Detect Compromise Software Dependencies and Development Tools in CrowdStrike LogScale

// T1195.001 — Supply Chain Compromise: Package Manager Hook Abuse + CI/CD Poisoning
// Arm 1: Package manager spawning suspicious child processes (postinstall/preinstall hook abuse)
#event_simpleName=ProcessRollup2
| test(
    (
      ParentBaseFileName = /^(npm\.cmd|npm\.exe|node\.exe|pip\.exe|pip3\.exe|python\.exe|python3\.exe|pipx\.exe|yarn\.exe|pnpm\.exe|gem\.exe|bundle\.exe|cargo\.exe|go\.exe|nuget\.exe|dotnet\.exe)$/i
      or ParentCommandLine = /(postinstall|preinstall|install\.js|setup\.py|node-pre-gyp)/i
    )
    and
    (
      FileName = /^(powershell\.exe|pwsh\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|curl\.exe|wget\.exe)$/i
      or CommandLine = /(\/dev\/tcp|base64 -d|base64 --decode|bash -i|sh -i|nc -e|ncat -e|python -c|perl -e|ruby -e|DownloadString|DownloadFile|Invoke-Expression|IEX\(|curl http|wget http|--registry http)/i
    )
  )
| eval(
    DetectionArm="PackageManagerSpawnedSuspiciousChild",
    RiskScore=if(
      FileName = /^(powershell\.exe|pwsh\.exe|mshta\.exe|wscript\.exe|cscript\.exe)$/i
        and CommandLine = /(DownloadString|DownloadFile|Invoke-Expression|IEX\(|base64 -d)/i,
      "critical",
      if(FileName = /^(certutil\.exe|bitsadmin\.exe|rundll32\.exe|regsvr32\.exe)$/i, "high", "medium")
    )
  )
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, ParentCommandLine, DetectionArm, RiskScore])

// ─── Arm 2: Package manager unexpected external network connections (run as separate query) ───
// #event_simpleName=NetworkConnectIP4
// | test(
//     FileName = /^(node\.exe|npm\.cmd|pip\.exe|pip3\.exe|python\.exe|python3\.exe|yarn\.exe|pnpm\.exe|gem\.exe|cargo\.exe|go\.exe)$/i
//     and not RemoteAddressIP4 = /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/
//     and not DomainName = /(registry\.npmjs\.org|pypi\.org|files\.pythonhosted\.org|rubygems\.org|crates\.io|nuget\.org|pkg\.go\.dev|proxy\.golang\.org|yarnpkg\.com|registry\.yarnpkg\.com)/i
//   )
// | eval(DetectionArm="PackageManagerUnexpectedExternalConnection")
// | table([@timestamp, ComputerName, UserName, FileName, RemoteAddressIP4, DomainName, RemotePort, DetectionArm])

// ─── Arm 3: CI/CD pipeline file write events (requires Falcon FileVantage or custom IOA) ───
// #event_simpleName=PeFileWritten OR #event_simpleName=ScriptFileWritten
// | test(
//     TargetFileName = /(\.github\/workflows|\.gitlab-ci|Jenkinsfile|\.circleci|\.travis|azure-pipelines)/i
//     or TargetFileName = /(Makefile|CMakeLists\.txt|build\.gradle|pom\.xml)$/i
//   )
// | eval(DetectionArm="CICDPipelineFileModified")
// | table([@timestamp, ComputerName, UserName, TargetFileName, DetectionArm])