AhsayCBS CVE-2026-105133 + CVE-2026-105134: Webshell, XMRig Disguised as Edge, NSSM Service and WinRing0 Driver

// HUNT: any unexpected child of the AhsayCBS service process (webshell / RCE execution)
// MITRE: T1190, T1505.003, T1059.003
// CONF: high | FP: low | COST: low | REQUIRES: ProcessRollup2 with ParentBaseFileName and CommandLine
// SOURCE: Huntress advisory + Huntress Sigma rule "Unexpected Child Process from AhsayCBS Service"
// FALSE POSITIVES: AhsayCBS releases that add new startup or maintenance commands
// TUNING: if a release adds a benign startup command, add one more | CommandLine!=/.../i line for that exact string; never exclude by FileName alone
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^cbssvcX(64|86)\.exe$/i
| FileName!=/^(7za|rotatelogs|conhost|java|cbssvcX64|cbssvcX86)\.exe$/i
| CommandLine!=/^("?([a-z]:\\windows\\system32\\)?cmd\.exe"? \/c (ipconfig \/all|ver|uname -i)|ipconfig +\/all)\s*$/i
| CommandLine!=/^cmd\.exe \/c bin\\MigrateV7\.bat >\.\\MigrateV7\.log\s*$/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, SHA256HashData, aid], limit=200)

event.type = 'Process Creation' endpoint.name = * src.process.name = * tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: any unexpected child of the AhsayCBS service process (webshell / RCE execution)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1505.003, T1059.003
// CONF: high | FP: low
// FALSE POSITIVES: AhsayCBS releases that add new startup or maintenance commands
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate as the CQL: creator is the AhsayCBS service binary, child not on the benign allowlist, two exact benign command lines excluded. Lineage re-mapped for SentinelOne.
// REQUIRES: SentinelOne Process Creation telemetry on the AhsayCBS server
// TUNING: If a release adds a benign startup command, add one more !(tgt.process.cmdline matches ...) line for that exact string; never exclude by process name alone.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A child launched by a process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name matches '^cbssvcX(64|86)\\.exe$'
!(tgt.process.name in:anycase ('7za.exe','rotatelogs.exe','conhost.exe','java.exe','cbssvcX64.exe','cbssvcX86.exe'))
!(tgt.process.cmdline matches '^("?([a-z]:\\\\windows\\\\system32\\\\)?cmd\\.exe"? /c (ipconfig /all|ver|uname -i)|ipconfig +/all)\\s*$')
!(tgt.process.cmdline matches '^cmd\\.exe /c bin\\\\MigrateV7\\.bat >\\.\\\\MigrateV7\\.log\\s*$')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name, tgt.process.image.sha256, agent.uuid
| limit 200

// HUNT: AhsayCBS service process launching curl / certutil / PowerShell / recon utilities
// MITRE: T1190, T1105, T1059.001, T1059.003
// CONF: high | FP: low | COST: low | REQUIRES: ProcessRollup2 with ParentBaseFileName
// SOURCE: Huntress advisory (cbssvcX64.exe spawned curl and certutil to drop payloads in %TEMP%)
// FALSE POSITIVES: none expected
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^cbssvcX(64|86)\.exe$/i
| FileName=/^(curl|certutil|powershell|pwsh|bitsadmin|wget|mshta|sc|schtasks|whoami|systeminfo|net|net1|nltest|tasklist)\.exe$/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, SHA256HashData, aid], limit=200)

event.type = 'Process Creation' endpoint.name = * src.process.name = * tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: AhsayCBS service process launching curl / certutil / PowerShell / recon utilities
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1105, T1059.001, T1059.003
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: AhsayCBS service as creator and a download, shell or recon utility as the child. Lineage re-mapped for SentinelOne.
// REQUIRES: SentinelOne Process Creation telemetry on the AhsayCBS server
// TUNING: No exclusions expected; investigate every hit.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A child launched by a process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name matches '^cbssvcX(64|86)\\.exe$'
tgt.process.name in:anycase ('curl.exe','certutil.exe','powershell.exe','pwsh.exe','bitsadmin.exe','wget.exe','mshta.exe','sc.exe','schtasks.exe','whoami.exe','systeminfo.exe','net.exe','net1.exe','nltest.exe','tasklist.exe')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name, tgt.process.image.sha256, agent.uuid
| limit 200

// HUNT: command line fetching from the campaign OSS bucket / path, or naming Taskgmr.ps1
// MITRE: T1105, T1608.001, T1059.003
// CONF: high | FP: low | COST: low | REQUIRES: ProcessRollup2 with CommandLine
// SOURCE: Huntress advisory (curl download command, payload URLs); bucket name is single-sourced
// FALSE POSITIVES: none expected
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(imagefiles-backup\.oss-ap-southeast-7\.aliyuncs\.com|\/javas\/Office\/win\/|Taskgmr\.ps1)/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, aid], limit=200)

event.type = 'Process Creation' endpoint.name = * tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.process.name, tgt.process.cmdline

// HUNT: command line fetching from the campaign OSS bucket / path, or naming Taskgmr.ps1
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1105, T1608.001, T1059.003
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same command-line substring test for the campaign OSS bucket, the /javas/Office/win/ path and Taskgmr.ps1. contains is used so the domain stays verbatim.
// REQUIRES: SentinelOne Process Creation telemetry with command lines
// TUNING: No exclusions expected.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: Downloads made by a process that does not carry the URL on its own command line are not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.cmdline contains ('imagefiles-backup.oss-ap-southeast-7.aliyuncs.com','/javas/Office/win/','Taskgmr.ps1')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name, agent.uuid
| limit 200

// HUNT: command line naming WinRing0 together with a URL (certutil / curl driver fetch)
// MITRE: T1105, T1496.001
// CONF: high | FP: low | COST: low | REQUIRES: ProcessRollup2 with CommandLine
// SOURCE: Huntress advisory + Huntress Sigma rule "WinRing0 Driver Downloaded via Command Line"
// FALSE POSITIVES: administrators manually fetching a hardware-monitoring driver
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/winring0/i
| CommandLine=/(https?|ftp):\/\//i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, aid], limit=200)

event.type = 'Process Creation' endpoint.name = * tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.process.name, tgt.process.cmdline

// HUNT: command line naming WinRing0 together with a URL (certutil / curl driver fetch)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1105, T1496.001
// CONF: high | FP: low
// FALSE POSITIVES: administrators manually fetching a hardware-monitoring driver
// EQUIVALENCE: equivalent-with-schema-assumptions - Same two-part test: WinRing0 on the command line together with an http, https or ftp URL.
// REQUIRES: SentinelOne Process Creation telemetry with command lines
// TUNING: Exclude a reviewed hardware-monitoring installer by full command line if one is legitimate.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A driver fetched by a process that hides the URL from its command line is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.cmdline contains 'winring0'
tgt.process.cmdline matches '(https?|ftp)://'
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name, agent.uuid
| limit 200

// HUNT: edge.exe / msedge.exe executing from Temp, Public or ProgramData, or with --daemonized
// MITRE: T1036.005, T1496.001, T1569.002
// CONF: high | FP: low | COST: low | REQUIRES: ProcessRollup2 with ImageFileName and CommandLine
// SOURCE: Huntress advisory + Huntress Sigma rule "Fake Edge Binary Launched with Daemonized Flag"
// FALSE POSITIVES: a portable Edge copy deliberately placed in a user folder
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(edge|msedge)\.exe$/i
| ImageFileName=/\\(Temp|Users\\Public|ProgramData)\\[^\\]+$/i OR CommandLine=/--daemonized/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData, aid], limit=200)

event.type = 'Process Creation' endpoint.name = * src.process.name = * tgt.process.name = * tgt.process.cmdline = * tgt.process.image.path = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.process.image.path

// HUNT: edge.exe / msedge.exe executing from Temp, Public or ProgramData, or with --daemonized
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1036.005, T1496.001, T1569.002
// CONF: high | FP: low
// FALSE POSITIVES: a portable Edge copy deliberately placed in a user folder
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an Edge-named image running from Temp, Users\Public or ProgramData, or carrying --daemonized.
// REQUIRES: SentinelOne Process Creation telemetry with image paths and command lines
// TUNING: A deliberate portable Edge copy in a user folder should be excluded by full image path after review.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A miner renamed to something other than edge.exe or msedge.exe is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name in:anycase ('edge.exe','msedge.exe')
(tgt.process.image.path matches '\\\\(Temp|Users\\\\Public|ProgramData)\\\\[^\\\\]+$' or tgt.process.cmdline contains '--daemonized')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, src.process.name, tgt.process.image.sha256, agent.uuid
| limit 200

// HUNT: msedge.exe (NSSM wrapper) as parent of edge.exe (XMRig miner)
// MITRE: T1543.003, T1036.005, T1496.001
// CONF: high | FP: low | COST: low | REQUIRES: ProcessRollup2 with ParentBaseFileName
// SOURCE: Huntress advisory (msedge.exe is a modified NSSM that keeps edge.exe running)
// FALSE POSITIVES: none expected
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^msedge\.exe$/i
| FileName=/^edge\.exe$/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData, aid], limit=200)

event.type = 'Process Creation' endpoint.name = * src.process.name = * tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: msedge.exe (NSSM wrapper) as parent of edge.exe (XMRig miner)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1543.003, T1036.005, T1496.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same parent and child names. Lineage re-mapped: msedge.exe is the creator (src.process.name) and edge.exe the child (tgt.process.name).
// REQUIRES: SentinelOne Process Creation telemetry
// TUNING: No exclusions expected.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A wrapper that does not appear as the creator on the event is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
src.process.name in:anycase ('msedge.exe')
tgt.process.name in:anycase ('edge.exe')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, src.process.name, tgt.process.image.sha256, agent.uuid
| limit 200

// HUNT: service named MicrosoftEdgeUpdateSvc / EdgeUpdateHelper, or Edge-named service image in Temp
// MITRE: T1543.003, T1036.004, T1569.002
// CONF: high | FP: low | COST: low | REQUIRES: CreateService with ServiceDisplayName and ServiceImagePath (validate in tenant)
// SOURCE: Huntress advisory (service MicrosoftEdgeUpdateSvc, SYSTEM, msedge.exe in Temp); EdgeUpdateHelper from the Huntress Sigma rule notes
// FALSE POSITIVES: none expected
// LOOKBACK: 30d
#event_simpleName=CreateService
| ServiceDisplayName=/^(MicrosoftEdgeUpdateSvc|EdgeUpdateHelper)$/i OR ServiceImagePath=/\\Temp\\(ms)?edge\.exe/i
| table([@timestamp, ComputerName, UserName, ServiceDisplayName, ServiceImagePath, aid], limit=200)

event.type = 'Process Creation'
| limit 5
| columns event.type

// HUNT: service named MicrosoftEdgeUpdateSvc / EdgeUpdateHelper, or Edge-named service image in Temp
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1543.003, T1036.004, T1569.002
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: unsupported-without-redesign - The CQL reads a Falcon service-creation sensor event; SentinelOne has no attested service-creation event type or service-name field in the Endpoint profile.
// REQUIRES: A service-creation event or the Windows Event Logs source with Event ID 7045
// TUNING: Use the CQL tab, or hunt Q5 and Q6 for the service-launched binary.
// LOOKBACK: 30d on the CQL tab
// CONFIGURATION: Use the CQL tab for this card.
// KNOWN GAPS: Service display name and image path at creation are not visible in the attested field model.
// VALIDATION LEVEL: static-reviewed

// HUNT: service created with an image path inside a Temp folder
// MITRE: T1543.003, T1569.002
// CONF: medium | FP: medium | COST: low | REQUIRES: CreateService with ServiceImagePath (validate in tenant)
// SOURCE: Huntress advisory (service wrapper executed from the Temp folder as SYSTEM)
// FALSE POSITIVES: installers or updaters that register a transient service from a Temp extraction folder
// TUNING: exclude the named installer once reviewed, for example | ServiceImagePath!=/\\Temp\\(YourVendorSetup)\\/i ; exclude by full path, never by extension
// LOOKBACK: 30d
#event_simpleName=CreateService
| ServiceImagePath=/\\Temp\\[^\\]+\.(exe|sys)/i
| table([@timestamp, ComputerName, UserName, ServiceDisplayName, ServiceImagePath, aid], limit=200)

event.type = 'Process Creation'
| limit 5
| columns event.type

// HUNT: service created with an image path inside a Temp folder
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1543.003, T1569.002
// CONF: medium | FP: medium
// FALSE POSITIVES: installers or updaters that register a transient service from a Temp extraction folder
// EQUIVALENCE: unsupported-without-redesign - The CQL reads a Falcon service-creation sensor event; SentinelOne has no attested service-creation event type or ServiceImagePath field in the Endpoint profile.
// REQUIRES: A service-creation event or the Windows Event Logs source with Event ID 7045
// TUNING: Use the CQL tab, or hunt Q5 for Edge-named images running from Temp.
// LOOKBACK: 30d on the CQL tab
// CONFIGURATION: Use the CQL tab for this card.
// KNOWN GAPS: Service image paths at creation are not visible in the attested field model.
// VALIDATION LEVEL: static-reviewed

// HUNT: PE written to Temp as edge.exe / msedge.exe / WinRing0x64.sys
// MITRE: T1105, T1036.005, T1496.001
// CONF: high | FP: medium | COST: low | REQUIRES: PeFileWritten / NewExecutableWritten with TargetFileName
// SOURCE: Huntress advisory (payloads dropped in %TEMP%, driver at ...\AppData\Local\Temp\WinRing0x64.sys)
// FALSE POSITIVES: legitimate hardware-monitoring installers that ship the WinRing0 driver
// TUNING: for the .sys branch only, exclude a reviewed installer writer, for example | ContextBaseFileName!=/^(YourMonitoringTool)\.exe$/i ; never exclude edge.exe or msedge.exe
// LOOKBACK: 30d
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| TargetFileName=/\\Temp\\(edge|msedge|WinRing0x64)\.(exe|sys)$/i
| table([@timestamp, ComputerName, UserName, TargetFileName, ContextBaseFileName, SHA256HashData, aid], limit=200)

event.type = 'File Creation' endpoint.name = * tgt.file.path = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.file.path

// HUNT: PE written to Temp as edge.exe / msedge.exe / WinRing0x64.sys
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1105, T1036.005, T1496.001
// CONF: high | FP: medium
// FALSE POSITIVES: legitimate hardware-monitoring installers that ship the WinRing0 driver
// EQUIVALENCE: equivalent-with-schema-assumptions - Same Temp-folder file-name test. PE-write events map to File Creation; the writer is src.process.* on file events.
// REQUIRES: SentinelOne File Creation telemetry
// TUNING: For the .sys branch exclude a reviewed installer writer by src.process.name; never exclude edge.exe or msedge.exe.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A file written by a kernel or remote path without a File Creation event is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'File Creation'
tgt.file.path matches '\\\\Temp\\\\(edge|msedge|WinRing0x64)\\.(exe|sys)$'
| columns event.time, endpoint.name, src.process.user, tgt.file.path, src.process.name, tgt.file.sha256, agent.uuid
| limit 200

// HUNT: published campaign SHA-256 values seen in process or PE-write telemetry
// MITRE: T1105, T1036.005, T1496.001
// CONF: medium | FP: low | COST: medium | REQUIRES: SHA256HashData on ProcessRollup2 / PeFileWritten / NewExecutableWritten
// SOURCE: Huntress advisory IOC table (single source; hashes change on rebuild)
// FALSE POSITIVES: none expected
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| in(field="SHA256HashData", values=["05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034", "4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d", "481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21"])
| table([@timestamp, #event_simpleName, ComputerName, UserName, FileName, SHA256HashData, ParentBaseFileName, aid], limit=200)

event.type = 'Process Creation' endpoint.name = * tgt.process.image.sha256 = * tgt.file.sha256 = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.process.image.sha256, tgt.file.sha256

// HUNT: published campaign SHA-256 values seen in process or PE-write telemetry
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1105, T1036.005, T1496.001
// CONF: medium | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same three published SHA-256 values tested on process creation and on file creation.
// REQUIRES: SentinelOne Process Creation and File Creation events with SHA-256 populated
// TUNING: Hashes change on rebuild; treat a miss as no evidence.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: The third value is a PowerShell script hash; it is not seen as a process image hash, so only file-creation of that script can match.
// VALIDATION LEVEL: static-reviewed
(event.type = 'Process Creation' tgt.process.image.sha256 in ('05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034','4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d','481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21')) or (event.type = 'File Creation' tgt.file.sha256 in ('05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034','4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d','481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21'))
| columns event.type, event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.sha256, tgt.file.path, tgt.file.sha256, src.process.name, agent.uuid
| limit 200

// HUNT: network connection to the Kryptex pool IP, or TCP 8029 from edge.exe / msedge.exe
// MITRE: T1571, T1496.001
// CONF: high | FP: low | COST: low | REQUIRES: NetworkConnectIP4 with ContextBaseFileName
// SOURCE: Huntress advisory (pool IP 51.195.127.124:8029; miner process edge.exe)
// FALSE POSITIVES: none expected
// LOOKBACK: 30d
#event_simpleName=NetworkConnectIP4
| RemoteAddressIP4="51.195.127.124" OR (RemotePort=8029 AND ContextBaseFileName=/^(edge|msedge)\.exe$/i)
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort, aid], limit=200)

event.type = 'IP Connect' endpoint.name = * src.process.name = * dst.ip.address = * dst.port.number = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, dst.ip.address, dst.port.number

// HUNT: network connection to the Kryptex pool IP, or TCP 8029 from edge.exe / msedge.exe
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1571, T1496.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same test: connection to the pool IP, or TCP 8029 from an Edge-named process. The acting process is src.process.* on network events.
// REQUIRES: SentinelOne IP Connect telemetry
// TUNING: No exclusions expected.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: Connections from a process renamed to something other than edge.exe or msedge.exe to a different pool are not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect'
(dst.ip.address = '51.195.127.124' or (dst.port.number = 8029 and src.process.name in:anycase ('edge.exe','msedge.exe')))
| columns event.time, endpoint.name, src.process.user, src.process.name, dst.ip.address, dst.port.number, agent.uuid
| limit 200

// HUNT: DNS resolution of the Kryptex pool host or the campaign Alibaba Cloud OSS bucket
// MITRE: T1071.001, T1571, T1496.001
// CONF: high | FP: low | COST: low | REQUIRES: DnsRequest with DomainName
// SOURCE: Huntress advisory (pool host and payload bucket); both single-sourced
// FALSE POSITIVES: none expected
// LOOKBACK: 30d
#event_simpleName=DnsRequest
| DomainName=/^(xmr\.kryptex\.network|imagefiles-backup\.oss-ap-southeast-7\.aliyuncs\.com)$/i
| table([@timestamp, ComputerName, UserName, DomainName, ContextProcessId_decimal, aid], limit=200)

event.type = 'DNS Resolved' endpoint.name = * event.dns.request = *
| limit 5
| columns event.type, event.time, endpoint.name, event.dns.request

// HUNT: DNS resolution of the Kryptex pool host or the campaign Alibaba Cloud OSS bucket
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1571, T1496.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same exact-name test for the pool host and the payload bucket on DNS resolution events.
// REQUIRES: SentinelOne DNS Resolved telemetry
// TUNING: No exclusions expected.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: Lookups made through an encrypted resolver that bypasses the host stack are not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved'
event.dns.request in:anycase ('xmr.kryptex.network','imagefiles-backup.oss-ap-southeast-7.aliyuncs.com')
| columns event.time, endpoint.name, src.process.user, event.dns.request, src.process.name, agent.uuid
| limit 200

// HUNT: inbound accept or outbound connect involving the six reported exploitation addresses
// MITRE: T1190
// CONF: medium | FP: medium | COST: medium | REQUIRES: NetworkReceiveAcceptIP4 / NetworkConnectIP4 with RemoteAddressIP4 (validate in tenant)
// SOURCE: Huntress advisory IOC table (single source, perishable)
// FALSE POSITIVES: shared cloud or anonymizing ranges, scanners
// TUNING: trust a hit only when the same aid also fires Q1, Q2 or Q3; scope to the AhsayCBS hosts with | in(field="aid", values=[...]) or a ComputerName filter
// LOOKBACK: 30d
#event_simpleName=/^(NetworkReceiveAcceptIP4|NetworkConnectIP4)$/
| in(field="RemoteAddressIP4", values=["177.4.12.11", "38.60.252.110", "107.191.47.199", "185.220.236.49", "104.234.26.10", "123.202.208.37"])
| table([@timestamp, #event_simpleName, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort, LocalPort, aid], limit=200)

event.type = 'IP Connect' endpoint.name = * dst.ip.address = * src.ip.address = *
| limit 5
| columns event.type, event.time, endpoint.name, dst.ip.address, src.ip.address

// HUNT: inbound accept or outbound connect involving the six reported exploitation addresses
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190
// CONF: medium | FP: medium
// FALSE POSITIVES: shared cloud or anonymizing ranges, scanners
// EQUIVALENCE: approximate-analytic - SentinelOne IP Connect does not separate accept from connect as the CQL events do, so both directions are covered by testing the six addresses in either the source or destination field.
// REQUIRES: SentinelOne IP Connect telemetry
// TUNING: Trust a hit only when the same host also fires Q1, Q2 or Q3; scope to the AhsayCBS hosts by endpoint.name.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: Inbound-only scans that never reach a listener the agent records are not captured. The addresses are perishable and single-sourced.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect'
(dst.ip.address in ('177.4.12.11','38.60.252.110','107.191.47.199','185.220.236.49','104.234.26.10','123.202.208.37') or src.ip.address in ('177.4.12.11','38.60.252.110','107.191.47.199','185.220.236.49','104.234.26.10','123.202.208.37'))
| columns event.time, endpoint.name, src.process.name, src.ip.address, src.port.number, dst.ip.address, dst.port.number, agent.uuid
| limit 200

// HUNT: PowerShell invoking Taskgmr.ps1, or Task Manager awareness combined with Stop-/Start-Service
// MITRE: T1059.001, T1564, T1057, T1124
// CONF: medium | FP: low | COST: low | REQUIRES: ProcessRollup2 with CommandLine
// SOURCE: Huntress advisory + Huntress Sigma rule "PowerShell Scriptblock - Task Manager Aware Service Control"
// FALSE POSITIVES: admin scripts that coordinate a service with Task Manager (rare)
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(powershell|pwsh)\.exe$/i
| CommandLine=/Taskgmr\.ps1/i OR (CommandLine=/taskmgr/i AND CommandLine=/(Stop|Start)-Service/i)
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, aid], limit=200)

event.type = 'Process Creation' endpoint.name = * tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.process.name, tgt.process.cmdline

// HUNT: PowerShell invoking Taskgmr.ps1, or Task Manager awareness combined with Stop-/Start-Service
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.001, T1564, T1057, T1124
// CONF: medium | FP: low
// FALSE POSITIVES: admin scripts that coordinate a service with Task Manager (rare)
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on the PowerShell command line: Taskgmr.ps1, or Task Manager awareness combined with Stop-Service or Start-Service.
// REQUIRES: SentinelOne Process Creation telemetry with command lines
// TUNING: Exclude a reviewed admin script by full command line.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: Script content loaded from a file that never appears on the command line is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name in:anycase ('powershell.exe','pwsh.exe')
(tgt.process.cmdline contains 'Taskgmr.ps1' or (tgt.process.cmdline contains 'taskmgr' and tgt.process.cmdline matches '(Stop|Start)-Service'))
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name, agent.uuid
| limit 200

// HUNT: correlate AhsayCBS exploitation-to-miner signals per host (two or more distinct signals)
// MITRE: T1190, T1105, T1543.003, T1036.005, T1496.001
// CONF: high | FP: low | COST: medium | REQUIRES: ProcessRollup2, CreateService, PeFileWritten, NewExecutableWritten, NetworkConnectIP4
// SOURCE: Huntress advisory (full chain); composite of Q2, Q5, Q7, Q9, Q11, Q14
// FALSE POSITIVES: very low; each signal is rare on its own
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|CreateService|PeFileWritten|NewExecutableWritten|NetworkConnectIP4)$/
| case {
    #event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ | ParentBaseFileName=/^cbssvcX(64|86)\.exe$/i | FileName=/^(curl|certutil)\.exe$/i | Signal := "cbs_download_child";
    #event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ | FileName=/^(edge|msedge)\.exe$/i | ImageFileName=/\\(Temp|Users\\Public|ProgramData)\\[^\\]+$/i | Signal := "fake_edge_process";
    #event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ | FileName=/^(powershell|pwsh)\.exe$/i | CommandLine=/Taskgmr\.ps1/i | Signal := "taskgmr_script";
    #event_simpleName=CreateService | ServiceDisplayName=/^(MicrosoftEdgeUpdateSvc|EdgeUpdateHelper)$/i | Signal := "edge_update_service";
    #event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/ | TargetFileName=/\\Temp\\(edge|msedge|WinRing0x64)\.(exe|sys)$/i | Signal := "temp_staging";
    #event_simpleName=NetworkConnectIP4 | RemoteAddressIP4="51.195.127.124" | Signal := "pool_connection";
    * | Signal := "none";
  }
| !in(field="Signal", values=["none"])
| groupBy([aid, ComputerName], function=[count(Signal, distinct=true, as=DistinctSignals), collect([Signal], limit=10), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=20000)
| DistinctSignals>1
| sort(DistinctSignals, order=desc, limit=200)

event.type = 'Process Creation'
| limit 5
| columns event.type

// HUNT: correlate AhsayCBS exploitation-to-miner signals per host (two or more distinct signals)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1105, T1543.003, T1036.005, T1496.001
// CONF: high | FP: low
// FALSE POSITIVES: very low; each signal is rare on its own
// EQUIVALENCE: unsupported-without-redesign - The CQL correlates six signals across sensor events including service creation with a distinct-count threshold per host; a single PowerQuery cannot reproduce the service signal and the multi-event distinct count in the offline engine.
// REQUIRES: All of the underlying signals plus a per-host distinct signal count
// TUNING: Run Q2, Q5, Q9, Q11 and Q14 and correlate hits by endpoint.name by hand.
// LOOKBACK: 30d on the CQL tab
// CONFIGURATION: Use the CQL tab for this card.
// KNOWN GAPS: No composite per-host signal count is shipped; the cbs_download_child, fake_edge_process, taskgmr_script, temp_staging and pool_connection signals are covered by Q2, Q5, Q14, Q9 and Q11 individually.
// VALIDATION LEVEL: static-reviewed