ProcessRollup2: CrowdStrike Falcon Process Event, Fields and Queries

What it records

ProcessRollup2 is the event the Falcon sensor writes for a process it saw start, on Windows, macOS and Linux alike. The record names the executable in ImageFileName, the full CommandLine, the parent in ParentBaseFileName and ParentProcessId, the account in UserSid, and hashes of the file (SHA256HashData, MD5HashData). Windows records add the token’s IntegrityLevel and TokenType, the logon session in AuthenticationId, and — when the file came from the internet — its Mark of the Web zone in ZoneIdentifier.

Three IDs matter for joining. TargetProcessId is Falcon’s own identifier for this process, unique on the host; events the process causes later carry it as ContextProcessId. ParentProcessId is the parent’s TargetProcessId. RawProcessId is the operating system’s PID, which Windows reuses, so it is only good for display. aid names the sensor, and with it the host. In Falcon Data Replicator data the record has neither the user’s name nor the host’s: CrowdStrike’s own ProcessRollup2 curation query notes this and adds the name from UserIdentity events by aid and UserSid.

Two details trip up first queries. Windows paths are kernel device paths (\Device\HarddiskVolume2\...), not drive letters. And several fields are numbers that Falcon’s console decodes for you: IntegrityLevel (8192 is Medium, 12288 High, 16384 System), ZoneIdentifier (3 is Internet) and TokenType (2 is an impersonation token). In Splunk, the add-on for Falcon Data Replicator adds decoded _meaning fields such as IntegrityLevel_meaning. In some situations — a process found already running rather than seen starting, for example — Falcon writes a SyntheticProcessRollup2 whose flags say why.

When it matters

Most intrusions run a process somewhere, so this is the event to search first:

• Office, mail or a browser starting a shell. ParentBaseFileName of winword.exe, excel.exe, outlook.exe or a browser with cmd.exe, powershell.exe, wscript.exe or mshta.exe as the child is how most malicious documents and links show up (MITRE ATT&CK T1204.002).
• Encoded or obfuscated PowerShell. A CommandLine with -enc, -EncodedCommand or a long base64 string hides what runs (T1059.001). The Sigma rule for this event flags it; the PowerShell decoder shows the hidden command.
• Discovery bursts. whoami, net, systeminfo, quser and ipconfig in quick succession from one user is someone learning the network; CrowdStrike publishes a query that counts these commands per user.
• Rare binaries. A SHA256HashData seen on one host in the whole estate, especially from a user’s Downloads or Temp folder or with ZoneIdentifier 3, is worth checking.

How to investigate

1. Find the process: filter by ImageFileName (end of path), CommandLine or SHA256HashData, and note aid, TargetProcessId and ProcessStartTime.
2. Walk up the tree: the parent is the ProcessRollup2 on the same aid whose TargetProcessId equals this ParentProcessId — the key CrowdStrike’s parent/child join uses. Stop at the logon (explorer.exe, a service host or a remote session).
3. Follow its activity: NetworkConnectIP4 and DnsRequest events on the same aid with ContextProcessId equal to the TargetProcessId, as in CrowdStrike’s process-and-connection query.
4. Scope it: count hosts and users that ran the same hash or command line.

Shells and script hosts started by Office applications, in Falcon’s event search:

#event_simpleName=ProcessRollup2 event_platform=Win
| ParentBaseFileName=/^(winword|excel|powerpnt|outlook)\.exe$/i
| ImageFileName=/\\(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32)\.exe$/i
| groupBy([aid, ComputerName, ParentBaseFileName, ImageFileName, CommandLine], function=count(as=Executions), limit=max)
| sort(Executions, order=desc)

Encoded PowerShell, with how many hosts ran each command line:

#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\powershell\.exe$/i
| CommandLine=/\s-(e|enc|encodedcommand)\s/i
| groupBy([CommandLine], function=[count(aid, distinct=true, as=Hosts), count(aid, as=Executions)], limit=max)
| sort(Executions, order=desc)

The same search over Falcon Data Replicator data in Splunk (add your index):

sourcetype="crowdstrike:events:sensor" event_simpleName=ProcessRollup2 event_platform=Win ParentBaseFileName IN ("winword.exe", "excel.exe", "outlook.exe")
| regex ImageFileName="(?i)\\\\(cmd|powershell|wscript|mshta)\.exe$"
| stats count AS Executions, values(CommandLine) AS CommandLines by aid, UserSid, ParentBaseFileName, ImageFileName
| sort - Executions

If you have an export in front of you, the free log analyzer reads Falcon Data Replicator files in the browser and flags suspicious command lines and LSASS access; the CrowdStrike field reference covers the export format.