SyntheticProcessRollup2: CrowdStrike's Synthetic Process Event

What it records

SyntheticProcessRollup2 is a second kind of process record. Where ProcessRollup2 is written when the sensor sees a process start, the synthetic record is written in other situations, and its SyntheticPR2Flags field says which. Panther’s schema for Falcon Data Replicator names the values: PROCESS_RUNDOWN (0), PROCESS_HOLLOWED (1), APP_MONITORING (2), IMAGEHASH_FAILURE (4), FILE_PATH_EXCLUDED (8) and PROCESS_FORK_FOLDING (16). CrowdStrike’s own description of each sits behind the Falcon console login, so the names are what public sources offer. “Rundown” is what Windows tracing calls listing the processes that already exist, which fits a process the sensor found running rather than saw start.

The core fields match ProcessRollup2: ImageFileName, CommandLine, TargetProcessId, ParentProcessId, RawProcessId, UserSid, the hashes, ProcessStartTime and ProcessEndTime. Linux and macOS records add the numeric user and group IDs (UID, RUID, SVUID, GID, RGID, SVGID) and ProcessGroupId. What is missing is the parent’s name: Panther’s schema lists no ParentBaseFileName, so finding the parent means looking up the record whose TargetProcessId equals ParentProcessId.

When it matters

• Completeness. A process hunt over ProcessRollup2 alone misses processes described only by a synthetic record — going by the PROCESS_RUNDOWN name, a process that was already running when the sensor started. CrowdStrike’s published hunts for remote-management tools and for processes that create user accounts search both events.
• Hollowed processes. A record with the PROCESS_HOLLOWED value deserves attention: process hollowing (MITRE ATT&CK T1055.012) hides malicious code inside a trusted program name, so the ImageFileName looks harmless.
• Long-running processes. Persistence often means a process that has been alive for days. A synthetic record with an old ProcessStartTime gives you its command line and hashes even when the original start is outside your search window.

How to investigate

1. Search both process events whenever you look for an executable, hash or command line, and keep #event_simpleName in the output so you can tell them apart.
2. Group synthetic records by SyntheticPR2Flags to see which cases occur in your estate; the hollowed value should be rare.
3. For any synthetic record of interest, look up the parent by ParentProcessId, then follow the process’s own activity through ContextProcessId in network and DNS events.

Both process events for remote-access tools, in Falcon’s event search:

#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ event_platform=Win
| ImageFileName=/\\(anydesk|teamviewer|screenconnect\.windowsclient|rustdesk)\.exe$/i
| groupBy([aid, ComputerName, #event_simpleName, ImageFileName, CommandLine], function=count(as=Records), limit=max)
| sort(Records, order=desc)

Which synthetic cases occur, and on how many hosts:

#event_simpleName=SyntheticProcessRollup2
| groupBy([SyntheticPR2Flags], function=[count(as=Records), count(aid, distinct=true, as=Hosts)])
| sort(Records, order=desc)

The flags in Falcon Data Replicator data in Splunk (add your index):

sourcetype="crowdstrike:events:sensor" event_simpleName=SyntheticProcessRollup2
| stats count AS Records, dc(aid) AS Hosts, values(ImageFileName) AS Images by SyntheticPR2Flags
| sort - Records

The free log analyzer reads Falcon exports in the browser and links each event name to its page here.