Antino Backdoor (UAT-11587) Hunt

// HUNT: mshta/wscript spawned from mail, browser or Office, or run against a remote URL
// MITRE: T1566.002, T1218.005, T1059.007
// CONF: medium  FP: medium  COST: low
// REQUIRES: process creation with command line and parent (ProcessRollup2)
// FALSE POSITIVES: legacy intranet HTA apps, vendor installers calling mshta.exe
// TUNING: exclude known internal HTA hosts or script paths via CommandLine, and sanctioned wscript logon scripts from managed UNC paths
// LOOKBACK: 30d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(mshta|wscript)\.exe$/i
| (ParentBaseFileName=/^(outlook|olk|hxoutlook|thunderbird|chrome|msedge|firefox|brave|opera|iexplore|winword|excel|powerpnt|acrobat|acrord32)\.exe$/i or CommandLine=/https?:/i)
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, ImageFileName, SHA256HashData])

event.type = 'Process Creation' endpoint.name = * src.process.name = * tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: mshta/wscript spawned from mail, browser or Office, or run against a remote URL
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1566.002, T1218.005, T1059.007
// CONF: medium | FP: medium
// FALSE POSITIVES: legacy intranet HTA apps, vendor installers calling mshta.exe
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: mshta or wscript created by a mail client, browser, Office or PDF parent, or carrying an http(s) URL on its command line. Lineage re-mapped for SentinelOne.
// REQUIRES: SentinelOne Process Creation telemetry with command lines
// TUNING: Exclude known internal HTA hosts or script paths by full command line, and sanctioned wscript logon scripts from managed UNC paths. Never exclude by process name alone.
// LOOKBACK: 30d; set the console time range to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A script host launched by a process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name in:anycase ('mshta.exe','wscript.exe')
(src.process.name in:anycase ('outlook.exe','olk.exe','hxoutlook.exe','thunderbird.exe','chrome.exe','msedge.exe','firefox.exe','brave.exe','opera.exe','iexplore.exe','winword.exe','excel.exe','powerpnt.exe','acrobat.exe','acrord32.exe') or tgt.process.cmdline matches 'https?:')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name, tgt.process.image.path, tgt.process.image.sha256, agent.uuid
| limit 200

// HUNT: script host process resolving Cloudflare Pages / R2 / CloudFront
// MITRE: T1218.005, T1059.007, T1102
// CONF: high  FP: low  COST: medium
// REQUIRES: process creation (ProcessRollup2) + DNS requests with initiating process (DnsRequest)
// FALSE POSITIVES: near none; legacy HTA apps hosted on CloudFront are the only realistic source
// LOOKBACK: 30d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|DnsRequest)$/
| coalesce([ContextProcessId, TargetProcessId], as=falconPID)
| selfJoinFilter(field=[aid, falconPID], where=[
    {#event_simpleName=ProcessRollup2 FileName=/^(mshta|wscript|cscript)\.exe$/i},
    {#event_simpleName=DnsRequest DomainName=/\.(pages\.dev|r2\.dev|cloudfront\.net)$/i}
  ])
| groupBy([aid, falconPID], function=[collect([ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, DomainName]), min(@timestamp, as=FirstSeen), count(as=Events)], limit=1000)

event.type = 'DNS Resolved' endpoint.name = * src.process.name = * event.dns.request = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, event.dns.request

// HUNT: script host process resolving Cloudflare Pages / R2 / CloudFront
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1218.005, T1059.007, T1102
// CONF: high | FP: low
// FALSE POSITIVES: near none; legacy HTA apps hosted on CloudFront are the only realistic source
// EQUIVALENCE: equivalent-with-schema-assumptions - The CQL joins process-creation and DNS events on the process id; SentinelOne's DNS Resolved event already carries the acting process, so one event type answers the same question: a script host resolved a Cloudflare Pages, R2 or CloudFront name.
// REQUIRES: SentinelOne DNS Resolved telemetry with the acting process
// TUNING: Legacy HTA apps hosted on CloudFront are the only realistic source; exclude by full host name after review.
// LOOKBACK: 30d; set the console time range to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A script host whose lookup the agent attributes to a different process (for example a DNS-client service) is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved'
src.process.name in:anycase ('mshta.exe','wscript.exe','cscript.exe')
event.dns.request matches '\\.(pages\\.dev|r2\\.dev|cloudfront\\.net)$'
| columns event.time, endpoint.name, src.process.user, src.process.name, src.process.cmdline, src.process.parent.name, event.dns.request, agent.uuid
| limit 200

// HUNT: DNS lookups for published Antino infrastructure
// MITRE: T1566.002, T1583.006, T1105
// CONF: high  FP: low  COST: low
// REQUIRES: DNS requests (DnsRequest)
// FALSE POSITIVES: security researchers and sandbox hosts resolving the domains
// LOOKBACK: 90d (set in the time picker)
// NOTE: d32tpl7xt7175h.cloudfront.net is deliberately absent. Talos reports it shared with a different cluster (UNC6384).
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(osc-cdn\.com|microsoft-flash\.com|wps-cn\.com|d2nq35tel3ucuo\.cloudfront\.net|oisadjfoinsiduhfnoisdnfosdnoifnsoid\.pages\.dev|pub-(abfa7742e315485a98a5fafd6dbfb68e|0173d1566dcd4fd49fa25f11f14bfe4c)\.r2\.dev|my-(3lyt6wcp|qc39r814|662ylt3w|6g16qsfe|goq6xmbm|h3qli6kq|sv7c1fzs|u0up9qri|vtsdod2n|wgoxp32b)\.pages\.dev)$/i
| groupBy([aid, ComputerName, DomainName], function=[count(as=Lookups), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=1000)

event.type = 'DNS Resolved' endpoint.name = * event.dns.request = *
| limit 5
| columns event.type, event.time, endpoint.name, event.dns.request

// HUNT: DNS lookups for published Antino infrastructure
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1566.002, T1583.006, T1105
// CONF: high | FP: low
// FALSE POSITIVES: security researchers and sandbox hosts resolving the domains
// EQUIVALENCE: equivalent-with-schema-assumptions - Same anchored domain regex over every published Antino delivery and staging name, grouped by host and name. The CQL deliberately omits the CloudFront host shared with a different cluster and so does this query.
// REQUIRES: SentinelOne DNS Resolved telemetry
// TUNING: Security researchers and sandbox hosts resolving these names are the only expected source.
// LOOKBACK: 90d; set the console time range to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: Name resolution performed by a resolver the agent does not instrument is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved'
event.dns.request matches '(^|\\.)(osc-cdn\\.com|microsoft-flash\\.com|wps-cn\\.com|d2nq35tel3ucuo\\.cloudfront\\.net|oisadjfoinsiduhfnoisdnfosdnoifnsoid\\.pages\\.dev|pub-(abfa7742e315485a98a5fafd6dbfb68e|0173d1566dcd4fd49fa25f11f14bfe4c)\\.r2\\.dev|my-(3lyt6wcp|qc39r814|662ylt3w|6g16qsfe|goq6xmbm|h3qli6kq|sv7c1fzs|u0up9qri|vtsdod2n|wgoxp32b)\\.pages\\.dev)$'
| group lookups = count(), host = any(endpoint.name), process = any(src.process.name) by agent.uuid, event.dns.request
| sort -lookups
| limit 200

// HUNT: GatherOsState.exe running from a non-ADK path (signed-binary sideload host)
// MITRE: T1574.002, T1036.005
// CONF: high  FP: medium  COST: low
// REQUIRES: process creation with image path (ProcessRollup2)
// FALSE POSITIVES: Windows feature upgrades stage GatherOsState.exe under the $WINDOWS.~BT folder; ADK installs under Windows Kits
// TUNING: add | ImageFileName!=/\\\$WINDOWS\.~BT\\/i after confirming the path on your own upgrade telemetry; do NOT allowlist by FileName or signature alone, the sideload host is the genuine signed binary
// LOOKBACK: 90d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^GatherOsState\.exe$/i
| ImageFileName!=/\\Windows Kits\\/i
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])

event.type = 'Process Creation' endpoint.name = * tgt.process.name = * tgt.process.image.path = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.process.name, tgt.process.image.path

// HUNT: GatherOsState.exe running from a non-ADK path (signed-binary sideload host)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002, T1036.005
// CONF: high | FP: medium
// FALSE POSITIVES: Windows feature upgrades stage GatherOsState.exe under the $WINDOWS.~BT folder; ADK installs under Windows Kits
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: GatherOsState.exe running from any image path that is not under Windows Kits. Lineage re-mapped for SentinelOne.
// REQUIRES: SentinelOne Process Creation telemetry with image paths
// TUNING: Add an exclusion for the $WINDOWS.~BT upgrade staging path only after confirming it on your own upgrade telemetry. Do not allowlist by name or signature alone: the sideload host is the genuine signed binary.
// LOOKBACK: 90d; set the console time range to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A sideload host renamed to another file name is not captured; the hash and DLL hunts cover that.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name in:anycase ('GatherOsState.exe')
tgt.process.image.path = *
!(tgt.process.image.path matches '\\\\Windows Kits\\\\')
| columns event.time, endpoint.name, src.process.user, tgt.process.image.path, tgt.process.cmdline, src.process.name, tgt.process.image.sha256, agent.uuid
| limit 200

// HUNT: slc.dll PE dropped in a user-writable directory
// MITRE: T1574.002, T1105
// CONF: medium  FP: low  COST: low
// REQUIRES: PE file write events (PeFileWritten, NewExecutableWritten)
// FALSE POSITIVES: software-licensing test tooling; servicing writes go to System32/WinSxS and are excluded by the path filter
// LOOKBACK: 90d (set in the time picker)
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| FileName=/^slc(\.dll(\.[a-z]{3})?)?$/i
| TargetFileName=/\\(Users|ProgramData)\\|\\Windows\\Temp\\/i
| table([@timestamp, ComputerName, UserName, FileName, TargetFileName, ContextBaseFileName, SHA256HashData])

event.type = 'File Creation' endpoint.name = * tgt.file.path = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.file.path

// HUNT: slc.dll PE dropped in a user-writable directory
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002, T1105
// CONF: medium | FP: low
// FALSE POSITIVES: software-licensing test tooling; servicing writes go to System32/WinSxS and are excluded by the path filter
// EQUIVALENCE: approximate-analytic - Same file-name and path predicates over File Creation events. The CQL restricts to PE writes ; SentinelOne's File Creation event has no PE-only discriminator, so any file with these names is matched.
// REQUIRES: SentinelOne File Creation telemetry
// TUNING: Software-licensing test tooling is the only expected source; servicing writes under System32 and WinSxS are outside the path filter.
// LOOKBACK: 90d; set the console time range to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A file that is not a PE but carries the same name also matches. A drop made by a process the agent did not observe is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'File Creation'
tgt.file.path matches '\\\\slc(\\.dll(\\.[a-z]{3})?)?$'
tgt.file.path matches '\\\\(Users|ProgramData)\\\\|\\\\Windows\\\\Temp\\\\'
| columns event.time, endpoint.name, src.process.user, tgt.file.path, src.process.name, tgt.file.sha256, agent.uuid
| limit 200

// HUNT: GatherOsState.exe process and slc PE written into the same directory
// MITRE: T1574.002
// CONF: high  FP: low  COST: medium
// REQUIRES: ProcessRollup2 + PeFileWritten/NewExecutableWritten on the same host
// FALSE POSITIVES: ADK or Windows Setup directories that legitimately hold both files (rare)
// LOOKBACK: 30d (set in the time picker; both events must fall inside the window)
// NOTE: a staged-then-restarted sideload outside this window is missed; widen the window for retro-hunts
#event_simpleName=/^(ProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| (#event_simpleName=ProcessRollup2 FileName=/^GatherOsState\.exe$/i) or (#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/ FileName=/^slc(\.dll(\.[a-z]{3})?)?$/i)
| coalesce([ImageFileName, TargetFileName], as=TargetFileName)
| TargetFileName=/^(?<Dir>.+)\\[^\\]+$/
| Dir := lower(Dir)
| groupBy([aid, ComputerName, Dir], function=[count(FileName, distinct=true, as=Distinct), collect([FileName, UserName, SHA256HashData])], limit=1000)
| test(Distinct >= 2)

event.type = 'Process Creation'
| limit 5
| columns event.type

// HUNT: GatherOsState.exe process and slc PE written into the same directory
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002
// CONF: high | FP: low
// FALSE POSITIVES: ADK or Windows Setup directories that legitimately hold both files (rare)
// EQUIVALENCE: unsupported-without-redesign - The CQL correlates a process image directory with a PE-write directory on the same host by extracting the directory with a regex and grouping on it. PowerQuery has no verified directory-extraction function that the offline engine models, and a join on a derived path would be unproven.
// REQUIRES: A same-directory correlation between a process path and a written file path
// TUNING: Use the CQL tab for the co-location test; the PowerQuery tabs for Q4 and Q5 cover each half separately.
// LOOKBACK: 7d on the CQL tab
// CONFIGURATION: Use the CQL tab for this card.
// KNOWN GAPS: SentinelOne cannot show the same-directory pairing here; Q4 and Q5 hunt the two halves independently.
// VALIDATION LEVEL: static-reviewed

// HUNT: sdiagnhost.exe (Scripted Diagnostics host) spawning script interpreters
// MITRE: T1218, T1202, T1059.001
// CONF: medium  FP: medium  COST: low
// REQUIRES: process creation with parent and command line (ProcessRollup2)
// FALSE POSITIVES: legitimate Windows troubleshooters (msdt-driven) on older builds
// TUNING: baseline 30 days, then exclude CommandLine values pointing at Microsoft diagnostic packages other than PCW; keep any SDIAG_ working directory outside C:\Windows\Temp
// LOOKBACK: 30d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^sdiagnhost\.exe$/i
| FileName=/^(powershell|pwsh|cmd|rundll32|reg|wscript|cscript|mshta)\.exe$/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, ImageFileName])

event.type = 'Process Creation' endpoint.name = * src.process.name = * tgt.process.name = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, tgt.process.name

// HUNT: sdiagnhost.exe (Scripted Diagnostics host) spawning script interpreters
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1218, T1202, T1059.001
// CONF: medium | FP: medium
// FALSE POSITIVES: legitimate Windows troubleshooters (msdt-driven) on older builds
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: sdiagnhost.exe as creator with a script interpreter as the child. Lineage re-mapped for SentinelOne.
// REQUIRES: SentinelOne Process Creation telemetry
// TUNING: Baseline 30 days, then exclude command lines that point at Microsoft diagnostic packages other than PCW by full command line.
// LOOKBACK: 30d; set the console time range to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A child launched by a process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
src.process.name in:anycase ('sdiagnhost.exe')
tgt.process.name in:anycase ('powershell.exe','pwsh.exe','cmd.exe','rundll32.exe','reg.exe','wscript.exe','cscript.exe','mshta.exe')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name, tgt.process.image.path, agent.uuid
| limit 200

// HUNT: Run key value referencing the GatherOSStateKit staging folder
// MITRE: T1547.001
// CONF: high  FP: low  COST: low
// REQUIRES: auto-start registry value updates (AsepValueUpdate, RegGenericValueUpdate)
// FALSE POSITIVES: none expected; the folder name is specific to this malware
// LOOKBACK: 90d (set in the time picker)
#event_simpleName=/^(AsepValueUpdate|RegGenericValueUpdate)$/
| RegObjectName=/\\CurrentVersion\\Run(Once)?/i
| RegStringValue=/GatherOSStateKit|GatherOsState\.exe/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, ContextProcessId])

event.type = 'Registry Value Modified' endpoint.name = * registry.keyPath = * registry.value = *
| limit 5
| columns event.type, event.time, endpoint.name, registry.keyPath, registry.value

// HUNT: Run key value referencing the GatherOSStateKit staging folder
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1547.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected; the folder name is specific to this malware
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a Run or RunOnce value whose data references the GatherOSStateKit folder or GatherOsState.exe.
// REQUIRES: SentinelOne Registry Value Modified telemetry
// TUNING: None expected; the folder name is specific to this malware.
// LOOKBACK: 90d; set the console time range to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A value written through an API the agent does not see as a registry modification is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified'
registry.keyPath matches '\\\\CurrentVersion\\\\Run(Once)?'
registry.value matches 'GatherOSStateKit|GatherOsState\\.exe'
| columns event.time, endpoint.name, src.process.user, registry.keyPath, registry.valueName, registry.value, src.process.name, agent.uuid
| limit 200

// HUNT: Run key value set by a child of sdiagnhost.exe
// MITRE: T1547.001, T1218
// CONF: high  FP: low  COST: medium
// REQUIRES: ProcessRollup2 + AsepValueUpdate with the writing process id
// FALSE POSITIVES: near none; no built-in troubleshooter writes autostart values
// LOOKBACK: 30d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|AsepValueUpdate)$/
| coalesce([ContextProcessId, TargetProcessId], as=falconPID)
| selfJoinFilter(field=[aid, falconPID], where=[
    {#event_simpleName=ProcessRollup2 ParentBaseFileName=/^sdiagnhost\.exe$/i},
    {#event_simpleName=AsepValueUpdate RegObjectName=/\\CurrentVersion\\Run(Once)?/i}
  ])
| groupBy([aid, falconPID], function=[collect([ComputerName, UserName, FileName, CommandLine, RegObjectName, RegValueName, RegStringValue]), min(@timestamp, as=FirstSeen)], limit=1000)

event.type = 'Registry Value Modified' endpoint.name = * src.process.parent.name = * registry.keyPath = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.parent.name, registry.keyPath

// HUNT: Run key value set by a child of sdiagnhost.exe
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1547.001, T1218
// CONF: high | FP: low
// FALSE POSITIVES: near none; no built-in troubleshooter writes autostart values
// EQUIVALENCE: equivalent-with-schema-assumptions - The CQL joins on the writing process id to find a Run write by a child of sdiagnhost.exe; on a registry event the writer is src.process.* and its parent is src.process.parent.*, so one event answers it without a join.
// REQUIRES: SentinelOne Registry Value Modified telemetry with the parent of the acting process
// TUNING: Near none expected; no built-in troubleshooter writes autostart values.
// LOOKBACK: 30d; set the console time range to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A write by a grandchild of sdiagnhost.exe is not captured; only direct children are.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified'
src.process.parent.name in:anycase ('sdiagnhost.exe')
registry.keyPath matches '\\\\CurrentVersion\\\\Run(Once)?'
| columns event.time, endpoint.name, src.process.user, src.process.name, src.process.parent.name, src.process.cmdline, registry.keyPath, registry.valueName, registry.value, agent.uuid
| limit 200

// HUNT: user-writable-path process talking to Microsoft Graph / Entra login without being a known client
// MITRE: T1102.002, T1567.002, T1071.001
// CONF: medium  FP: medium  COST: medium
// REQUIRES: ProcessRollup2 + DnsRequest with initiating process
// FALSE POSITIVES: per-user installs of sync, chat and developer clients
// TUNING: stack by FileName for 14 days, then add benign per-user clients to the FileName exclusion (OneDrive, Teams, Slack, VS Code, Zoom); also exclude your own sanctioned automation by hash
// LOOKBACK: 14d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|DnsRequest)$/
| coalesce([ContextProcessId, TargetProcessId], as=falconPID)
| selfJoinFilter(field=[aid, falconPID], where=[
    {#event_simpleName=ProcessRollup2 ImageFileName=/\\(Users|ProgramData)\\|\\Windows\\Temp\\/i FileName!=/^(chrome|msedge|firefox|brave|onedrive|teams|ms-teams|outlook|olk|slack|code|zoom)\.exe$/i},
    {#event_simpleName=DnsRequest DomainName=/^(graph\.microsoft\.com|login\.microsoftonline\.com)$/i}
  ])
| groupBy([aid, falconPID], function=[collect([ComputerName, UserName, FileName, ImageFileName, ParentBaseFileName, DomainName]), count(as=Events), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=1000)
| sort(Events, order=desc, limit=200)

event.type = 'DNS Resolved' endpoint.name = * src.process.name = * src.process.image.path = * event.dns.request = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, src.process.image.path, event.dns.request

// HUNT: user-writable-path process talking to Microsoft Graph / Entra login without being a known client
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1102.002, T1567.002, T1071.001
// CONF: medium | FP: medium
// FALSE POSITIVES: per-user installs of sync, chat and developer clients
// EQUIVALENCE: equivalent-with-schema-assumptions - The CQL joins process and DNS events on the process id; the DNS Resolved event carries the acting process and its image path, so one event type answers it: a non-allowlisted process under a user-writable path resolved Microsoft Graph or Entra login hosts.
// REQUIRES: SentinelOne DNS Resolved telemetry with the acting process image path
// TUNING: Stack by process name for 14 days, then add benign per-user clients to the name exclusion (OneDrive, Teams, Slack, VS Code, Zoom) and exclude sanctioned automation by hash.
// LOOKBACK: 14d; set the console time range to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A client that proxies its lookups through another process is attributed to that process.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved'
src.process.image.path matches '\\\\(Users|ProgramData)\\\\|\\\\Windows\\\\Temp\\\\'
!(src.process.name in:anycase ('chrome.exe','msedge.exe','firefox.exe','brave.exe','onedrive.exe','teams.exe','ms-teams.exe','outlook.exe','olk.exe','slack.exe','code.exe','zoom.exe'))
event.dns.request in:anycase ('graph.microsoft.com','login.microsoftonline.com')
| group hits = count(), host = any(endpoint.name), user = any(src.process.user), image = any(src.process.image.path), parent = any(src.process.parent.name), domain = any(event.dns.request) by agent.uuid, src.process.name
| sort -hits
| limit 200

// HUNT: GatherOsState.exe contacting Microsoft Graph / Entra login (Antino C2 poll)
// MITRE: T1102.002, T1574.002
// CONF: high  FP: low  COST: medium
// REQUIRES: ProcessRollup2 + DnsRequest with initiating process
// FALSE POSITIVES: none expected from the genuine ADK binary
// LOOKBACK: 30d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|DnsRequest)$/
| coalesce([ContextProcessId, TargetProcessId], as=falconPID)
| selfJoinFilter(field=[aid, falconPID], where=[
    {#event_simpleName=ProcessRollup2 FileName=/^GatherOsState\.exe$/i},
    {#event_simpleName=DnsRequest DomainName=/^(graph\.microsoft\.com|login\.microsoftonline\.com)$/i}
  ])
| groupBy([aid, falconPID], function=[collect([ComputerName, UserName, ImageFileName, CommandLine, DomainName]), count(as=Events), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=1000)

event.type = 'DNS Resolved' endpoint.name = * src.process.name = * event.dns.request = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, event.dns.request

// HUNT: GatherOsState.exe contacting Microsoft Graph / Entra login (Antino C2 poll)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1102.002, T1574.002
// CONF: high | FP: low
// FALSE POSITIVES: none expected from the genuine ADK binary
// EQUIVALENCE: equivalent-with-schema-assumptions - The CQL joins process and DNS events on the process id; the DNS Resolved event carries the acting process, so one event type answers it: GatherOsState.exe resolved Microsoft Graph or Entra login hosts.
// REQUIRES: SentinelOne DNS Resolved telemetry with the acting process
// TUNING: None expected from the genuine ADK binary; investigate every hit.
// LOOKBACK: 30d; set the console time range to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A lookup attributed to a different process is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved'
src.process.name in:anycase ('GatherOsState.exe')
event.dns.request in:anycase ('graph.microsoft.com','login.microsoftonline.com')
| group hits = count(), host = any(endpoint.name), user = any(src.process.user), image = any(src.process.image.path), cmdline = any(src.process.cmdline), domain = any(event.dns.request) by agent.uuid, src.process.name
| sort -hits
| limit 200

// HUNT: published Antino backdoor and TestAssembly.dll SHA-256 sweep
// MITRE: T1574.002, T1204.002
// CONF: high  FP: low  COST: low
// REQUIRES: SHA256HashData on process and PE-write events
// FALSE POSITIVES: none
// LOOKBACK: 90d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| in(SHA256HashData, values=[
    "09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff",
    "0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd",
    "1fadc90b61ce536abda78eb387a7f3d745f00c16775d3f762845ccc0fde567da",
    "40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d",
    "5c5c060b272cd4a5c3767edc0e9478bd35b7e1756e183d0446a5491bd65519cb",
    "971cb2448b5d67dcc1f5eaa10d12e77f213035ad31230dc2ac7a510610a2059d",
    "9b7df409c9a89f7536d3ba7b6d43fb6dbac618c8bb52615ba34cc971ad71bbf3",
    "b90a4e770869c28fd2140acb3ebdc50c113bb6f096b4bbdb9ac87c349c70e85e",
    "ca14ad0344dc7216f6da29a5cbe4237d886cc5257e8c3a48fb4885a311c9b800",
    "e2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530",
    "e7e3b0bcd6798634adf8b49d305f3a7b7682e4b76db549682a183c5a186df4bb",
    "fdbd047031c13a17c9f491c9355f44d587584ebe2b8927be8482e6c236c8e1c1",
    "d753a615aedf8e58ffc75b2b7ebd320c0cbe6bcb5cbb885db749a2a85c55d3bf",
    "133a46ba41136ca21c93fb08c28446826d8c0d9b7923a16f2d152d595a710098",
    "9fc50cf28f86201fda8306926817b1ede41fdd993202515905dd072f6803542f",
    "d4cb2f5df16ec9b9c5b796ae55848534e15d4f8b8806f0431108fc7a99a2548a",
    "131ac3e0df777910e0a32e43d5744bccb0490750d4c2adc359da41d76d383c46"
  ])
| table([@timestamp, ComputerName, UserName, FileName, TargetFileName, ImageFileName, SHA256HashData])

event.type = 'Process Creation' endpoint.name = * tgt.process.image.sha256 = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.process.image.sha256

// HUNT: published Antino backdoor and TestAssembly.dll SHA-256 sweep
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002, T1204.002
// CONF: high | FP: low
// FALSE POSITIVES: none
// EQUIVALENCE: equivalent-with-schema-assumptions - Same 17-hash SHA-256 sweep over created process images and, as the PE-write analogue, created files.
// REQUIRES: SentinelOne Process Creation and File Creation telemetry with SHA-256 populated
// TUNING: None expected; a match is a published indicator.
// LOOKBACK: 90d; set the console time range to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: Hashes are only seen when the agent populates SHA-256 for the event; a file that is never created or executed during the window is not captured.
// VALIDATION LEVEL: static-reviewed
(event.type = 'Process Creation' tgt.process.image.sha256 in ('09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff','0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd','1fadc90b61ce536abda78eb387a7f3d745f00c16775d3f762845ccc0fde567da','40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d','5c5c060b272cd4a5c3767edc0e9478bd35b7e1756e183d0446a5491bd65519cb','971cb2448b5d67dcc1f5eaa10d12e77f213035ad31230dc2ac7a510610a2059d','9b7df409c9a89f7536d3ba7b6d43fb6dbac618c8bb52615ba34cc971ad71bbf3','b90a4e770869c28fd2140acb3ebdc50c113bb6f096b4bbdb9ac87c349c70e85e','ca14ad0344dc7216f6da29a5cbe4237d886cc5257e8c3a48fb4885a311c9b800','e2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530','e7e3b0bcd6798634adf8b49d305f3a7b7682e4b76db549682a183c5a186df4bb','fdbd047031c13a17c9f491c9355f44d587584ebe2b8927be8482e6c236c8e1c1','d753a615aedf8e58ffc75b2b7ebd320c0cbe6bcb5cbb885db749a2a85c55d3bf','133a46ba41136ca21c93fb08c28446826d8c0d9b7923a16f2d152d595a710098','9fc50cf28f86201fda8306926817b1ede41fdd993202515905dd072f6803542f','d4cb2f5df16ec9b9c5b796ae55848534e15d4f8b8806f0431108fc7a99a2548a','131ac3e0df777910e0a32e43d5744bccb0490750d4c2adc359da41d76d383c46')) or (event.type = 'File Creation' tgt.file.sha256 in ('09ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff','0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd','1fadc90b61ce536abda78eb387a7f3d745f00c16775d3f762845ccc0fde567da','40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d','5c5c060b272cd4a5c3767edc0e9478bd35b7e1756e183d0446a5491bd65519cb','971cb2448b5d67dcc1f5eaa10d12e77f213035ad31230dc2ac7a510610a2059d','9b7df409c9a89f7536d3ba7b6d43fb6dbac618c8bb52615ba34cc971ad71bbf3','b90a4e770869c28fd2140acb3ebdc50c113bb6f096b4bbdb9ac87c349c70e85e','ca14ad0344dc7216f6da29a5cbe4237d886cc5257e8c3a48fb4885a311c9b800','e2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530','e7e3b0bcd6798634adf8b49d305f3a7b7682e4b76db549682a183c5a186df4bb','fdbd047031c13a17c9f491c9355f44d587584ebe2b8927be8482e6c236c8e1c1','d753a615aedf8e58ffc75b2b7ebd320c0cbe6bcb5cbb885db749a2a85c55d3bf','133a46ba41136ca21c93fb08c28446826d8c0d9b7923a16f2d152d595a710098','9fc50cf28f86201fda8306926817b1ede41fdd993202515905dd072f6803542f','d4cb2f5df16ec9b9c5b796ae55848534e15d4f8b8806f0431108fc7a99a2548a','131ac3e0df777910e0a32e43d5744bccb0490750d4c2adc359da41d76d383c46'))
| columns event.type, event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.sha256, tgt.file.path, tgt.file.sha256, src.process.name, agent.uuid
| limit 200

// HUNT: filenames from the Antino standalone-installer and sideload bundle
// MITRE: T1204.002, T1036
// CONF: medium  FP: low  COST: low
// REQUIRES: process creation and PE write events
// FALSE POSITIVES: low; generic names such as OsState.dat could in theory collide with unrelated software
// LOOKBACK: 90d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| FileName=/^(flashcenter_pp_ax_install_en\.exe|OsGather\.dat|OsState\.dat)$/i
| table([@timestamp, ComputerName, UserName, FileName, TargetFileName, ImageFileName, SHA256HashData, ParentBaseFileName])

event.type = 'Process Creation' endpoint.name = * tgt.process.name = * tgt.file.path = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.process.name, tgt.file.path

// HUNT: filenames from the Antino standalone-installer and sideload bundle
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.002, T1036
// CONF: medium | FP: low
// FALSE POSITIVES: low; generic names such as OsState.dat could in theory collide with unrelated software
// EQUIVALENCE: equivalent-with-schema-assumptions - Same filename test: the fake-installer executable as a process name, and the installer or the two .dat staging names as a created file path.
// REQUIRES: SentinelOne Process Creation and File Creation telemetry
// TUNING: Generic names such as OsState.dat could collide with unrelated software; exclude by full path after review.
// LOOKBACK: 90d; set the console time range to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A renamed copy of any of these files is not captured; the hash hunt covers published samples.
// VALIDATION LEVEL: static-reviewed
(event.type = 'Process Creation' tgt.process.name in:anycase ('flashcenter_pp_ax_install_en.exe')) or (event.type = 'File Creation' tgt.file.path matches '\\\\(flashcenter_pp_ax_install_en\\.exe|OsGather\\.dat|OsState\\.dat)$')
| columns event.type, event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, tgt.file.path, tgt.file.sha256, src.process.name, agent.uuid
| limit 200