DET-CS-FALCON-001 CrowdStrike Falcon Endpoint Falcon CQL Severity: Informational
CrowdStrike Falcon — AI client process activity
CrowdStrike Falcon Custom IOA detection for execution and DNS resolution patterns of consumer AI clients on managed endpoints.
Rule
// Falcon CQL — AI client process activity
// Custom IOA rule: alert on process execution of known AI desktop clients
// OR DNS resolution to consumer LLM domains
//
// Rule group: Shadow_AI_Detection
//
// Trigger 1 — Process executions:
// FileName IN ('ChatGPT.exe', 'Claude.exe', 'Cursor.exe', 'Otter.exe', 'Copilot.exe')
// OR FileName MATCHES_REGEX '(?i)ChatGPT\.app|Claude\.app'
//
// Trigger 2 — DNS resolution to consumer AI domains:
// DomainName ENDS_WITH ('.openai.com', '.chatgpt.com', '.anthropic.com', '.claude.ai',
// '.gemini.google.com', '.perplexity.ai', '.deepseek.com',
// '.x.ai', '.copilot.microsoft.com')
//
// Severity: Informational (raises analyst-visible event for correlation;
// combine with DET-MS-PV-001 equivalent in your DLP tool to escalate)
//
// Actions: Generate detection. Do not auto-block (use Falcon Device Control + USB policy
// for hardware controls; use NGAV exploit prevention for true malicious behavior)// Falcon CQL — AI client process activity
// Custom IOA rule: alert on process execution of known AI desktop clients
// OR DNS resolution to consumer LLM domains
//
// Rule group: Shadow_AI_Detection
//
// Trigger 1 — Process executions:
// FileName IN ('ChatGPT.exe', 'Claude.exe', 'Cursor.exe', 'Otter.exe', 'Copilot.exe')
// OR FileName MATCHES_REGEX '(?i)ChatGPT\.app|Claude\.app'
//
// Trigger 2 — DNS resolution to consumer AI domains:
// DomainName ENDS_WITH ('.openai.com', '.chatgpt.com', '.anthropic.com', '.claude.ai',
// '.gemini.google.com', '.perplexity.ai', '.deepseek.com',
// '.x.ai', '.copilot.microsoft.com')
//
// Severity: Informational (raises analyst-visible event for correlation;
// combine with DET-MS-PV-001 equivalent in your DLP tool to escalate)
//
// Actions: Generate detection. Do not auto-block (use Falcon Device Control + USB policy
// for hardware controls; use NGAV exploit prevention for true malicious behavior) How it works
Endpoint-side coverage for environments where Microsoft tooling isn't dominant. Falcon Custom IOAs are evaluated at the agent and surface in Falcon Insight events.
Required data sources
- CrowdStrike Falcon Insight (XDR) or Falcon Prevent with telemetry
Prerequisites
- CrowdStrike Falcon Insight licensed
- Custom IOA rule group created (Admin > Custom IOAs)
- Sensor at version that supports DNS_LOOKUP and PROCESS_EXEC IOA triggers
Expected volume
Variable by org. Use Informational severity by default.
False-positive guidance
Allow-list approved-pilot users via sensor grouping.
Tuning steps
- Refine domain list quarterly.
- Add new AI desktop clients as released.
- Correlate with Falcon Identity Protection events for OAuth grants where applicable.
Framework mappings
- NIST AI RMF: GOVERN-4.1, MEASURE-2.7
- ISO/IEC 42001: 8.2
- NIST CSF: DE.CM-7