Armorsteal: SEO-Poisoned Chocolatey and Massgrave Installers

// HUNT: Armorsteal lure and C2 domain resolution
// MITRE: T1608.006, T1204.004, T1071.001, T1008
// CONF: high  FP: low  COST: low
// REQUIRES: DNS lookups with the requesting host (endpoint DNS telemetry)
// FALSE POSITIVES: researchers or sandboxes resolving the published domains
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(choclatey\.org|massgravel\.net|workerstats\.net|datamons\.org|supertrap\.net|niceer\.net|pymons\.is)$/i
| groupBy([ComputerName, aid, DomainName], function=[count(as=lookups), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)])
| table([ComputerName, aid, DomainName, lookups, firstSeen, lastSeen])

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.type, event.dns.request, endpoint.name, event.time

// HUNT: Armorsteal lure and C2 domain resolution
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1608.006, T1204.004, T1071.001, T1008
// CONF: high | FP: low
// FALSE POSITIVES: researchers or sandboxes resolving the published domains
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: an exact match on the seven published domains or any subdomain of them, grouped per host and domain with a lookup count and first and last seen. in:anycase and the default case-insensitive matches reproduce the case-insensitive intent.
// REQUIRES: SentinelOne DNS telemetry (DNS Resolved events) with the requested name populated
// TUNING: Exclude sandbox and research hosts by endpoint name after a baseline review.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: DNS resolved by a process the sensor did not observe is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' (event.dns.request in:anycase ('choclatey.org', 'massgravel.net', 'workerstats.net', 'datamons.org', 'supertrap.net', 'niceer.net', 'pymons.is') or event.dns.request matches '^.*\\.(choclatey\\.org|massgravel\\.net|workerstats\\.net|datamons\\.org|supertrap\\.net|niceer\\.net|pymons\\.is)$')
| group lookups=count(), first_seen=min(event.time), last_seen=max(event.time) by agent.uuid, endpoint.name, event.dns.request
| sort -last_seen
| limit 1000

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: Armorsteal lure and C2 domain resolution
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1608.006, T1204.004, T1071.001, T1008
// CONF: high | FP: low
// FALSE POSITIVES: researchers or sandboxes resolving the published domains
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate on DnsQueryResponse events: an exact match on the seven published domains or any subdomain, grouped per host and name. The name is read from AdditionalFields because Defender has no endpoint DNS table.
// REQUIRES: Defender for Endpoint DNS telemetry (DeviceEvents DnsQueryResponse)
// TUNING: Exclude sandbox and research hosts by DeviceName after a baseline review.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers the CQL window)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days; the CQL tab covers the CQL window. DNS answered from a cache the sensor did not observe is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where DnsName in~ ("choclatey.org", "massgravel.net", "workerstats.net", "datamons.org", "supertrap.net", "niceer.net", "pymons.is") or DnsName matches regex @"(?i)\.(choclatey\.org|massgravel\.net|workerstats\.net|datamons\.org|supertrap\.net|niceer\.net|pymons\.is)$"
| summarize Lookups = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName, DnsName
| sort by LastSeen desc
| take 1000

// HUNT: Armorsteal payload host and C2 IP connections
// MITRE: T1105, T1071.001
// CONF: medium  FP: low  COST: low
// REQUIRES: outbound network connections with the initiating process
// FALSE POSITIVES: unrelated tenants later assigned the same hosting IPs
#event_simpleName=NetworkConnectIP4
| in(field=RemoteAddressIP4, values=["82.153.135.80","209.99.186.187","186.2.175.183","186.2.163.185","190.115.31.69"])
| table([@timestamp, ComputerName, aid, ContextBaseFileName, RemoteAddressIP4, RemotePort, LocalAddressIP4])

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.type, dst.ip.address, src.process.name, dst.port.number

// HUNT: Armorsteal payload host and C2 IP connections
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1105, T1071.001
// CONF: medium | FP: low
// FALSE POSITIVES: unrelated tenants later assigned the same hosting IPs
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an outbound IP connection to one of the five published payload or C2 addresses. The initiating process on a non-creation event is src.process.*.
// REQUIRES: SentinelOne network telemetry (IP Connect events)
// TUNING: Hosting addresses can be reassigned; review the age of a hit against the advisory date before escalating.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connections made before the sensor started, or from an unmonitored host, are not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' dst.ip.address in ('82.153.135.80', '209.99.186.187', '186.2.175.183', '186.2.163.185', '190.115.31.69')
| columns event.time, endpoint.name, src.process.name, dst.ip.address, dst.port.number, src.ip.address
| sort -event.time
| limit 1000

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, RemoteIP, InitiatingProcessFileName, RemotePort
| take 5

// HUNT: Armorsteal payload host and C2 IP connections
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1105, T1071.001
// CONF: medium | FP: low
// FALSE POSITIVES: unrelated tenants later assigned the same hosting IPs
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a network event whose remote address is one of the five published payload or C2 addresses. The initiating process is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Hosting addresses can be reassigned; review the age of a hit against the advisory date before escalating.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers the CQL window)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days; the CQL tab covers the CQL window.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemoteIP in ("82.153.135.80", "209.99.186.187", "186.2.175.183", "186.2.163.185", "190.115.31.69")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, LocalIP
| sort by Timestamp desc
| take 1000

// HUNT: Armorsteal known file hashes
// MITRE: T1059.001, T1059.006, T1105
// CONF: high  FP: low  COST: low
// REQUIRES: file and process events carrying SHA256HashData
// FALSE POSITIVES: none expected for these exact hashes
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten|ZipFileWritten)$/
| in(field=SHA256HashData, values=[
    "f3846ec2a6ff0a27d9ef2b9bf7908743b81d295ef29344acfb96ff83fff994f9",
    "fb1181160e9f10ce1eb5e5dc9bc23e1498a39110ee9ea361fd150454cb01b292",
    "3e3b62a9836697d978cbb620dc8af8f6eefdf8cb73fc30d16bb394d1c58f4c97",
    "237ba698d7dc8936c43e0e78e7644002375e51e8baf9b3a7d4e18683f871ee31",
    "be0329d0795dd62ae587faf97e704bb36413e5c98ddd8fe575f5077db3c84e5f",
    "04d2828155ed2a276cfd3c97d4f966d328391dd818e04e773212cd601e49fa74",
    "56f05c4fb1c25c04e0dde60e2e5e41ac164a6dc53688d0f9eb52a55f82106389",
    "0ea99fbbe29af6f797e3866ed5f822c7a5d3e9cdb990a8c382a715069f156499",
    "8fb7aaf2b9270b8b75f6844aaefd5242b4f926fb89cba10fff3d9b908a769788",
    "5410c2f239c3649928383c4478dea182f90b21f5b258081fec07e9d297ae4b1c"])
| table([@timestamp, ComputerName, aid, #event_simpleName, FileName, TargetFileName, SHA256HashData])

tgt.file.sha256 = *
| limit 5
| columns event.type, tgt.process.image.sha256, tgt.file.sha256, tgt.file.path

// HUNT: Armorsteal known file hashes
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.001, T1059.006, T1105
// CONF: high | FP: low
// FALSE POSITIVES: none expected for these exact hashes
// EQUIVALENCE: approximate-analytic - Same ten SHA256 values, matched against the process image hash and the file hash on every event that carries them. The source limits itself to a few write and launch event types; SentinelOne has no per-event-type split here, so the match runs on any event with those hash fields.
// REQUIRES: SentinelOne process and file telemetry with SHA256 hashes populated
// TUNING: None expected for these exact hashes; treat any hit as confirmed until proven otherwise.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An event that carries neither hash field is not matched, and the hash of a process that is not the created or written object is not checked.
// VALIDATION LEVEL: static-reviewed
(tgt.process.image.sha256 in:anycase ('f3846ec2a6ff0a27d9ef2b9bf7908743b81d295ef29344acfb96ff83fff994f9', 'fb1181160e9f10ce1eb5e5dc9bc23e1498a39110ee9ea361fd150454cb01b292', '3e3b62a9836697d978cbb620dc8af8f6eefdf8cb73fc30d16bb394d1c58f4c97', '237ba698d7dc8936c43e0e78e7644002375e51e8baf9b3a7d4e18683f871ee31', 'be0329d0795dd62ae587faf97e704bb36413e5c98ddd8fe575f5077db3c84e5f', '04d2828155ed2a276cfd3c97d4f966d328391dd818e04e773212cd601e49fa74', '56f05c4fb1c25c04e0dde60e2e5e41ac164a6dc53688d0f9eb52a55f82106389', '0ea99fbbe29af6f797e3866ed5f822c7a5d3e9cdb990a8c382a715069f156499', '8fb7aaf2b9270b8b75f6844aaefd5242b4f926fb89cba10fff3d9b908a769788', '5410c2f239c3649928383c4478dea182f90b21f5b258081fec07e9d297ae4b1c') or tgt.file.sha256 in:anycase ('f3846ec2a6ff0a27d9ef2b9bf7908743b81d295ef29344acfb96ff83fff994f9', 'fb1181160e9f10ce1eb5e5dc9bc23e1498a39110ee9ea361fd150454cb01b292', '3e3b62a9836697d978cbb620dc8af8f6eefdf8cb73fc30d16bb394d1c58f4c97', '237ba698d7dc8936c43e0e78e7644002375e51e8baf9b3a7d4e18683f871ee31', 'be0329d0795dd62ae587faf97e704bb36413e5c98ddd8fe575f5077db3c84e5f', '04d2828155ed2a276cfd3c97d4f966d328391dd818e04e773212cd601e49fa74', '56f05c4fb1c25c04e0dde60e2e5e41ac164a6dc53688d0f9eb52a55f82106389', '0ea99fbbe29af6f797e3866ed5f822c7a5d3e9cdb990a8c382a715069f156499', '8fb7aaf2b9270b8b75f6844aaefd5242b4f926fb89cba10fff3d9b908a769788', '5410c2f239c3649928383c4478dea182f90b21f5b258081fec07e9d297ae4b1c'))
| columns event.time, event.type, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.sha256, tgt.file.path, tgt.file.sha256
| sort -event.time
| limit 1000

DeviceFileEvents
| where Timestamp > ago(1d)
| where isnotempty(SHA256)
| project Timestamp, SHA256, FileName, FolderPath
| take 5

// HUNT: Armorsteal known file hashes
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.001, T1059.006, T1105
// CONF: high | FP: low
// FALSE POSITIVES: none expected for these exact hashes
// EQUIVALENCE: telemetry-gap - Partial pivot: the ten SHA256 values matched against file events only. The launch-side half of the source, matching hashes of started processes, is not expressible in the same table, and SHA256 is often unpopulated in Advanced Hunting.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents) with SHA256 populated
// TUNING: None expected for these exact hashes; treat any hit as confirmed until proven otherwise.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers the CQL window)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Started processes with these hashes are not matched here; DeviceProcessEvents would be needed. SHA256 is often unpopulated, and the source offers no SHA1 to pivot on, so an empty result is not proof of absence. Advanced Hunting keeps 30 days; the CQL tab covers the CQL window.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where SHA256 in~ ("f3846ec2a6ff0a27d9ef2b9bf7908743b81d295ef29344acfb96ff83fff994f9", "fb1181160e9f10ce1eb5e5dc9bc23e1498a39110ee9ea361fd150454cb01b292", "3e3b62a9836697d978cbb620dc8af8f6eefdf8cb73fc30d16bb394d1c58f4c97", "237ba698d7dc8936c43e0e78e7644002375e51e8baf9b3a7d4e18683f871ee31", "be0329d0795dd62ae587faf97e704bb36413e5c98ddd8fe575f5077db3c84e5f", "04d2828155ed2a276cfd3c97d4f966d328391dd818e04e773212cd601e49fa74", "56f05c4fb1c25c04e0dde60e2e5e41ac164a6dc53688d0f9eb52a55f82106389", "0ea99fbbe29af6f797e3866ed5f822c7a5d3e9cdb990a8c382a715069f156499", "8fb7aaf2b9270b8b75f6844aaefd5242b4f926fb89cba10fff3d9b908a769788", "5410c2f239c3649928383c4478dea182f90b21f5b258081fec07e9d297ae4b1c")
| project Timestamp, ReportId, DeviceId, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName
| sort by Timestamp desc
| take 1000

// HUNT: Armorsteal scheduled task persistence (registration event)
// MITRE: T1053.005, T1036.005
// CONF: high  FP: low  COST: low
// REQUIRES: scheduled task registration telemetry
// FALSE POSITIVES: an unrelated product that happens to use the same task names (none known)
// VALIDATE: confirm TaskName is populated on ScheduledTaskRegistered in your tenant; Q5 covers the same behavior
#event_simpleName=ScheduledTaskRegistered
| TaskName=/(^|\\)SysCheck(2|X)$/i
| table([@timestamp, ComputerName, aid, UserName, TaskName])

event.type = 'Registry Value Modified' registry.keyPath contains 'TaskCache'
| limit 5
| columns event.type, registry.keyPath, src.process.name, registry.valueName

// HUNT: Armorsteal scheduled task persistence (registration event)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1053.005, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: an unrelated product that happens to use the same task names (none known)
// EQUIVALENCE: approximate-analytic - SentinelOne has no attested scheduled-task registration field here, so the same behaviour is hunted through the registry write that registering a task leaves under the Task Scheduler cache: a key path ending in the task name SysCheck2 or SysCheckX.
// REQUIRES: SentinelOne registry telemetry (Registry Value Modified events) covering the Task Scheduler cache
// TUNING: The source command-line hunt (Q5) covers the same behaviour; use it to corroborate.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: This is a registry-side approximation, not the scheduled-task registration event itself. A task created while registry telemetry is suppressed is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified' registry.keyPath matches '\\\\TaskCache\\\\Tree\\\\SysCheck(2|X)(\\\\|$)'
| columns event.time, endpoint.name, src.process.user, src.process.name, registry.keyPath, registry.valueName
| sort -event.time
| limit 1000

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "ScheduledTaskCreated"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: Armorsteal scheduled task persistence (registration event)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1053.005, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: an unrelated product that happens to use the same task names (none known)
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on task-creation events: the task name ends in SysCheck2 or SysCheckX, anchored at the start or after a backslash. The name is read from AdditionalFields.
// REQUIRES: Defender for Endpoint scheduled-task telemetry (DeviceEvents ScheduledTaskCreated)
// TUNING: The command-line hunt (Q5) covers the same behaviour; use it to corroborate.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A task registered where the sensor does not raise a creation event is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "ScheduledTaskCreated"
| extend TaskName = tostring(parse_json(AdditionalFields)["TaskName"])
| where TaskName matches regex @"(?i)(^|\\)SysCheck(2|X)$"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, TaskName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Armorsteal persistence via command line
// MITRE: T1053.005
// CONF: high  FP: low  COST: low
// REQUIRES: process creation with command line
// FALSE POSITIVES: administrators removing or querying the tasks during response
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(schtasks|powershell|pwsh|cmd)(\.exe)?$/i
| CommandLine=/SysCheck(2|X)\b/i
| table([@timestamp, ComputerName, aid, UserName, FileName, CommandLine, ParentBaseFileName])

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.type, tgt.process.name, tgt.process.cmdline, src.process.name

// HUNT: Armorsteal persistence via command line
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1053.005
// CONF: high | FP: low
// FALSE POSITIVES: administrators removing or querying the tasks during response
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the created process is schtasks, PowerShell, pwsh or cmd and its command line names SysCheck2 or SysCheckX at a word boundary. in:anycase and the default case-insensitive matches reproduce the case-insensitive intent.
// REQUIRES: SentinelOne process-creation telemetry with command lines
// TUNING: Expect administrators removing or querying the tasks during response; exclude the response account after review.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A task created through the Task Scheduler API without a command line is not captured; the registry hunt covers that.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('schtasks.exe', 'powershell.exe', 'pwsh.exe', 'cmd.exe') tgt.process.cmdline matches 'SysCheck(2|X)\\b'
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name
| sort -event.time
| limit 1000

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine, InitiatingProcessFileName
| take 5

// HUNT: Armorsteal persistence via command line
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1053.005
// CONF: high | FP: low
// FALSE POSITIVES: administrators removing or querying the tasks during response
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the created process is schtasks, PowerShell, pwsh or cmd and its command line names SysCheck2 or SysCheckX at a word boundary. The creator is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Expect administrators removing or querying the tasks during response; exclude the response account after review.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A task created through the Task Scheduler API without a command line is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ("schtasks.exe", "powershell.exe", "pwsh.exe", "cmd.exe")
| where ProcessCommandLine matches regex @"(?i)SysCheck(2|X)\b"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: Armorsteal runtime executing from fake SystemHealth directory
// MITRE: T1036.005, T1059.006, T1053.005
// CONF: high  FP: low  COST: low
// REQUIRES: process creation with image path and command line
// FALSE POSITIVES: none known; the directory is not a standard Windows path
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| (ImageFileName=/\\Windows\\SystemHealth\\Update\\/i or CommandLine=/\\Windows\\SystemHealth\\Update\\/i)
| table([@timestamp, ComputerName, aid, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])

event.type = 'Process Creation' tgt.process.image.path = *
| limit 5
| columns event.type, tgt.process.image.path, tgt.process.cmdline

// HUNT: Armorsteal runtime executing from fake SystemHealth directory
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1036.005, T1059.006, T1053.005
// CONF: high | FP: low
// FALSE POSITIVES: none known; the directory is not a standard Windows path
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the created process image path or its command line contains the fake SystemHealth Update directory. contains is case-insensitive, which reproduces the CQL /i intent. The creator is src.process.name.
// REQUIRES: SentinelOne process-creation telemetry with image path and command line
// TUNING: None known; the directory is not a standard Windows path.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' (tgt.process.image.path contains '\\Windows\\SystemHealth\\Update\\' or tgt.process.cmdline contains '\\Windows\\SystemHealth\\Update\\')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, src.process.name, tgt.process.image.sha256
| sort -event.time
| limit 1000

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FolderPath, ProcessCommandLine
| take 5

// HUNT: Armorsteal runtime executing from fake SystemHealth directory
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1036.005, T1059.006, T1053.005
// CONF: high | FP: low
// FALSE POSITIVES: none known; the directory is not a standard Windows path
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the created process folder path or its command line contains the fake SystemHealth Update directory. contains is case-insensitive, which reproduces the CQL /i intent. The creator is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None known; the directory is not a standard Windows path.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FolderPath contains "\\Windows\\SystemHealth\\Update\\" or ProcessCommandLine contains "\\Windows\\SystemHealth\\Update\\"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Armorsteal payload staging in fake SystemHealth directory
// MITRE: T1036.005, T1105
// CONF: high  FP: low  COST: low
// REQUIRES: file write telemetry for executables and archives
// FALSE POSITIVES: none known
#event_simpleName=/^(PeFileWritten|NewExecutableWritten|ZipFileWritten)$/
| TargetFileName=/\\Windows\\SystemHealth\\Update\\/i
| table([@timestamp, ComputerName, aid, ContextBaseFileName, TargetFileName, SHA256HashData])

event.type = 'File Creation' tgt.file.path = *
| limit 5
| columns event.type, tgt.file.path, src.process.name

// HUNT: Armorsteal payload staging in fake SystemHealth directory
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1036.005, T1105
// CONF: high | FP: low
// FALSE POSITIVES: none known
// EQUIVALENCE: approximate-analytic - Same staging directory, but the source limits itself to executable and archive write events and SentinelOne has no attested file-type event split, so this query reports every file created or modified under the directory. The writer is src.process.name.
// REQUIRES: SentinelOne file telemetry (File Creation and File Modification events)
// TUNING: None known; the directory is not a standard Windows path. Add an extension filter if non-executable writes are noisy.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Non-executable and non-archive writes are included, so a hit needs a glance at the file type.
// VALIDATION LEVEL: static-reviewed
event.type in ('File Creation', 'File Modification') tgt.file.path contains '\\Windows\\SystemHealth\\Update\\'
| columns event.time, event.type, endpoint.name, src.process.name, tgt.file.path, tgt.file.sha256
| sort -event.time
| limit 1000

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, FolderPath, FileName
| take 5

// HUNT: Armorsteal payload staging in fake SystemHealth directory
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1036.005, T1105
// CONF: high | FP: low
// FALSE POSITIVES: none known
// EQUIVALENCE: approximate-analytic - Same staging directory, but the source limits itself to executable and archive write events and Defender reports every created or modified file, so this query reports all of them under the directory. The writer is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: None known; the directory is not a standard Windows path. Add an extension filter if non-executable writes are noisy.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Non-executable and non-archive writes are included, so a hit needs a glance at the file type.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(7d)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath contains "\\Windows\\SystemHealth\\Update"
| project Timestamp, ReportId, DeviceId, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessFileName, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Armorsteal lure one-liner (domain or host in command line)
// MITRE: T1204.004, T1059.001, T1105
// CONF: high  FP: low  COST: low
// REQUIRES: process creation with command line
// FALSE POSITIVES: analysts testing the published domains
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(choclatey\.org|massgravel\.net|workerstats\.net|datamons\.org|supertrap\.net|niceer\.net|pymons\.is|82\.153\.135\.80|209\.99\.186\.187)/i
| table([@timestamp, ComputerName, aid, UserName, FileName, CommandLine, ParentBaseFileName])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.type, tgt.process.cmdline, tgt.process.name

// HUNT: Armorsteal lure one-liner (domain or host in command line)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.004, T1059.001, T1105
// CONF: high | FP: low
// FALSE POSITIVES: analysts testing the published domains
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the created process command line contains one of the seven published domains or two payload addresses. contains is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation telemetry with command lines
// TUNING: Analysts testing the published domains will hit; exclude their hosts after review.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The two addresses match as plain substrings, so a longer address that ends in the same digits also matches.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.cmdline contains ('choclatey.org', 'massgravel.net', 'workerstats.net', 'datamons.org', 'supertrap.net', 'niceer.net', 'pymons.is', '82.153.135.80', '209.99.186.187')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name
| sort -event.time
| limit 1000

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine, FileName
| take 5

// HUNT: Armorsteal lure one-liner (domain or host in command line)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.004, T1059.001, T1105
// CONF: high | FP: low
// FALSE POSITIVES: analysts testing the published domains
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the created process command line contains one of the seven published domains or two payload addresses. contains is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Analysts testing the published domains will hit; exclude their hosts after review.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers the CQL window)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A longer address that ends in the same digits also matches. Advanced Hunting keeps 30 days; the CQL tab covers the CQL window.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine contains "choclatey.org" or ProcessCommandLine contains "massgravel.net" or ProcessCommandLine contains "workerstats.net" or ProcessCommandLine contains "datamons.org" or ProcessCommandLine contains "supertrap.net" or ProcessCommandLine contains "niceer.net" or ProcessCommandLine contains "pymons.is" or ProcessCommandLine contains "82.153.135.80" or ProcessCommandLine contains "209.99.186.187"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: Hidden PowerShell downloading a ZIP or install.ps1 (installer-stage approximation)
// MITRE: T1059.001, T1564.003, T1105
// CONF: low  FP: medium  COST: low
// REQUIRES: process creation with command line
// FALSE POSITIVES: software deployment agents, package managers, legitimate hidden-window installers
// TUNING: exclude known deployment parents and internal download hosts, for example append
// TUNING: | ParentBaseFileName!=/^(ccmexec|intunemanagementextension|ninjarmmagent|ltsvc)(\.exe)?$/i
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(powershell|pwsh)(\.exe)?$/i
| CommandLine=/(-w(indowstyle)?\s+hidden|-win\s+h)/i
| CommandLine=/(invoke-webrequest|invoke-restmethod|downloadfile|downloadstring|start-bitstransfer|\biwr\b|\birm\b)/i
| CommandLine=/(\.zip|install\.ps1)/i
| table([@timestamp, ComputerName, aid, UserName, CommandLine, ParentBaseFileName])

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.type, tgt.process.name, tgt.process.cmdline

// HUNT: Hidden PowerShell downloading a ZIP or install.ps1 (installer-stage approximation)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.001, T1564.003, T1105
// CONF: low | FP: medium
// FALSE POSITIVES: software deployment agents, package managers, legitimate hidden-window installers
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: PowerShell or pwsh with a hidden-window switch, a download cmdlet or alias, and a .zip or install.ps1 reference, each tested as its own condition on the command line. matches is case-insensitive by default, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation telemetry with command lines
// TUNING: Exclude known software-deployment parents and internal download hosts, for example by adding a negated src.process.name list after baseline review.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An installer stage that downloads through another binary, or builds the command line at run time, is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('powershell.exe', 'pwsh.exe') tgt.process.cmdline matches '(-w(indowstyle)?\\s+hidden|-win\\s+h)' tgt.process.cmdline matches '(invoke-webrequest|invoke-restmethod|downloadfile|downloadstring|start-bitstransfer|\\biwr\\b|\\birm\\b)' tgt.process.cmdline matches '(\\.zip|install\\.ps1)'
| columns event.time, endpoint.name, src.process.user, tgt.process.cmdline, src.process.name
| sort -event.time
| limit 1000

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine, InitiatingProcessFileName
| take 5

// HUNT: Hidden PowerShell downloading a ZIP or install.ps1 (installer-stage approximation)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.001, T1564.003, T1105
// CONF: low | FP: medium
// FALSE POSITIVES: software deployment agents, package managers, legitimate hidden-window installers
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: PowerShell or pwsh with a hidden-window switch, a download cmdlet or alias, and a .zip or install.ps1 reference, each tested as its own condition on the command line. The (?i) prefix reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude known software-deployment parents and internal download hosts, for example by adding a negated InitiatingProcessFileName list after baseline review.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An installer stage that downloads through another binary, or builds the command line at run time, is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine matches regex @"(?i)(-w(indowstyle)?\s+hidden|-win\s+h)"
| where ProcessCommandLine matches regex @"(?i)(invoke-webrequest|invoke-restmethod|downloadfile|downloadstring|start-bitstransfer|\biwr\b|\birm\b)"
| where ProcessCommandLine contains ".zip" or ProcessCommandLine contains "install.ps1"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: Browser launched with --remote-debugging-port=9222 (cookie theft via CDP)
// MITRE: T1539, T1555.003
// CONF: medium  FP: medium  COST: low
// REQUIRES: process creation with command line and parent
// FALSE POSITIVES: web developers, test automation, screenshot and PDF tooling
// TUNING: exclude automation parents and developer groups, for example append
// TUNING: | ParentBaseFileName!=/^(node|chromedriver|msedgedriver|code|pwsh)(\.exe)?$/i
// TUNING: prioritise hits whose parent is a python interpreter or runs from a non-standard path
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(chrome|msedge|brave|opera|vivaldi)(\.exe)?$/i
| CommandLine=/--remote-debugging-port=9222/i
| table([@timestamp, ComputerName, aid, UserName, FileName, CommandLine, ParentBaseFileName, ImageFileName])

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.type, tgt.process.name, tgt.process.cmdline, src.process.name

// HUNT: Browser launched with --remote-debugging-port=9222 (cookie theft via CDP)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1539, T1555.003
// CONF: medium | FP: medium
// FALSE POSITIVES: web developers, test automation, screenshot and PDF tooling
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a Chromium-family browser started with the remote debugging port set to 9222. in:anycase and the default case-insensitive contains reproduce the CQL /i intent.
// REQUIRES: SentinelOne process-creation telemetry with command lines
// TUNING: Exclude automation and developer parents after review, and prioritise hits whose creating process is a python interpreter or runs from a non-standard path.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A browser launched under a renamed binary, or with a different debugging port, is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('chrome.exe', 'msedge.exe', 'brave.exe', 'opera.exe', 'vivaldi.exe') tgt.process.cmdline contains '--remote-debugging-port=9222'
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name, tgt.process.image.path
| sort -event.time
| limit 1000

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName
| take 5

// HUNT: Browser launched with --remote-debugging-port=9222 (cookie theft via CDP)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1539, T1555.003
// CONF: medium | FP: medium
// FALSE POSITIVES: web developers, test automation, screenshot and PDF tooling
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a Chromium-family browser started with the remote debugging port set to 9222. in~ and the case-insensitive contains reproduce the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude automation and developer parents after review, and prioritise hits whose creating process is a python interpreter or runs from a non-standard path.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A browser launched under a renamed binary, or with a different debugging port, is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ("chrome.exe", "msedge.exe", "brave.exe", "opera.exe", "vivaldi.exe")
| where ProcessCommandLine contains "--remote-debugging-port=9222"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: Microsoft Defender exclusion added (posture and triage)
// MITRE: T1562.001
// CONF: medium  FP: medium  COST: low
// REQUIRES: process creation with command line, registry value writes
// FALSE POSITIVES: administrators, software deployment, backup and database products adding vendor-documented exclusions
// TUNING: exclude approved exclusion paths and the change-management account, and escalate any exclusion for C:\Windows or a parent of it
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|RegGenericValueUpdate)$/
| (CommandLine=/(Add-MpPreference|Set-MpPreference).*-Exclusion(Path|Process|Extension)/i or RegObjectName=/Windows Defender\\Exclusions\\(Paths|Processes|Extensions)/i)
| table([@timestamp, ComputerName, aid, UserName, CommandLine, RegObjectName, RegValueName])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.type, tgt.process.cmdline, registry.keyPath, registry.valueName

// HUNT: Microsoft Defender exclusion added (posture and triage)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1562.001
// CONF: medium | FP: medium
// FALSE POSITIVES: administrators, software deployment, backup and database products adding vendor-documented exclusions
// EQUIVALENCE: equivalent-with-schema-assumptions - Same two populations: a process whose command line adds a Defender exclusion through Add-MpPreference or Set-MpPreference, and a registry value written under the Defender Exclusions key. matches is case-insensitive by default, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation telemetry with command lines, and registry value telemetry
// TUNING: Exclude approved exclusion paths and the change-management account, and escalate any exclusion for C:\Windows or a parent of it.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An exclusion set through Group Policy, Intune or the Windows Security UI without a matching command line or sensor-visible registry write is not captured.
// VALIDATION LEVEL: static-reviewed
(event.type = 'Process Creation' tgt.process.cmdline matches '(Add-MpPreference|Set-MpPreference).*-Exclusion(Path|Process|Extension)') or (event.type = 'Registry Value Modified' registry.keyPath matches 'Windows Defender\\\\Exclusions\\\\(Paths|Processes|Extensions)')
| columns event.time, event.type, endpoint.name, src.process.user, tgt.process.cmdline, registry.keyPath, registry.valueName
| sort -event.time
| limit 1000

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine, FileName
| take 5

// HUNT: Microsoft Defender exclusion added (posture and triage)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1562.001
// CONF: medium | FP: medium
// FALSE POSITIVES: administrators, software deployment, backup and database products adding vendor-documented exclusions
// EQUIVALENCE: approximate-analytic - Partial pivot on the process half only: a process whose command line adds a Defender exclusion through Add-MpPreference or Set-MpPreference. The registry-write half lives in another table and one query can read only one table.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude approved exclusion paths and the change-management account, and escalate any exclusion for C:\Windows or a parent of it.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The registry-write half of the source, values written under the Defender Exclusions key, is not covered; DeviceRegistryEvents would be needed. An exclusion set through Group Policy, Intune or the Windows Security UI is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine matches regex @"(?i)(Add-MpPreference|Set-MpPreference).*-Exclusion(Path|Process|Extension)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200