validation work with this. Please merge. Thanks.