Get in touch
← Sentinel Explorer
↳ GitHub sourceSolution

FalconFriday

View on GitHub ↗Original file ↗

Description

[FalconFriday](https://github.com/FalconForceTeam/FalconFriday/blob/master/README.md) is a blog post series by FalconForce providing the community with free detection content for various attacks seen and executed in the wild by FalconForce.
Version
3.0.1
Declared author / publisher
FalconForce - info@falconforce.nl
Support tier
Partner

Related content

Links established from declared identifiers and solution manifests.

Analytics rules30
Access Token Manipulation - Create Process with TokenMediumASR Bypassing Writing Executable ContentMediumBeacon Traffic Based on Common User Agents Visiting Limited Number of DomainsMediumCertified Pre-Owned - backup of CA private key - rule 1MediumCertified Pre-Owned - backup of CA private key - rule 2MediumCertified Pre-Owned - TGTs requested with certificate authenticationMediumComponent Object Model Hijacking - Vault7 trickMediumDCOM Lateral MovementMediumDetect .NET runtime being loaded in JScript for code executionMediumDetecting UAC bypass - ChangePK and SLUI registry tamperingMediumDetecting UAC bypass - elevated COM interfaceMediumDetecting UAC bypass - modify Windows Store settingsMediumDisable or Modify Windows DefenderMediumExcessive share permissionsMediumExpired access credentials being used in AzureMediumHijack Execution Flow - DLL Side-LoadingMediumIngress Tool Transfer - CertutilLowMatch Legitimate Name or Location - 2MediumMicrosoft Entra ID Rare UserAgent App Sign-inMediumMicrosoft Entra ID UserAgent OS MissmatchMediumOffice ASR rule triggered from browser spawned office process.MediumOracle suspicious command executionMediumPassword SprayingMediumRemote Desktop Protocol - SharpRDPMediumRename System UtilitiesMediumSMB/Windows Admin SharesMediumSuspicious named pipesMediumSuspicious parentprocess relationship - Office child processes.MediumSuspicious Process Injection from Office applicationMediumTrusted Developer Utilities Proxy ExecutionMedium

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
falconfriday_content
Additional source files 2Solutions/FalconFriday/Data/Solution_FalconFriday.jsonsolution-manifest ↗Solutions/FalconFriday/SolutionMetadata.jsonsolution-metadata ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.