AOMEI Backupper Supply-Chain Tampering (UNC7017): CROSSROAD and SHINYROAD

// HUNT: Updater process launching an executable from its own staging or rendering directory
// MITRE: T1195.002, T1036.005
// CONF: high
// FP: low
// COST: low
// REQUIRES: Process creation with parent and image path
// FALSE POSITIVES: none expected; legitimate AOMEI bundles contain no executables in these directories (ManageEngine)
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(ABNotify|Backupper)(\.exe)?$/i
| ImageFileName=/\\(html|tmphtml)\\.*\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData])

event.type = 'Process Creation' src.process.name = * tgt.process.image.path = *
| limit 5
| columns event.time, src.process.name, tgt.process.image.path

// HUNT: Updater process launching an executable from its own staging or rendering directory
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1195.002, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected; legitimate AOMEI bundles contain no executables in these directories (ManageEngine)
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: an AOMEI updater (ABNotify or Backupper) as creator of an executable under an html or tmphtml directory. The creator is src.process.name and the created image is tgt.process.image.path, per the Process Creation lineage. contains and matches are case-insensitive, which reproduces the CQL i flag.
// REQUIRES: SentinelOne process-creation telemetry with creator name and created image path
// TUNING: None expected: legitimate AOMEI bundles contain no executables in these directories. Review every hit.
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An executable the sensor did not see being created is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name matches '^(ABNotify|Backupper)(\\.exe)?$' tgt.process.image.path matches '\\.exe$' (tgt.process.image.path contains '\\html\\' or tgt.process.image.path contains '\\tmphtml\\')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha256
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FolderPath
| take 5

// HUNT: Updater process launching an executable from its own staging or rendering directory
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1195.002, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected; legitimate AOMEI bundles contain no executables in these directories (ManageEngine)
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on DeviceProcessEvents: the updater is InitiatingProcessFileName and the created image path sits under an html or tmphtml directory and ends in .exe. contains and in~ are case-insensitive, which reproduces the CQL i flag.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected: legitimate AOMEI bundles contain no executables in these directories. Review every hit.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 120d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days, so the 120-day campaign window is covered only on the CQL tab. A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName in~ ("ABNotify.exe", "ABNotify", "Backupper.exe", "Backupper")
| where FolderPath endswith ".exe"
| where FolderPath contains "\\html\\" or FolderPath contains "\\tmphtml\\"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: CROSSROAD self-deletion child (--nitrod)
// MITRE: T1070.004, T1564.004
// CONF: high
// FP: low
// COST: low
// REQUIRES: Process creation with command line
// FALSE POSITIVES: none expected; the flag is specific to this dropper
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(^|\s)--nitrod(\s|$)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline

// HUNT: CROSSROAD self-deletion child (--nitrod)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1070.004, T1564.004
// CONF: high | FP: low
// FALSE POSITIVES: none expected; the flag is specific to this dropper
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the --nitrod flag as a whole command-line token. The created process is tgt.process.*, so the command line is tgt.process.cmdline. matches is case-insensitive, which reproduces the CQL i flag.
// REQUIRES: SentinelOne process-creation telemetry with the created process command line
// TUNING: None expected: the flag is specific to this dropper.
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process started by a sensor-invisible parent is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.cmdline matches '(^|\\s)--nitrod(\\s|$)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha256
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: CROSSROAD self-deletion child (--nitrod)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1070.004, T1564.004
// CONF: high | FP: low
// FALSE POSITIVES: none expected; the flag is specific to this dropper
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the --nitrod flag as a whole command-line token on DeviceProcessEvents. The (?i) prefix reproduces the CQL i flag.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected: the flag is specific to this dropper.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 120d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days, so the 120-day campaign window is covered only on the CQL tab. A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine matches regex @"(?i)(^|\s)--nitrod(\s|$)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Persistence tasks RadminComponentRuntime and NitroRuntime
// MITRE: T1053.005
// CONF: high
// FP: low
// COST: low
// REQUIRES: Scheduled task registration
// FALSE POSITIVES: none expected; neither task name is a stock Radmin or Nitro artifact
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
#event_simpleName=ScheduledTaskRegistered
| TaskName=/(RadminComponentRuntime|NitroRuntime)$/i
| table([@timestamp, ComputerName, UserName, TaskName, TaskAuthor])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline

// HUNT: Persistence tasks RadminComponentRuntime and NitroRuntime
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1053.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected; neither task name is a stock Radmin or Nitro artifact
// EQUIVALENCE: approximate-analytic - SentinelOne telemetry in this field model has no scheduled-task registration event, so the hunt pivots on the command line of any created process that names RadminComponentRuntime or NitroRuntime. That catches schtasks.exe and PowerShell task registration by command line, but not a task registered through the Task Scheduler API with no such command line.
// REQUIRES: SentinelOne process-creation telemetry with the created process command line
// TUNING: None expected: neither task name is a stock Radmin or Nitro artifact. Confirm the registering process on any hit.
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A task registered through the Task Scheduler API with no such command line is not captured; the CQL tab sees the registration event itself. The CQL anchors the match at the end of the task name; this pane matches the name anywhere in the command line.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.cmdline matches '(RadminComponentRuntime|NitroRuntime)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "ScheduledTaskCreated"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: Persistence tasks RadminComponentRuntime and NitroRuntime
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1053.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected; neither task name is a stock Radmin or Nitro artifact
// EQUIVALENCE: equivalent-with-schema-assumptions - Same scheduled-task registration predicate: DeviceEvents records ScheduledTaskCreated and the task name is read from AdditionalFields. The task name is matched at its end, as the CQL does.
// REQUIRES: Defender for Endpoint scheduled-task telemetry (DeviceEvents, ActionType ScheduledTaskCreated)
// TUNING: None expected: neither task name is a stock Radmin or Nitro artifact. Confirm the registering process on any hit.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 120d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days, so the 120-day campaign window is covered only on the CQL tab. A task registered without a ScheduledTaskCreated event is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "ScheduledTaskCreated"
| extend TaskName = tostring(parse_json(AdditionalFields).TaskName)
| where TaskName matches regex @"(?i)(RadminComponentRuntime|NitroRuntime)$"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, TaskName
| sort by Timestamp desc
| take 200

// HUNT: Signed Radmin launcher run with --runtimechk or from a user profile
// MITRE: T1574.001, T1053.005
// CONF: high
// FP: low
// COST: low
// REQUIRES: Process creation with command line and image path
// FALSE POSITIVES: Sanctioned Radmin deployments should not use --runtimechk or run from AppData; confirm with the Radmin owner
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^FamItrf[c2]\.exe$/i
| CommandLine=/--runtimechk/i or ImageFileName=/\\AppData\\Local\\Radmin\\.*\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData])

event.type = 'Process Creation' tgt.process.name = * tgt.process.cmdline = * tgt.process.image.path = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline, tgt.process.image.path

// HUNT: Signed Radmin launcher run with --runtimechk or from a user profile
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.001, T1053.005
// CONF: high | FP: low
// FALSE POSITIVES: Sanctioned Radmin deployments should not use --runtimechk or run from AppData; confirm with the Radmin owner
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the signed Radmin launcher FamItrfc.exe or FamItrf2.exe, run with --runtimechk or from the user-profile Radmin directory. The created process is tgt.process.*. The CQL requires the image to end in .exe, which the launcher name already guarantees.
// REQUIRES: SentinelOne process-creation telemetry with created name, image path and command line
// TUNING: Sanctioned Radmin deployments should not use --runtimechk or run from the user profile; confirm with the Radmin owner.
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A launcher renamed to another file name is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name matches '^FamItrf[c2]\\.exe$' (tgt.process.cmdline contains '--runtimechk' or tgt.process.image.path contains '\\AppData\\Local\\Radmin\\')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha256
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath, ProcessCommandLine
| take 5

// HUNT: Signed Radmin launcher run with --runtimechk or from a user profile
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.001, T1053.005
// CONF: high | FP: low
// FALSE POSITIVES: Sanctioned Radmin deployments should not use --runtimechk or run from AppData; confirm with the Radmin owner
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on DeviceProcessEvents: the launcher by name, and either the --runtimechk flag or the user-profile Radmin directory. contains and in~ are case-insensitive, which reproduces the CQL i flag.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Sanctioned Radmin deployments should not use --runtimechk or run from the user profile; confirm with the Radmin owner.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 120d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days, so the 120-day campaign window is covered only on the CQL tab. A launcher renamed to another file name is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("FamItrfc.exe", "FamItrf2.exe")
| where ProcessCommandLine contains "--runtimechk" or FolderPath contains "\\AppData\\Local\\Radmin\\"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Sideload DLL and launcher drops in user-profile Radmin and Nitro Pro folders
// MITRE: T1574.001, T1036.005
// CONF: high
// FP: low
// COST: low
// REQUIRES: Executable or file written with path
// FALSE POSITIVES: BlkScrDl.dll is described as masquerading as a Radmin component name; if a genuine file of that name exists in your Radmin build, confirm with the hash from section 4
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| TargetFileName=/\\AppData\\Local\\(Radmin\\(BlkScrDl\.dll|csvc\\RuntimeComponent\.dll)|Nitro Pro\\(Eztwain4\.dll|NitroPromotion\.exe))$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData])

event.type = 'File Creation' tgt.file.path = *
| limit 5
| columns event.time, src.process.name, tgt.file.path

// HUNT: Sideload DLL and launcher drops in user-profile Radmin and Nitro Pro folders
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.001, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: BlkScrDl.dll is described as masquerading as a Radmin component name; if a genuine file of that name exists in your Radmin build, confirm with the hash from section 4
// EQUIVALENCE: approximate-analytic - The CQL matches PE-file-written events at four exact paths. SentinelOne has no PE-specific write event here, so this pane matches File Creation and File Modification at the same paths. The paths are matched as substrings rather than anchored at the end, so a longer name that merely starts with a listed file name also matches.
// REQUIRES: SentinelOne file creation and modification telemetry with the target path
// TUNING: BlkScrDl.dll is described as masquerading as a Radmin component name; if a genuine file of that name exists in your Radmin build, confirm with the hash from section 4.
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Whether the written file is a PE image is not tested; the exact paths carry that meaning. The match is a substring match, not anchored at the end of the path.
// VALIDATION LEVEL: static-reviewed
event.type in ('File Creation', 'File Modification') (tgt.file.path contains '\\AppData\\Local\\Radmin\\BlkScrDl.dll' or tgt.file.path contains '\\AppData\\Local\\Radmin\\csvc\\RuntimeComponent.dll' or tgt.file.path contains '\\AppData\\Local\\Nitro Pro\\Eztwain4.dll' or tgt.file.path contains '\\AppData\\Local\\Nitro Pro\\NitroPromotion.exe')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.file.path, tgt.file.sha256
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, FolderPath
| take 5

// HUNT: Sideload DLL and launcher drops in user-profile Radmin and Nitro Pro folders
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.001, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: BlkScrDl.dll is described as masquerading as a Radmin component name; if a genuine file of that name exists in your Radmin build, confirm with the hash from section 4
// EQUIVALENCE: approximate-analytic - The CQL matches PE-file-written events at four exact paths. DeviceFileEvents has no PE-specific write action, so this pane matches FileCreated and FileModified at the same paths. The paths are matched as substrings rather than anchored at the end.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: BlkScrDl.dll is described as masquerading as a Radmin component name; if a genuine file of that name exists in your Radmin build, confirm with the hash from section 4.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 120d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days, so the 120-day campaign window is covered only on the CQL tab. Whether the written file is a PE image is not tested; the exact paths carry that meaning.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath contains "\\AppData\\Local\\Radmin\\BlkScrDl.dll" or FolderPath contains "\\AppData\\Local\\Radmin\\csvc\\RuntimeComponent.dll" or FolderPath contains "\\AppData\\Local\\Nitro Pro\\Eztwain4.dll" or FolderPath contains "\\AppData\\Local\\Nitro Pro\\NitroPromotion.exe"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FileName, FolderPath, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Radmin launcher or dllhost spawning a command shell
// MITRE: T1059.006, T1559.001
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Process creation with parent
// FALSE POSITIVES: COM surrogate children from legitimate software
// TUNING: exclude dllhost parents whose command line carries a known-good /Processid and that match your baselined software; review FamItrf parents without exclusion
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(FamItrf[c2]|dllhost)(\.exe)?$/i
| FileName=/^(cmd|powershell|pwsh)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' src.process.name = * tgt.process.name = *
| limit 5
| columns event.time, src.process.name, tgt.process.name

// HUNT: Radmin launcher or dllhost spawning a command shell
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.006, T1559.001
// CONF: medium | FP: medium
// FALSE POSITIVES: COM surrogate children from legitimate software
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a Radmin launcher or dllhost as creator of cmd, powershell or pwsh. The creator is src.process.name and the created shell is tgt.process.name, per the Process Creation lineage.
// REQUIRES: SentinelOne process-creation telemetry with creator and created process names
// TUNING: Exclude dllhost creators whose command line carries a known-good /Processid and that match your baselined software; review FamItrf creators without exclusion.
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Shells launched through an intermediate process are not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name matches '^(FamItrf[c2]|dllhost)(\\.exe)?$' tgt.process.name matches '^(cmd|powershell|pwsh)\\.exe$'
| columns event.time, endpoint.name, src.process.user, src.process.name, src.process.cmdline, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, InitiatingProcessFileName
| take 5

// HUNT: Radmin launcher or dllhost spawning a command shell
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.006, T1559.001
// CONF: medium | FP: medium
// FALSE POSITIVES: COM surrogate children from legitimate software
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on DeviceProcessEvents: the Radmin launcher or dllhost is the initiating process and the created process is a command shell. The (?i) prefix and in~ reproduce the CQL i flag.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude dllhost parents whose command line carries a known-good /Processid and that match your baselined software; review FamItrf parents without exclusion.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 120d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days, so the 120-day campaign window is covered only on the CQL tab. Shells launched through an intermediate process are not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName matches regex @"(?i)^(FamItrf[c2]|dllhost)(\.exe)?$"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: COM server registration for the SHINYROAD CLSID and AppID
// MITRE: T1559.001
// CONF: medium
// FP: low
// COST: low
// REQUIRES: Registry value set (CrowdStrike registry events)
// FALSE POSITIVES: none expected; the identifiers are specific to this campaign
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
#event_simpleName=/^(RegGenericValueUpdate|AsepValueUpdate)$/
| RegObjectName=/21191641-0D7F-4CD9-9572-01AAE6E7851B|9AD3E98A-4C7E-4F37-982D-D73D41E4F91B/i or RegStringValue=/\\Radmin\\csvc\\RuntimeComponent\.dll/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue])

event.type = 'Registry Value Modified' registry.keyPath = * registry.value = *
| limit 5
| columns event.time, registry.keyPath, registry.value

// HUNT: COM server registration for the SHINYROAD CLSID and AppID
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1559.001
// CONF: medium | FP: low
// FALSE POSITIVES: none expected; the identifiers are specific to this campaign
// EQUIVALENCE: equivalent-with-schema-assumptions - Same registry-value predicate: either campaign GUID in the key path, or the RuntimeComponent.dll path as the value data. SentinelOne reports one Registry Value Modified event type where the CQL lists two event names.
// REQUIRES: SentinelOne registry value modification telemetry
// TUNING: None expected: the identifiers are specific to this campaign.
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Registry activity on keys the sensor does not monitor is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified' (registry.keyPath matches '21191641-0D7F-4CD9-9572-01AAE6E7851B|9AD3E98A-4C7E-4F37-982D-D73D41E4F91B' or registry.value contains '\\Radmin\\csvc\\RuntimeComponent.dll')
| columns event.time, endpoint.name, src.process.user, src.process.name, registry.keyPath, registry.valueName, registry.value
| limit 200

DeviceRegistryEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, RegistryKey, RegistryValueData
| take 5

// HUNT: COM server registration for the SHINYROAD CLSID and AppID
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1559.001
// CONF: medium | FP: low
// FALSE POSITIVES: none expected; the identifiers are specific to this campaign
// EQUIVALENCE: equivalent-with-schema-assumptions - Same registry-value predicate on DeviceRegistryEvents: RegistryValueSet with either campaign GUID in the key or the RuntimeComponent.dll path as the value data. contains is case-insensitive, which reproduces the CQL i flag.
// REQUIRES: Defender for Endpoint registry telemetry (DeviceRegistryEvents)
// TUNING: None expected: the identifiers are specific to this campaign.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 120d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days, so the 120-day campaign window is covered only on the CQL tab. Registry activity on keys the sensor does not monitor is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceRegistryEvents
| where Timestamp >= ago(30d)
| where ActionType == "RegistryValueSet"
| where RegistryKey contains "21191641-0D7F-4CD9-9572-01AAE6E7851B" or RegistryKey contains "9AD3E98A-4C7E-4F37-982D-D73D41E4F91B" or RegistryValueData contains "\\Radmin\\csvc\\RuntimeComponent.dll"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData
| sort by Timestamp desc
| take 200

// HUNT: External IP lookup by campaign binaries (CROSSROAD geolocation guardrail)
// MITRE: T1016, T1614, T1480
// CONF: medium
// FP: low
// COST: low
// REQUIRES: DNS lookup with requesting process
// FALSE POSITIVES: none expected for these two process names
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
#event_simpleName=DnsRequest
| DomainName=/^(myip\.opendns\.com|o-o\.myaddr\.l\.google\.com|checkip\.amazonaws\.com|api\.ipify\.org|ifconfig\.me|icanhazip\.com)$/i
| ContextBaseFileName=/^(upgrade-now|NitroPromotion)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, DomainName])

event.type = 'DNS Resolved' event.dns.request = * src.process.name = *
| limit 5
| columns event.time, src.process.name, event.dns.request, dns.request

// HUNT: External IP lookup by campaign binaries (CROSSROAD geolocation guardrail)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1016, T1614, T1480
// CONF: medium | FP: low
// FALSE POSITIVES: none expected for these two process names
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: one of six public IP-lookup hostnames requested by upgrade-now or NitroPromotion. On a DNS Resolved event the requesting process is src.process.*. SentinelOne documents two DNS field spellings; this pane uses the one the independent Sigma backend maps.
// REQUIRES: SentinelOne DNS telemetry with the requesting process
// TUNING: None expected for these two process names.
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Tenants that populate dns.request instead of event.dns.request return nothing until the field is swapped; run the field check in the readiness test.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' event.dns.request in:anycase ('myip.opendns.com', 'o-o.myaddr.l.google.com', 'checkip.amazonaws.com', 'api.ipify.org', 'ifconfig.me', 'icanhazip.com') src.process.name matches '^(upgrade-now|NitroPromotion)(\\.exe)?$'
| columns event.time, endpoint.name, src.process.user, src.process.name, event.dns.request
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, InitiatingProcessFileName, AdditionalFields
| take 5

// HUNT: External IP lookup by campaign binaries (CROSSROAD geolocation guardrail)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1016, T1614, T1480
// CONF: medium | FP: low
// FALSE POSITIVES: none expected for these two process names
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: one of six public IP-lookup hostnames requested by upgrade-now or NitroPromotion. Defender has no endpoint DNS table, so the name is read from DeviceEvents DnsQueryResponse AdditionalFields.
// REQUIRES: Defender for Endpoint DNS telemetry (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: None expected for these two process names.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 120d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days, so the 120-day campaign window is covered only on the CQL tab. A tenant whose DnsQueryResponse rows carry the name under another key returns nothing; check the readiness test output.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| where InitiatingProcessFileName matches regex @"(?i)^(upgrade-now|NitroPromotion)(\.exe)?$"
| extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where DnsName in~ ("myip.opendns.com", "o-o.myaddr.l.google.com", "checkip.amazonaws.com", "api.ipify.org", "ifconfig.me", "icanhazip.com")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, DnsName
| sort by Timestamp desc
| take 200

// HUNT: Outbound connections to campaign IP addresses
// MITRE: T1571, T1573.001, T1187
// CONF: high
// FP: low
// COST: low
// REQUIRES: Outbound network connection with process
// FALSE POSITIVES: none expected
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
#event_simpleName=NetworkConnectIP4
| in(RemoteAddressIP4, values=["8.210.84.56","8.218.65.184","47.239.60.117"])
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort])

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.time, src.process.name, dst.ip.address

// HUNT: Outbound connections to campaign IP addresses
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1571, T1573.001, T1187
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate: an outbound IPv4 connection whose destination is one of the three campaign addresses. The destination is dst.ip.address on an IP Connect event.
// REQUIRES: SentinelOne IP Connect network telemetry
// TUNING: None expected: the addresses are campaign infrastructure. Treat any hit as a lead and check the address is still attributed to the campaign.
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connections through a proxy show the proxy address, not the campaign address.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' dst.ip.address in ('8.210.84.56', '8.218.65.184', '47.239.60.117')
| columns event.time, endpoint.name, src.process.user, src.process.name, dst.ip.address, dst.port.number
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, RemoteIP, RemotePort
| take 5

// HUNT: Outbound connections to campaign IP addresses
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1571, T1573.001, T1187
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate on DeviceNetworkEvents: an outbound connection whose RemoteIP is one of the three campaign addresses.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: None expected: the addresses are campaign infrastructure. Treat any hit as a lead and check the address is still attributed to the campaign.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 120d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days, so the 120-day campaign window is covered only on the CQL tab. Connections through a proxy show the proxy address, not the campaign address.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemoteIP in ("8.210.84.56", "8.218.65.184", "47.239.60.117")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteIP, RemotePort
| sort by Timestamp desc
| take 200

// HUNT: DNS lookups for campaign domains and the Alibaba OSS staging bucket
// MITRE: T1583.001, T1583.006, T1105
// CONF: high
// FP: low
// COST: low
// REQUIRES: DNS lookup with requesting process
// FALSE POSITIVES: none expected; the OSS match is on the single bucket host, not on aliyuncs.com as a whole
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
#event_simpleName=DnsRequest
| DomainName=/(^|\.)storage-data\.com$/i or DomainName=/^serv\.oss-cn-hongkong\.aliyuncs\.com$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, DomainName])

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, src.process.name, event.dns.request, dns.request

// HUNT: DNS lookups for campaign domains and the Alibaba OSS staging bucket
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1583.001, T1583.006, T1105
// CONF: high | FP: low
// FALSE POSITIVES: none expected; the OSS match is on the single bucket host, not on aliyuncs.com as a whole
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: the storage-data.com domain or any subdomain of it, or the single Alibaba OSS bucket host. The bucket is matched by exact host, not by aliyuncs.com as a whole. SentinelOne documents two DNS field spellings; this pane uses the one the independent Sigma backend maps.
// REQUIRES: SentinelOne DNS telemetry with the requesting process
// TUNING: None expected: the OSS match is on the single bucket host, not on aliyuncs.com as a whole.
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Tenants that populate dns.request instead of event.dns.request return nothing until the field is swapped; run the field check in the readiness test.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' (event.dns.request in:anycase ('storage-data.com', 'serv.oss-cn-hongkong.aliyuncs.com') or event.dns.request matches '\\.storage-data\\.com$')
| columns event.time, endpoint.name, src.process.user, src.process.name, event.dns.request
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: DNS lookups for campaign domains and the Alibaba OSS staging bucket
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1583.001, T1583.006, T1105
// CONF: high | FP: low
// FALSE POSITIVES: none expected; the OSS match is on the single bucket host, not on aliyuncs.com as a whole
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: the storage-data.com domain or any subdomain of it, or the single Alibaba OSS bucket host. Defender has no endpoint DNS table, so the name is read from DeviceEvents DnsQueryResponse AdditionalFields.
// REQUIRES: Defender for Endpoint DNS telemetry (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: None expected: the OSS match is on the single bucket host, not on aliyuncs.com as a whole.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 120d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days, so the 120-day campaign window is covered only on the CQL tab. A tenant whose DnsQueryResponse rows carry the name under another key returns nothing; check the readiness test output.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where DnsName in~ ("storage-data.com", "serv.oss-cn-hongkong.aliyuncs.com") or DnsName endswith ".storage-data.com"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, DnsName
| sort by Timestamp desc
| take 200

// HUNT: Hidden PowerShell launching NitroPromotion.exe (ADAPTAGENT staging)
// MITRE: T1059.001, T1036.005
// CONF: high
// FP: low
// COST: low
// REQUIRES: Process creation with command line
// FALSE POSITIVES: none expected; confirm with the Nitro Software owner that no sanctioned tool uses this name
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^NitroPromotion\.exe$/i or CommandLine=/Start-Process.*NitroPromotion\.exe/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData])

event.type = 'Process Creation' tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline

// HUNT: Hidden PowerShell launching NitroPromotion.exe (ADAPTAGENT staging)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.001, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected; confirm with the Nitro Software owner that no sanctioned tool uses this name
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a process named NitroPromotion.exe, or a command line that runs Start-Process against NitroPromotion.exe. The created process is tgt.process.*. The CQL does not test for a hidden window, so neither does this pane.
// REQUIRES: SentinelOne process-creation telemetry with created name and command line
// TUNING: Confirm with the Nitro Software owner that no sanctioned tool uses this name.
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The hidden-window flag in the card title is not tested by the CQL or by this pane.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' (tgt.process.name in:anycase ('NitroPromotion.exe') or tgt.process.cmdline matches 'Start-Process.*NitroPromotion\\.exe')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha256
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: Hidden PowerShell launching NitroPromotion.exe (ADAPTAGENT staging)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.001, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected; confirm with the Nitro Software owner that no sanctioned tool uses this name
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on DeviceProcessEvents: a process named NitroPromotion.exe, or a command line that runs Start-Process against NitroPromotion.exe. The (?i) prefix and =~ reproduce the CQL i flag. The CQL does not test for a hidden window, so neither does this pane.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Confirm with the Nitro Software owner that no sanctioned tool uses this name.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 120d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days, so the 120-day campaign window is covered only on the CQL tab. The hidden-window flag in the card title is not tested by the CQL or by this pane.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName =~ "NitroPromotion.exe" or ProcessCommandLine matches regex @"(?i)Start-Process.*NitroPromotion\.exe"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Outbound SMB to non-private addresses (WebDAV and NTLM coercion fallout)
// MITRE: T1187
// CONF: medium
// FP: medium
// COST: medium
// REQUIRES: Outbound network connection with process
// FALSE POSITIVES: legitimate SMB to cloud or partner storage
// TUNING: exclude sanctioned remote storage IP ranges with !cidr() and known backup appliance hosts; the hosts left are the review set
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
#event_simpleName=NetworkConnectIP4
| RemotePort=445
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","127.0.0.0/8","169.254.0.0/16","100.64.0.0/10"])
| groupBy([ComputerName, ContextBaseFileName, RemoteAddressIP4], function=count(as=conns))
| sort(conns, order=desc)

event.type = 'IP Connect' dst.port.number = 445 dst.ip.address = *
| limit 5
| columns event.time, endpoint.name, src.process.name, dst.ip.address, dst.port.number

// HUNT: Outbound SMB to non-private addresses (WebDAV and NTLM coercion fallout)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1187
// CONF: medium | FP: medium
// FALSE POSITIVES: legitimate SMB to cloud or partner storage
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate: outbound connections to port 445 whose destination is outside RFC1918, loopback, link-local and carrier-grade NAT space, counted per host, process and destination. SentinelOne keys the destination as dst.ip.address and the process as src.process.name.
// REQUIRES: SentinelOne IP Connect network telemetry
// TUNING: Exclude sanctioned remote storage IP ranges with net_ipsubnet and known backup appliance hosts; the hosts left are the review set.
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: IPv6 destinations are not covered, as in the CQL.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' dst.port.number = 445 !(net_rfc1918(dst.ip.address) or net_ipsubnet(dst.ip.address, '127.0.0.0/8') or net_ipsubnet(dst.ip.address, '169.254.0.0/16') or net_ipsubnet(dst.ip.address, '100.64.0.0/10'))
| group conns = count() by endpoint.name, src.process.name, dst.ip.address
| sort -conns
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| where RemotePort == 445
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| take 5

// HUNT: Outbound SMB to non-private addresses (WebDAV and NTLM coercion fallout)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1187
// CONF: medium | FP: medium
// FALSE POSITIVES: legitimate SMB to cloud or partner storage
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate on DeviceNetworkEvents: connections to port 445 whose RemoteIP is outside RFC1918, loopback, link-local and carrier-grade NAT space, counted per host, process and destination.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Exclude sanctioned remote storage IP ranges with ipv4_is_in_range and known backup appliance hosts; the hosts left are the review set.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 120d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days, so the 120-day campaign window is covered only on the CQL tab. IPv6 destinations are not covered, as in the CQL.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemotePort == 445
| where not(ipv4_is_private(RemoteIP)) and not(ipv4_is_in_range(RemoteIP, "127.0.0.0/8")) and not(ipv4_is_in_range(RemoteIP, "169.254.0.0/16")) and not(ipv4_is_in_range(RemoteIP, "100.64.0.0/10"))
| summarize conns = count(), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessFileName, RemoteIP
| sort by conns desc
| take 200

// HUNT: Known campaign file hashes executed or written
// MITRE: T1195.002, T1574.001
// CONF: high
// FP: low
// COST: medium
// REQUIRES: Process creation and executable written with file hash
// FALSE POSITIVES: none expected
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| in(SHA256HashData, values=[
    "11e576df44e9c9eef72b9f5b699291bcdb200a19130778ec231e5b0987b913ad",
    "130c3970f1c900191615b99d8be522d6a488a3d3b73938896ed937092007d96a",
    "9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450",
    "b360b6db0c2b668317edc1504a7c39ef047f0d925c8f113b521f6724c157ae21",
    "5837bc26a73cfb46ffd466cf889f03ce2f6a48f1f3fd42ec8be22189d51cab1e",
    "8fbaa74b27dc1e89abfc694e834378746f0ad37a688098c5f8f511410157c8b8",
    "100657d3e205bfd0e96f1c088ae1739b50657592a696201467b4c65b7d36289a",
    "53b7d01163ccb679001f20e4a8a5e1f33d5d2837c375315f6514cc820f81bd12",
    "14b31918075e6130b9123158743db0a81e2d7bfcf6d39731ee7d9200a98cd591",
    "8c8090aca8ddb1cf968d2b810457e0cfce97c03cd721f70d2eca7f37f2681fc4",
    "7b252be444dee2fb2a57043a823dc5b5e1fae970aea91ee2c8339aa70329969d"
  ])
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, TargetFileName, SHA256HashData])

event.type = 'Process Creation' tgt.process.image.sha256 = *
| limit 5
| columns event.type, tgt.process.image.sha256, tgt.file.sha256

// HUNT: Known campaign file hashes executed or written
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1195.002, T1574.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same hash predicate: the eleven campaign SHA-256 values against the created process image on Process Creation events and against the written file on File Creation and File Modification events. in:anycase keeps the match case-insensitive.
// REQUIRES: SentinelOne process-creation and file telemetry with SHA-256 populated
// TUNING: None expected. Hash hits are exact; confirm the sample against section 4 before acting.
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A file whose hash the sensor did not compute is not matched.
// VALIDATION LEVEL: static-reviewed
event.type in ('Process Creation', 'File Creation', 'File Modification') (tgt.process.image.sha256 in:anycase ('11e576df44e9c9eef72b9f5b699291bcdb200a19130778ec231e5b0987b913ad', '130c3970f1c900191615b99d8be522d6a488a3d3b73938896ed937092007d96a', '9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450', 'b360b6db0c2b668317edc1504a7c39ef047f0d925c8f113b521f6724c157ae21', '5837bc26a73cfb46ffd466cf889f03ce2f6a48f1f3fd42ec8be22189d51cab1e', '8fbaa74b27dc1e89abfc694e834378746f0ad37a688098c5f8f511410157c8b8', '100657d3e205bfd0e96f1c088ae1739b50657592a696201467b4c65b7d36289a', '53b7d01163ccb679001f20e4a8a5e1f33d5d2837c375315f6514cc820f81bd12', '14b31918075e6130b9123158743db0a81e2d7bfcf6d39731ee7d9200a98cd591', '8c8090aca8ddb1cf968d2b810457e0cfce97c03cd721f70d2eca7f37f2681fc4', '7b252be444dee2fb2a57043a823dc5b5e1fae970aea91ee2c8339aa70329969d') or tgt.file.sha256 in:anycase ('11e576df44e9c9eef72b9f5b699291bcdb200a19130778ec231e5b0987b913ad', '130c3970f1c900191615b99d8be522d6a488a3d3b73938896ed937092007d96a', '9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450', 'b360b6db0c2b668317edc1504a7c39ef047f0d925c8f113b521f6724c157ae21', '5837bc26a73cfb46ffd466cf889f03ce2f6a48f1f3fd42ec8be22189d51cab1e', '8fbaa74b27dc1e89abfc694e834378746f0ad37a688098c5f8f511410157c8b8', '100657d3e205bfd0e96f1c088ae1739b50657592a696201467b4c65b7d36289a', '53b7d01163ccb679001f20e4a8a5e1f33d5d2837c375315f6514cc820f81bd12', '14b31918075e6130b9123158743db0a81e2d7bfcf6d39731ee7d9200a98cd591', '8c8090aca8ddb1cf968d2b810457e0cfce97c03cd721f70d2eca7f37f2681fc4', '7b252be444dee2fb2a57043a823dc5b5e1fae970aea91ee2c8339aa70329969d'))
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.file.path, tgt.process.image.sha256, tgt.file.sha256
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| where isnotempty(SHA256)
| project Timestamp, FolderPath, SHA256
| take 5

// HUNT: Known campaign file hashes executed or written
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1195.002, T1574.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: telemetry-gap - A single Advanced Hunting query reads one table. This pane pivots the eleven SHA-256 values on DeviceFileEvents, which sees the written half of the CQL. The executed half would need DeviceProcessEvents, where SHA256 is often unpopulated, so it is left to the CQL tab.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents) with SHA256 populated
// TUNING: None expected. Hash hits are exact; confirm the sample against section 4 before acting.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 120d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Process executions of these hashes are not covered; the CQL tab covers them. Advanced Hunting keeps 30 days, so the 120-day campaign window is covered only on the CQL tab. A file whose hash the sensor did not compute is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where SHA256 in~ ("11e576df44e9c9eef72b9f5b699291bcdb200a19130778ec231e5b0987b913ad", "130c3970f1c900191615b99d8be522d6a488a3d3b73938896ed937092007d96a", "9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450", "b360b6db0c2b668317edc1504a7c39ef047f0d925c8f113b521f6724c157ae21", "5837bc26a73cfb46ffd466cf889f03ce2f6a48f1f3fd42ec8be22189d51cab1e", "8fbaa74b27dc1e89abfc694e834378746f0ad37a688098c5f8f511410157c8b8", "100657d3e205bfd0e96f1c088ae1739b50657592a696201467b4c65b7d36289a", "53b7d01163ccb679001f20e4a8a5e1f33d5d2837c375315f6514cc820f81bd12", "14b31918075e6130b9123158743db0a81e2d7bfcf6d39731ee7d9200a98cd591", "8c8090aca8ddb1cf968d2b810457e0cfce97c03cd721f70d2eca7f37f2681fc4", "7b252be444dee2fb2a57043a823dc5b5e1fae970aea91ee2c8339aa70329969d")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, ActionType, FileName, FolderPath, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: SHINYROAD and ADAPTAGENT C2 ports from sideload hosts
// MITRE: T1571, T1219.002
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Outbound network connection with process
// FALSE POSITIVES: other software using port 6800
// TUNING: restrict to non-RFC1918 destinations with !cidr() if internal services use 6800, and exclude baselined dllhost destinations
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
#event_simpleName=NetworkConnectIP4
| in(RemotePort, values=[41397, 6800])
| ContextBaseFileName=/^(FamItrf[c2]|dllhost|NitroPromotion|Nitro_Scan2PDFApp|rundll32)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort])

event.type = 'IP Connect' dst.port.number = * src.process.name = *
| limit 5
| columns event.time, src.process.name, dst.ip.address, dst.port.number

// HUNT: SHINYROAD and ADAPTAGENT C2 ports from sideload hosts
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1571, T1219.002
// CONF: medium | FP: medium
// FALSE POSITIVES: other software using port 6800
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate: an outbound connection to port 41397 or 6800 from a Radmin launcher, dllhost, NitroPromotion, Nitro_Scan2PDFApp or rundll32. The connecting process is src.process.name on an IP Connect event.
// REQUIRES: SentinelOne IP Connect network telemetry with the connecting process
// TUNING: Restrict to non-private destinations with net_rfc1918 if internal services use port 6800, and exclude baselined dllhost destinations.
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Other software using port 6800 can match when it runs under one of the listed process names.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' dst.port.number in (41397, 6800) src.process.name matches '^(FamItrf[c2]|dllhost|NitroPromotion|Nitro_Scan2PDFApp|rundll32)(\\.exe)?$'
| columns event.time, endpoint.name, src.process.user, src.process.name, dst.ip.address, dst.port.number
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, RemotePort
| take 5

// HUNT: SHINYROAD and ADAPTAGENT C2 ports from sideload hosts
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1571, T1219.002
// CONF: medium | FP: medium
// FALSE POSITIVES: other software using port 6800
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate on DeviceNetworkEvents: an outbound connection to port 41397 or 6800 from one of the five named processes. The (?i) prefix reproduces the CQL i flag.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Restrict to non-private destinations with ipv4_is_private if internal services use port 6800, and exclude baselined dllhost destinations.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 120d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days, so the 120-day campaign window is covered only on the CQL tab. Other software using port 6800 can match when it runs under one of the listed process names.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemotePort in (41397, 6800)
| where InitiatingProcessFileName matches regex @"(?i)^(FamItrf[c2]|dllhost|NitroPromotion|Nitro_Scan2PDFApp|rundll32)(\.exe)?$"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteIP, RemotePort
| sort by Timestamp desc
| take 200

// HUNT: Silent Radmin Server install (rsetup64.exe /intsetup)
// MITRE: T1219.002
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Process creation with command line and parent
// FALSE POSITIVES: IT-managed Radmin deployments
// TUNING: exclude ParentBaseFileName values for your software deployment agent; keep any hit whose parent image path sits under an AOMEI directory
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^rsetup64(\.exe)?$/i
| CommandLine=/intsetup/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine])

event.type = 'Process Creation' tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline

// HUNT: Silent Radmin Server install (rsetup64.exe /intsetup)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1219.002
// CONF: medium | FP: medium
// FALSE POSITIVES: IT-managed Radmin deployments
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a created process named rsetup64 whose command line contains intsetup. The created process is tgt.process.*. contains and matches are case-insensitive, which reproduces the CQL i flag.
// REQUIRES: SentinelOne process-creation telemetry with created name and command line
// TUNING: Exclude creator names for your software deployment agent; keep any hit whose creator image path sits under an AOMEI directory.
// LOOKBACK: 120d (covers the April to July 2026 campaign window; set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The creator image path is not projected; pivot on src.process.name and the host to find it.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name matches '^rsetup64(\\.exe)?$' tgt.process.cmdline contains 'intsetup'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: Silent Radmin Server install (rsetup64.exe /intsetup)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1219.002
// CONF: medium | FP: medium
// FALSE POSITIVES: IT-managed Radmin deployments
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on DeviceProcessEvents: a created process named rsetup64 whose command line contains intsetup. contains and in~ are case-insensitive, which reproduces the CQL i flag.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude initiating process names for your software deployment agent; keep any hit whose initiating process path sits under an AOMEI directory.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 120d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days, so the 120-day campaign window is covered only on the CQL tab. A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("rsetup64.exe", "rsetup64")
| where ProcessCommandLine contains "intsetup"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, FileName, FolderPath, ProcessCommandLine
| sort by Timestamp desc
| take 200