Aur0ra Ransomware (GOLD OGRE): AI-Agent-Driven Intrusion Hunt

// HUNT: Operator keyboard-layout typos: зы and ды (ps and ls typed on a Cyrillic layout)
// MITRE: T1059, T1083, T1057
// CONF: high
// FP: low
// COST: low
// REQUIRES: Console command history and process creation with command line (CrowdStrike: CommandHistory, ProcessRollup2)
// FALSE POSITIVES: Russian-speaking admins mistyping in a shell; lab replays of operator logs
// TUNING: exclude known admin jump hosts only after a first review, and keep the hit list: any server hit outside an admin workstation tier is worth a call
#event_simpleName=/^(CommandHistory|ProcessRollup2|SyntheticProcessRollup2)$/
| @rawstring=/(^|[\s;|&"])(зы|ды)(\s|[;|&"]|$)/i
| table([@timestamp, ComputerName, UserName, #event_simpleName, FileName, CommandLine, @rawstring], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.name, src.process.name, tgt.process.cmdline

// HUNT: Operator keyboard-layout typos: зы and ды (ps and ls typed on a Cyrillic layout)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059, T1083, T1057
// CONF: high | FP: low
// FALSE POSITIVES: Russian-speaking admins mistyping in a shell; lab replays of operator logs
// EQUIVALENCE: approximate-analytic - Console command history is not a SentinelOne event type, so the same keyboard-layout token expression runs over the process-creation command line only. Typos typed at an interactive prompt that never launch a process are not seen.
// REQUIRES: SentinelOne process-creation telemetry with the command line
// TUNING: Exclude known admin jump hosts only after a first review, and keep the hit list: any server hit outside an admin workstation tier is worth a call.
// LOOKBACK: 7d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Typed console input that never becomes a process command line (the CQL tab also reads command history) is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and tgt.process.cmdline matches '.*(^|[\\s;|&"])(зы|ды)(\\s|[;|&"]|$).*'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine, InitiatingProcessFileName
| take 5

// HUNT: Operator keyboard-layout typos: зы and ды (ps and ls typed on a Cyrillic layout)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059, T1083, T1057
// CONF: high | FP: low
// FALSE POSITIVES: Russian-speaking admins mistyping in a shell; lab replays of operator logs
// EQUIVALENCE: approximate-analytic - Console command history is not a Defender table, so the same keyboard-layout token expression runs over the process-creation command line only. Typos typed at an interactive prompt that never launch a process are not seen.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude known admin jump hosts only after a first review, and keep the hit list: any server hit outside an admin workstation tier is worth a call.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Typed console input that never becomes a process command line (the CQL tab also reads command history) is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine matches regex @"(?i)(^|[\s;|&\x22])(зы|ды)(\s|[;|&\x22]|$)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Cursor application running on a host (scope to servers, jump boxes, VPN-connected hosts)
// MITRE: T1219, T1059
// CONF: medium
// FP: high
// COST: low
// REQUIRES: Process creation with image path (CrowdStrike: ProcessRollup2)
// FALSE POSITIVES: developers on workstations (expected); approved build or dev servers
// TUNING: scope to server and jump-box host groups; uncomment the ComputerName filter with your server naming regex; exclude approved developer VDI pools
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^cursor(\.exe)?$/i or ImageFileName=/\\programs\\cursor\\/i or ImageFileName=/\\\.cursor\\/i
// | ComputerName=/REPLACE_WITH_SERVER_NAME_REGEX/i
| groupBy([ComputerName], function=[count(as=Launches), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen), collect([UserName])], limit=500)
| sort(FirstSeen, order=asc, limit=200)

event.type = 'Process Creation' tgt.process.image.path = *
| limit 5
| columns event.time, event.type, endpoint.name, tgt.process.name, tgt.process.image.path

// HUNT: Cursor application running on a host (scope to servers, jump boxes, VPN-connected hosts)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1219, T1059
// CONF: medium | FP: high
// FALSE POSITIVES: developers on workstations (expected); approved build or dev servers
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the process name, or either of the two install-path fragments, grouped per host. The user list is reduced to one sample user per host because the language has no collect aggregate.
// REQUIRES: SentinelOne process-creation telemetry with the image path
// TUNING: Scope to server and jump-box host groups with an endpoint.name filter that matches your server naming, and exclude approved developer VDI pools.
// LOOKBACK: 7d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Only one sample user per host is returned; the CQL tab lists every user.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and (tgt.process.name matches '^cursor(\\.exe)?$' or tgt.process.image.path contains ('\\programs\\cursor\\', '\\.cursor\\'))
| group launches=count(), first_seen=min(event.time), last_seen=max(event.time), users=any(src.process.user) by endpoint.name
| sort +first_seen
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceName, FileName, FolderPath
| take 5

// HUNT: Cursor application running on a host (scope to servers, jump boxes, VPN-connected hosts)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1219, T1059
// CONF: medium | FP: high
// FALSE POSITIVES: developers on workstations (expected); approved build or dev servers
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the process name, or either of the two install-path fragments, grouped per host with the users collected into a set.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Scope to server and jump-box device groups with a DeviceName filter that matches your server naming, and exclude approved developer VDI pools.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The set of users is capped at 20 per device.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName matches regex @"(?i)^cursor(\.exe)?$" or FolderPath contains @"\programs\cursor\" or FolderPath contains @"\.cursor\"
| summarize Launches = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Users = make_set(AccountName, 20) by DeviceName
| sort by FirstSeen asc
| take 200

// HUNT: Cursor service lookups from a host
// MITRE: T1219, T1071.001
// CONF: low
// FP: high
// COST: low
// REQUIRES: DNS query telemetry (CrowdStrike: DnsRequest)
// FALSE POSITIVES: any developer using Cursor
// TUNING: restrict to server-tier hosts; suppress host groups approved for AI-assisted development
#event_simpleName=DnsRequest
| DomainName=/(^|\.)cursor\.(sh|com)$/i
// | ComputerName=/REPLACE_WITH_SERVER_NAME_REGEX/i
| groupBy([ComputerName, ContextBaseFileName], function=[count(as=Lookups), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=500)
| sort(Lookups, order=desc, limit=200)

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, event.type, endpoint.name, src.process.name, event.dns.request

// HUNT: Cursor service lookups from a host
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1219, T1071.001
// CONF: low | FP: high
// FALSE POSITIVES: any developer using Cursor
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: a lookup of the vendor service domain or its subdomains, grouped by host and requesting process. The request field is the one the independent backend maps for DNS.
// REQUIRES: SentinelOne DNS telemetry (event type DNS Resolved)
// TUNING: Restrict to server-tier hosts with an endpoint.name filter, and suppress host groups approved for AI-assisted development.
// LOOKBACK: 7d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: If the tenant populates dns.request rather than event.dns.request, this query returns nothing; run the readiness test first.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' and event.dns.request matches '.*(^|\\.)cursor\\.(sh|com)$'
| group lookups=count(), first_seen=min(event.time), last_seen=max(event.time) by endpoint.name, src.process.name
| sort -lookups
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields, DeviceName, InitiatingProcessFileName
| take 5

// HUNT: Cursor service lookups from a host
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1219, T1071.001
// CONF: low | FP: high
// FALSE POSITIVES: any developer using Cursor
// EQUIVALENCE: equivalent-with-schema-assumptions - Defender has no endpoint DNS table, so the lookup is read from the DnsQueryResponse action of DeviceEvents, with the queried name taken from AdditionalFields. The predicate and grouping match the CQL.
// REQUIRES: Defender for Endpoint network protection DNS events (DeviceEvents, DnsQueryResponse)
// TUNING: Restrict to server-tier devices with a DeviceName filter, and suppress device groups approved for AI-assisted development.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: DnsQueryResponse events are only recorded where the sensor emits them; hosts without them are blind.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "DnsQueryResponse"
| extend QueryName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where QueryName matches regex @"(?i)(^|\.)cursor\.(sh|com)$"
| summarize Lookups = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessFileName
| sort by Lookups desc
| take 200

// HUNT: Cursor or Node parent launching Active Directory discovery commands
// MITRE: T1087.002, T1069.002, T1482, T1018
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Process creation with parent name and command line (CrowdStrike: ProcessRollup2)
// FALSE POSITIVES: developers and AD engineers using Cursor terminals; authorized red team activity
// TUNING: exclude named AD engineering accounts and developer VDI host groups; keep servers and jump boxes
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(cursor|node)(\.exe)?$/i
| CommandLine=/(nltest|setspn|dsquery|klist|net1?\s+(group|user|accounts|view)|Get-AD(User|Computer|Group|Trust|Domain)|adfind|whoami\s+\/(all|groups))/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

event.type = 'Process Creation' src.process.name = *
| limit 5
| columns event.time, event.type, endpoint.name, src.process.name, tgt.process.cmdline

// HUNT: Cursor or Node parent launching Active Directory discovery commands
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1087.002, T1069.002, T1482, T1018
// CONF: medium | FP: medium
// FALSE POSITIVES: developers and AD engineers using Cursor terminals; authorized red team activity
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a Cursor or Node creator process spawning a directory-discovery command. The creator is src.process.* and the created process is tgt.process.* on a Process Creation event.
// REQUIRES: SentinelOne process-creation telemetry with creator name and command line
// TUNING: Exclude named AD engineering accounts and developer VDI host groups; keep servers and jump boxes.
// LOOKBACK: 7d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A discovery command launched by a grandchild of the editor (for example through a shell) is not matched, the same as the CQL tab.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and src.process.name matches '^(cursor|node)(\\.exe)?$' and tgt.process.cmdline matches '.*(nltest|setspn|dsquery|klist|net1?\\s+(group|user|accounts|view)|Get-AD(User|Computer|Group|Trust|Domain)|adfind|whoami\\s+/(all|groups)).*'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName, ProcessCommandLine
| take 5

// HUNT: Cursor or Node parent launching Active Directory discovery commands
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1087.002, T1069.002, T1482, T1018
// CONF: medium | FP: medium
// FALSE POSITIVES: developers and AD engineers using Cursor terminals; authorized red team activity
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a Cursor or Node creator process spawning a directory-discovery command. The creator is InitiatingProcessFileName and the created process is FileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude named AD engineering accounts and developer VDI device groups; keep servers and jump boxes.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A discovery command launched by a grandchild of the editor (for example through a shell) is not matched, the same as the CQL tab.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName matches regex @"(?i)^(cursor|node)(\.exe)?$"
| where ProcessCommandLine matches regex @"(?i)(nltest|setspn|dsquery|klist|net1?\s+(group|user|accounts|view)|Get-AD(User|Computer|Group|Trust|Domain)|adfind|whoami\s+/(all|groups))"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: VPN client installed or configured on a server by an unexpected parent
// MITRE: T1133, T1572
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Process creation with parent and command line (CrowdStrike: ProcessRollup2)
// FALSE POSITIVES: planned VPN client rollouts; helpdesk remote installs
// TUNING: exclude deployment parents (CcmExec, ccmsetup, IntuneManagementExtension) and approved VPN vendors; alert only on server host groups
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(openvpn|wireguard|wg-quick|tailscale|openconnect|forticlient|anyconnect|nordvpn|protonvpn)/i
| ParentBaseFileName=/^(cmd|powershell|pwsh|bash|sh|zsh|node|python3?|cursor|msiexec|winget|choco)(\.exe)?$/i
| ParentBaseFileName!=/^(CcmExec|ccmsetup|IntuneManagementExtension)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

event.type = 'Process Creation' src.process.name = *
| limit 5
| columns event.time, event.type, endpoint.name, src.process.name, tgt.process.cmdline

// HUNT: VPN client installed or configured on a server by an unexpected parent
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1133, T1572
// CONF: medium | FP: medium
// FALSE POSITIVES: planned VPN client rollouts; helpdesk remote installs
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a VPN client name in the command line, launched by one of the listed shells, installers or interpreters, excluding the deployment agents. The creator is src.process.* on a Process Creation event.
// REQUIRES: SentinelOne process-creation telemetry with creator name and command line
// TUNING: Exclude deployment parents and approved VPN vendors; alert only on server host groups.
// LOOKBACK: 7d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Scoping to server host groups is left to the analyst; the query returns workstations too.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and tgt.process.cmdline contains ('openvpn', 'wireguard', 'wg-quick', 'tailscale', 'openconnect', 'forticlient', 'anyconnect', 'nordvpn', 'protonvpn') and src.process.name matches '^(cmd|powershell|pwsh|bash|sh|zsh|node|python3?|cursor|msiexec|winget|choco)(\\.exe)?$' and !(src.process.name matches '^(CcmExec|ccmsetup|IntuneManagementExtension)(\\.exe)?$')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName, ProcessCommandLine
| take 5

// HUNT: VPN client installed or configured on a server by an unexpected parent
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1133, T1572
// CONF: medium | FP: medium
// FALSE POSITIVES: planned VPN client rollouts; helpdesk remote installs
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a VPN client name in the command line, launched by one of the listed shells, installers or interpreters, excluding the deployment agents. The creator is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude deployment parents and approved VPN vendors; alert only on server device groups.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Scoping to server device groups is left to the analyst; the query returns workstations too.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine matches regex @"(?i)(openvpn|wireguard|wg-quick|tailscale|openconnect|forticlient|anyconnect|nordvpn|protonvpn)"
| where InitiatingProcessFileName matches regex @"(?i)^(cmd|powershell|pwsh|bash|sh|zsh|node|python3?|cursor|msiexec|winget|choco)(\.exe)?$"
| where not(InitiatingProcessFileName matches regex @"(?i)^(CcmExec|ccmsetup|IntuneManagementExtension)(\.exe)?$")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Nmap and NetExec execution
// MITRE: T1046, T1018, T1135
// CONF: high
// FP: medium
// COST: low
// REQUIRES: Process creation with command line (CrowdStrike: ProcessRollup2)
// FALSE POSITIVES: approved vulnerability scanners; network engineering; authorized pentests
// TUNING: exclude the scanner hosts on your change calendar; require a change ticket for any other hit
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(nmap|ncat|nxc|netexec|crackmapexec)(\.exe)?$/i or CommandLine=/\b(nxc|netexec)(\.exe)?\s+(smb|ldap|winrm|mssql|rdp|ssh|wmi|ftp|vnc)\b/i or CommandLine=/\bnmap(\.exe)?\s+.*(-sS|-sT|-sV|-sn|-Pn|-p-|--top-ports|-p\s?[0-9,-]+)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.name, tgt.process.name, tgt.process.cmdline

// HUNT: Nmap and NetExec execution
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1046, T1018, T1135
// CONF: high | FP: medium
// FALSE POSITIVES: approved vulnerability scanners; network engineering; authorized pentests
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a scanner tool name, a NetExec protocol invocation, or an Nmap scan-flag invocation.
// REQUIRES: SentinelOne process-creation telemetry with the command line
// TUNING: Exclude the scanner hosts on your change calendar; require a change ticket for any other hit.
// LOOKBACK: 7d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed binary run without scan flags in its command line is not matched, the same as the CQL tab.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and (tgt.process.name matches '^(nmap|ncat|nxc|netexec|crackmapexec)(\\.exe)?$' or tgt.process.cmdline matches '.*\\b(nxc|netexec)(\\.exe)?\\s+(smb|ldap|winrm|mssql|rdp|ssh|wmi|ftp|vnc)\\b.*' or tgt.process.cmdline matches '.*\\bnmap(\\.exe)?\\s+.*(-sS|-sT|-sV|-sn|-Pn|-p-|--top-ports|-p\\s?[0-9,-]+).*')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine, InitiatingProcessFileName
| take 5

// HUNT: Nmap and NetExec execution
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1046, T1018, T1135
// CONF: high | FP: medium
// FALSE POSITIVES: approved vulnerability scanners; network engineering; authorized pentests
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a scanner tool name, a NetExec protocol invocation, or an Nmap scan-flag invocation.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude the scanner devices on your change calendar; require a change ticket for any other hit.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed binary run without scan flags in its command line is not matched, the same as the CQL tab.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName matches regex @"(?i)^(nmap|ncat|nxc|netexec|crackmapexec)(\.exe)?$" or ProcessCommandLine matches regex @"(?i)\b(nxc|netexec)(\.exe)?\s+(smb|ldap|winrm|mssql|rdp|ssh|wmi|ftp|vnc)\b" or ProcessCommandLine matches regex @"(?i)\bnmap(\.exe)?\s+.*(-sS|-sT|-sV|-sn|-Pn|-p-|--top-ports|-p\s?[0-9,-]+)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: One process fanning out to many internal hosts on AD and admin ports
// MITRE: T1046, T1018, T1021
// CONF: medium
// FP: medium
// COST: high
// REQUIRES: Network connection telemetry (CrowdStrike: NetworkConnectIP4)
// FALSE POSITIVES: scanners, backup and monitoring agents, DCs, file-server migrations
// TUNING: exclude the process names of scanners and backup agents and your domain controllers; raise the threshold on busy servers
#event_simpleName=NetworkConnectIP4
| in(field=RemotePort, values=[445, 389, 636, 88, 135, 3389, 5985, 1433, 22])
| cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"])
| groupBy([aid, ComputerName, ContextBaseFileName], function=[count(RemoteAddressIP4, distinct=true, as=DistinctHosts), count(RemotePort, distinct=true, as=DistinctPorts), count(as=Connections), min(@timestamp, as=FirstSeen)], limit=500)
| test(DistinctHosts >= 50)
| sort(DistinctHosts, order=desc, limit=100)

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.time, event.type, agent.uuid, endpoint.name, src.process.name, dst.ip.address, dst.port.number

// HUNT: One process fanning out to many internal hosts on AD and admin ports
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1046, T1018, T1021
// CONF: medium | FP: medium
// FALSE POSITIVES: scanners, backup and monitoring agents, DCs, file-server migrations
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate: one process connecting to at least 50 distinct private addresses on the listed directory and admin ports, grouped per endpoint and process name. The private ranges are tested with the subnet function.
// REQUIRES: SentinelOne network telemetry (event type IP Connect)
// TUNING: Exclude the process names of scanners and backup agents and your domain controllers; raise the threshold on busy servers.
// LOOKBACK: 1d; a short window keeps the distinct count meaningful
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The distinct-host count is an estimate rather than an exact count.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' and dst.port.number in (445, 389, 636, 88, 135, 3389, 5985, 1433, 22)
| filter net_ipsubnet(dst.ip.address, '10.0.0.0/8') or net_ipsubnet(dst.ip.address, '172.16.0.0/12') or net_ipsubnet(dst.ip.address, '192.168.0.0/16')
| group distinct_hosts=estimate_distinct(dst.ip.address), distinct_ports=estimate_distinct(dst.port.number), connections=count(), first_seen=min(event.time) by agent.uuid, endpoint.name, src.process.name
| filter distinct_hosts >= 50
| sort -distinct_hosts
| limit 100

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceId, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| take 5

// HUNT: One process fanning out to many internal hosts on AD and admin ports
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1046, T1018, T1021
// CONF: medium | FP: medium
// FALSE POSITIVES: scanners, backup and monitoring agents, DCs, file-server migrations
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate: one process connecting to at least 50 distinct private addresses on the listed directory and admin ports, grouped per device and process name.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Exclude the process names of scanners and backup agents and your domain controllers; raise the threshold on busy servers.
// LOOKBACK: 7d; narrow to 1d on busy estates to keep the distinct count meaningful
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: dcount is an estimate, so a count near the threshold of 50 may differ slightly from the exact CQL count.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where RemotePort in (445, 389, 636, 88, 135, 3389, 5985, 1433, 22)
| where ipv4_is_in_range(RemoteIP, "10.0.0.0/8") or ipv4_is_in_range(RemoteIP, "172.16.0.0/12") or ipv4_is_in_range(RemoteIP, "192.168.0.0/16")
| summarize DistinctHosts = dcount(RemoteIP), DistinctPorts = dcount(RemotePort), Connections = count(), FirstSeen = min(Timestamp) by DeviceId, DeviceName, InitiatingProcessFileName
| where DistinctHosts >= 50
| sort by DistinctHosts desc
| take 100

// HUNT: BloodHound collector execution
// MITRE: T1087.002, T1069.002, T1482
// CONF: high
// FP: low
// COST: low
// REQUIRES: Process creation with command line (CrowdStrike: ProcessRollup2)
// FALSE POSITIVES: authorized red team and internal attack-path assessments
// TUNING: exclude the assessment host while an exercise is open
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(sharphound|azurehound)(\.exe)?$/i or CommandLine=/(sharphound|azurehound|bloodhound-python|bloodhound\.py|invoke-bloodhound|--collectionmethod)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.name, tgt.process.name, tgt.process.cmdline

// HUNT: BloodHound collector execution
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1087.002, T1069.002, T1482
// CONF: high | FP: low
// FALSE POSITIVES: authorized red team and internal attack-path assessments
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a collector binary name, or a collector marker anywhere in the command line.
// REQUIRES: SentinelOne process-creation telemetry with the command line
// TUNING: Exclude the assessment host while an exercise is open.
// LOOKBACK: 7d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A collector that is renamed and run without its usual switches is not matched, the same as the CQL tab.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and (tgt.process.name matches '^(sharphound|azurehound)(\\.exe)?$' or tgt.process.cmdline matches '.*(sharphound|azurehound|bloodhound-python|bloodhound\\.py|invoke-bloodhound|--collectionmethod).*')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine, InitiatingProcessFileName
| take 5

// HUNT: BloodHound collector execution
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1087.002, T1069.002, T1482
// CONF: high | FP: low
// FALSE POSITIVES: authorized red team and internal attack-path assessments
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a collector binary name, or a collector marker anywhere in the command line.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude the assessment device while an exercise is open.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A collector that is renamed and run without its usual switches is not matched, the same as the CQL tab.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName matches regex @"(?i)^(sharphound|azurehound)(\.exe)?$" or ProcessCommandLine matches regex @"(?i)(sharphound|azurehound|bloodhound-python|bloodhound\.py|invoke-bloodhound|--collectionmethod)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: BloodHound and Certipy output archives written to disk
// MITRE: T1087.002, T1649
// CONF: medium
// FP: low
// COST: low
// REQUIRES: File write telemetry for archives (CrowdStrike: ZipFileWritten)
// FALSE POSITIVES: authorized assessments
// TUNING: exclude assessment hosts while an exercise is open
#event_simpleName=ZipFileWritten
| TargetFileName=/(_BloodHound|_Certipy)\.zip$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName], limit=200)

event.type = 'File Creation' tgt.file.path = *
| limit 5
| columns event.time, event.type, endpoint.name, src.process.name, tgt.file.path

// HUNT: BloodHound and Certipy output archives written to disk
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1087.002, T1649
// CONF: medium | FP: low
// FALSE POSITIVES: authorized assessments
// EQUIVALENCE: approximate-analytic - The CQL reads an archive-written sensor event. The closest SentinelOne event is a File Creation whose target path ends in one of the two output-archive suffixes; the writing process is src.process.* on that event.
// REQUIRES: SentinelOne file telemetry (event type File Creation)
// TUNING: Exclude assessment hosts while an exercise is open.
// LOOKBACK: 7d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Archives that arrive by rename or move rather than by creation are not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'File Creation' and tgt.file.path matches '.*(_BloodHound|_Certipy)\\.zip$'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.file.path
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| where ActionType == "FileCreated"
| project Timestamp, ActionType, FileName, FolderPath, InitiatingProcessFileName
| take 5

// HUNT: BloodHound and Certipy output archives written to disk
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1087.002, T1649
// CONF: medium | FP: low
// FALSE POSITIVES: authorized assessments
// EQUIVALENCE: approximate-analytic - The CQL reads an archive-written sensor event. The closest Defender signal is a FileCreated row in DeviceFileEvents whose file name ends in one of the two output-archive suffixes.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: Exclude assessment devices while an exercise is open.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Archives that arrive by rename or move rather than by creation are not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(7d)
| where ActionType == "FileCreated"
| where FileName matches regex @"(?i)(_BloodHound|_Certipy)\.zip$"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FolderPath, FileName
| sort by Timestamp desc
| take 200

// HUNT: SharpShares share and AD enumeration
// MITRE: T1135, T1087.002
// CONF: high
// FP: low
// COST: low
// REQUIRES: Process creation with command line (CrowdStrike: ProcessRollup2)
// FALSE POSITIVES: authorized assessments
// TUNING: exclude the assessment host while an exercise is open
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^sharpshares(\.exe)?$/i or CommandLine=/sharpshares/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.name, tgt.process.name, tgt.process.cmdline

// HUNT: SharpShares share and AD enumeration
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1135, T1087.002
// CONF: high | FP: low
// FALSE POSITIVES: authorized assessments
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the tool binary name, or its name anywhere in the command line.
// REQUIRES: SentinelOne process-creation telemetry with the command line
// TUNING: Exclude the assessment host while an exercise is open.
// LOOKBACK: 7d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed binary with no telltale command line is not matched, the same as the CQL tab.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and (tgt.process.name matches '^sharpshares(\\.exe)?$' or tgt.process.cmdline contains 'sharpshares')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine, InitiatingProcessFileName
| take 5

// HUNT: SharpShares share and AD enumeration
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1135, T1087.002
// CONF: high | FP: low
// FALSE POSITIVES: authorized assessments
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the tool binary name, or its name anywhere in the command line.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude the assessment device while an exercise is open.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed binary with no telltale command line is not matched, the same as the CQL tab.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName matches regex @"(?i)^sharpshares(\.exe)?$" or ProcessCommandLine contains "sharpshares"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Domain trust and computer enumeration commands
// MITRE: T1482, T1018
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Process creation with command line (CrowdStrike: ProcessRollup2)
// FALSE POSITIVES: AD admins, inventory and migration scripts
// TUNING: exclude named AD engineering accounts and inventory service accounts
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(nltest(\.exe)?\s+.*(domain_trusts|dclist|trusted_domains)|Get-ADTrust|Get-ADComputer\s+-Filter|Win32_ComputerSystem.*(Get-WmiObject|Get-CimInstance)|(Get-WmiObject|Get-CimInstance).*Win32_ComputerSystem)/i
| groupBy([ComputerName, UserName], function=[count(as=Commands), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen), collect([CommandLine])], limit=500)
| sort(Commands, order=desc, limit=100)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.name, src.process.user, tgt.process.cmdline

// HUNT: Domain trust and computer enumeration commands
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1482, T1018
// CONF: medium | FP: medium
// FALSE POSITIVES: AD admins, inventory and migration scripts
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate and the same per-host and per-user grouping. The command-line list is reduced to one sample command line because the language has no collect aggregate.
// REQUIRES: SentinelOne process-creation telemetry with the command line
// TUNING: Exclude named AD engineering accounts and inventory service accounts.
// LOOKBACK: 7d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Only one sample command line per host and user is returned; the CQL tab lists every command line.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and tgt.process.cmdline matches '.*(nltest(\\.exe)?\\s+.*(domain_trusts|dclist|trusted_domains)|Get-ADTrust|Get-ADComputer\\s+-Filter|Win32_ComputerSystem.*(Get-WmiObject|Get-CimInstance)|(Get-WmiObject|Get-CimInstance).*Win32_ComputerSystem).*'
| group commands=count(), first_seen=min(event.time), last_seen=max(event.time), sample_cmdline=any(tgt.process.cmdline) by endpoint.name, src.process.user
| sort -commands
| limit 100

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| take 5

// HUNT: Domain trust and computer enumeration commands
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1482, T1018
// CONF: medium | FP: medium
// FALSE POSITIVES: AD admins, inventory and migration scripts
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate and the same per-device and per-account grouping, with the command lines collected into a set.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude named AD engineering accounts and inventory service accounts.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The set of command lines is capped at 10 per device and account.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine matches regex @"(?i)(nltest(\.exe)?\s+.*(domain_trusts|dclist|trusted_domains)|Get-ADTrust|Get-ADComputer\s+-Filter|Win32_ComputerSystem.*(Get-WmiObject|Get-CimInstance)|(Get-WmiObject|Get-CimInstance).*Win32_ComputerSystem)"
| summarize Commands = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), CommandLines = make_set(ProcessCommandLine, 10) by DeviceName, AccountName
| sort by Commands desc
| take 100

// HUNT: Kerberoasting tools and scripts (Invoke-Kerberoast, PowerShell Kerberoast)
// MITRE: T1558.003
// CONF: high
// FP: low
// COST: medium
// REQUIRES: Process creation and PowerShell script scan (CrowdStrike: ProcessRollup2, ScriptControlScanTelemetry)
// FALSE POSITIVES: authorized assessments; security tooling that audits SPN accounts
// TUNING: exclude the assessment host while an exercise is open
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|ScriptControlScanTelemetry)$/
| @rawstring=/(Invoke-Kerberoast|Request-SPNTicket|GetUserSPNs|Rubeus.*kerberoast|\bkerberoast\b)/i
| table([@timestamp, ComputerName, UserName, #event_simpleName, FileName, CommandLine, @rawstring], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.name, tgt.process.name, tgt.process.cmdline

// HUNT: Kerberoasting tools and scripts (Invoke-Kerberoast, PowerShell Kerberoast)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1558.003
// CONF: high | FP: low
// FALSE POSITIVES: authorized assessments; security tooling that audits SPN accounts
// EQUIVALENCE: approximate-analytic - The CQL searches both process-creation text and PowerShell script-scan telemetry. SentinelOne exposes the process-creation command line here, so the same marker expression runs over that only; markers that appear solely inside a script body are not seen.
// REQUIRES: SentinelOne process-creation telemetry with the command line
// TUNING: Exclude the assessment host while an exercise is open.
// LOOKBACK: 7d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Script-body scan telemetry (read by the CQL tab) is not available here, so a Kerberoast function loaded inside a script without a revealing command line is missed.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and tgt.process.cmdline matches '.*(Invoke-Kerberoast|Request-SPNTicket|GetUserSPNs|Rubeus.*kerberoast|\\bkerberoast\\b).*'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine, InitiatingProcessFileName
| take 5

// HUNT: Kerberoasting tools and scripts (Invoke-Kerberoast, PowerShell Kerberoast)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1558.003
// CONF: high | FP: low
// FALSE POSITIVES: authorized assessments; security tooling that audits SPN accounts
// EQUIVALENCE: approximate-analytic - The CQL searches both process-creation text and PowerShell script-scan telemetry. A hunt reads one table, so the same marker expression runs over the process-creation command line only; markers that appear solely inside a script body are not seen.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude the assessment device while an exercise is open.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: PowerShell script-body telemetry (read by the CQL tab) is not part of this table, so a Kerberoast function loaded inside a script without a revealing command line is missed.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine matches regex @"(?i)(Invoke-Kerberoast|Request-SPNTicket|GetUserSPNs|Rubeus.*kerberoast|\bkerberoast\b)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Password spraying: one source, many accounts, failed logons
// MITRE: T1110.003
// CONF: medium
// FP: medium
// COST: medium
// REQUIRES: Failed logon telemetry from domain controllers (CrowdStrike: UserLogonFailed2)
// FALSE POSITIVES: NAT or proxy addresses; stale service credentials; scanners
// TUNING: exclude known NAT, VPN and scanner source addresses; require DistinctUsers above your baseline
#event_simpleName=UserLogonFailed2
| groupBy([RemoteAddressIP4, ComputerName], function=[count(UserName, distinct=true, as=DistinctUsers), count(as=Failures), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=1000)
| test(DistinctUsers >= 10)
| sort(DistinctUsers, order=desc, limit=100)

event.type = 'Login' src.endpoint.ip.address = *
| limit 5
| columns event.time, event.type, endpoint.name, src.endpoint.ip.address, event.login.userName, event.login.loginIsSuccessful

// HUNT: Password spraying: one source, many accounts, failed logons
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1110.003
// CONF: medium | FP: medium
// FALSE POSITIVES: NAT or proxy addresses; stale service credentials; scanners
// EQUIVALENCE: approximate-analytic - The CQL counts failed domain-controller logons per source address. SentinelOne sees a failed Login event only on endpoints that carry the agent, so the same count of distinct accounts per source address runs over those events; a domain controller without the agent contributes nothing.
// REQUIRES: SentinelOne Login events from the domain controllers, which must run the agent
// TUNING: Exclude known NAT, VPN and scanner source addresses; require the distinct account count to exceed your baseline.
// LOOKBACK: 1d; a short window keeps the distinct count meaningful
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Failed logons on controllers without the agent are invisible, and the source address field is unproven on a tenant.
// VALIDATION LEVEL: static-reviewed
event.type = 'Login' and event.login.loginIsSuccessful = false and src.endpoint.ip.address = *
| group distinct_users=estimate_distinct(event.login.userName), failures=count(), first_seen=min(event.time), last_seen=max(event.time) by src.endpoint.ip.address, endpoint.name
| filter distinct_users >= 10
| sort -distinct_users
| limit 100

DeviceLogonEvents
| where Timestamp > ago(1d)
| where ActionType == "LogonFailed"
| project Timestamp, ActionType, DeviceName, AccountName, RemoteIP
| take 5

// HUNT: Password spraying: one source, many accounts, failed logons
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1110.003
// CONF: medium | FP: medium
// FALSE POSITIVES: NAT or proxy addresses; stale service credentials; scanners
// EQUIVALENCE: approximate-analytic - The CQL counts failed domain-controller logons per source address. DeviceLogonEvents records failed logons only on devices onboarded to Defender for Endpoint, so the same count of distinct accounts per source address runs over those rows; a domain controller that is not onboarded contributes nothing.
// REQUIRES: Defender for Endpoint logon telemetry (DeviceLogonEvents) from the domain controllers
// TUNING: Exclude known NAT, VPN and scanner source addresses; require the distinct account count to exceed your baseline.
// LOOKBACK: 1d; a short window keeps the distinct count meaningful
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Failed logons on controllers that are not onboarded are invisible; dcount is an estimate near the threshold of 10.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceLogonEvents
| where Timestamp >= ago(1d)
| where ActionType == "LogonFailed"
| where isnotempty(RemoteIP)
| summarize DistinctUsers = dcount(AccountName), Failures = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by RemoteIP, DeviceName
| where DistinctUsers >= 10
| sort by DistinctUsers desc
| take 100

// HUNT: NTLM coercion and relay tooling (PetitPotam, Coerce Plus, PrinterBug, Impacket relay)
// MITRE: T1187, T1557.001
// CONF: high
// FP: low
// COST: low
// REQUIRES: Process creation with command line (CrowdStrike: ProcessRollup2)
// FALSE POSITIVES: authorized assessments; scripts that happen to contain the word coerce
// TUNING: exclude the assessment host; review any coerce-only match by hand before escalating
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(petitpotam|spoolsample|printerbug|ntlmrelayx|krbrelayx|coercer)(\.exe|\.py)?$/i or CommandLine=/(petitpotam|spoolsample|printerbug|ntlmrelayx|krbrelayx|\bcoerce)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.name, tgt.process.name, tgt.process.cmdline

// HUNT: NTLM coercion and relay tooling (PetitPotam, Coerce Plus, PrinterBug, Impacket relay)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1187, T1557.001
// CONF: high | FP: low
// FALSE POSITIVES: authorized assessments; scripts that happen to contain the word coerce
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a coercion or relay tool binary name, or a tool marker anywhere in the command line.
// REQUIRES: SentinelOne process-creation telemetry with the command line
// TUNING: Exclude the assessment host; review any match on the word coerce alone by hand before escalating.
// LOOKBACK: 7d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed tool with no telltale command line is not matched, the same as the CQL tab.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and (tgt.process.name matches '^(petitpotam|spoolsample|printerbug|ntlmrelayx|krbrelayx|coercer)(\\.exe|\\.py)?$' or tgt.process.cmdline matches '.*(petitpotam|spoolsample|printerbug|ntlmrelayx|krbrelayx|\\bcoerce).*')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine, InitiatingProcessFileName
| take 5

// HUNT: NTLM coercion and relay tooling (PetitPotam, Coerce Plus, PrinterBug, Impacket relay)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1187, T1557.001
// CONF: high | FP: low
// FALSE POSITIVES: authorized assessments; scripts that happen to contain the word coerce
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a coercion or relay tool binary name, or a tool marker anywhere in the command line.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude the assessment device; review any match on the word coerce alone by hand before escalating.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed tool with no telltale command line is not matched, the same as the CQL tab.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName matches regex @"(?i)^(petitpotam|spoolsample|printerbug|ntlmrelayx|krbrelayx|coercer)(\.exe|\.py)?$" or ProcessCommandLine matches regex @"(?i)(petitpotam|spoolsample|printerbug|ntlmrelayx|krbrelayx|\bcoerce)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Certipy certificate abuse
// MITRE: T1649
// CONF: high
// FP: low
// COST: low
// REQUIRES: Process creation with command line (CrowdStrike: ProcessRollup2)
// FALSE POSITIVES: AD CS audits by defenders; authorized assessments
// TUNING: exclude the audit host while an AD CS review is open
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^certipy(-ad)?(\.exe)?$/i or CommandLine=/\bcertipy(-ad)?(\.exe)?\s+(find|req|auth|shadow|ca|template|account|relay|forge|cert)\b/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.name, tgt.process.name, tgt.process.cmdline

// HUNT: Certipy certificate abuse
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1649
// CONF: high | FP: low
// FALSE POSITIVES: AD CS audits by defenders; authorized assessments
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the tool binary name, or the tool name followed by one of its sub-commands in the command line.
// REQUIRES: SentinelOne process-creation telemetry with the command line
// TUNING: Exclude the audit host while a certificate services review is open.
// LOOKBACK: 7d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed tool with no telltale command line is not matched, the same as the CQL tab.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and (tgt.process.name matches '^certipy(-ad)?(\\.exe)?$' or tgt.process.cmdline matches '.*\\bcertipy(-ad)?(\\.exe)?\\s+(find|req|auth|shadow|ca|template|account|relay|forge|cert)\\b.*')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine, InitiatingProcessFileName
| take 5

// HUNT: Certipy certificate abuse
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1649
// CONF: high | FP: low
// FALSE POSITIVES: AD CS audits by defenders; authorized assessments
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the tool binary name, or the tool name followed by one of its sub-commands in the command line.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude the audit device while a certificate services review is open.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed tool with no telltale command line is not matched, the same as the CQL tab.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName matches regex @"(?i)^certipy(-ad)?(\.exe)?$" or ProcessCommandLine matches regex @"(?i)\bcertipy(-ad)?(\.exe)?\s+(find|req|auth|shadow|ca|template|account|relay|forge|cert)\b"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Chisel SOCKS tunnel
// MITRE: T1090, T1572
// CONF: high
// FP: low
// COST: low
// REQUIRES: Process creation with command line (CrowdStrike: ProcessRollup2)
// FALSE POSITIVES: developers and admins using it for sanctioned forwarding
// TUNING: exclude named developer accounts; review any hit on a server
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^chisel(_[a-z0-9_.]+)?(\.exe)?$/i or CommandLine=/\bchisel(\.exe)?\s+(client|server)\b/i or CommandLine=/\bR:(\d+:)?socks\b/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.name, tgt.process.name, tgt.process.cmdline

// HUNT: Chisel SOCKS tunnel
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1090, T1572
// CONF: high | FP: low
// FALSE POSITIVES: developers and admins using it for sanctioned forwarding
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the tunnel tool binary name, its client or server sub-command, or the reverse SOCKS forwarding argument.
// REQUIRES: SentinelOne process-creation telemetry with the command line
// TUNING: Exclude named developer accounts; review any hit on a server.
// LOOKBACK: 7d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed binary run without the reverse SOCKS argument or a sub-command is not matched, the same as the CQL tab.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and (tgt.process.name matches '^chisel(_[a-z0-9_.]+)?(\\.exe)?$' or tgt.process.cmdline matches '.*\\bchisel(\\.exe)?\\s+(client|server)\\b.*' or tgt.process.cmdline matches '.*\\bR:(\\d+:)?socks\\b.*')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine, InitiatingProcessFileName
| take 5

// HUNT: Chisel SOCKS tunnel
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1090, T1572
// CONF: high | FP: low
// FALSE POSITIVES: developers and admins using it for sanctioned forwarding
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the tunnel tool binary name, its client or server sub-command, or the reverse SOCKS forwarding argument.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude named developer accounts; review any hit on a server.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed binary run without the reverse SOCKS argument or a sub-command is not matched, the same as the CQL tab.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName matches regex @"(?i)^chisel(_[a-z0-9_.]+)?(\.exe)?$" or ProcessCommandLine matches regex @"(?i)\bchisel(\.exe)?\s+(client|server)\b" or ProcessCommandLine matches regex @"(?i)\bR:(\d+:)?socks\b"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Cobalt Strike named-pipe command shape (getsystem style)
// MITRE: T1134, T1559
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Process creation with command line (CrowdStrike: ProcessRollup2)
// FALSE POSITIVES: admin scripts that talk to a local pipe
// TUNING: exclude known software that echoes to a pipe; correlate with a service or SYSTEM token change
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/echo\s.*>\s*\\\\\.\\pipe\\/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.name, tgt.process.name, tgt.process.cmdline

// HUNT: Cobalt Strike named-pipe command shape (getsystem style)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1134, T1559
// CONF: medium | FP: medium
// FALSE POSITIVES: admin scripts that talk to a local pipe
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a command line that echoes to a local named pipe, written as a character-class expression for the double-backslash, dot and pipe prefix.
// REQUIRES: SentinelOne process-creation telemetry with the command line
// TUNING: Exclude known software that echoes to a pipe; correlate with a service or SYSTEM token change.
// LOOKBACK: 7d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Pipe writes made by an API call rather than a command line are not captured, the same as the CQL tab.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and tgt.process.cmdline matches '.*echo\\s.*>\\s*[\\\\]{2}[.][\\\\]pipe[\\\\].*'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine, InitiatingProcessFileName
| take 5

// HUNT: Cobalt Strike named-pipe command shape (getsystem style)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1134, T1559
// CONF: medium | FP: medium
// FALSE POSITIVES: admin scripts that talk to a local pipe
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a command line that echoes to a local named pipe, written as a character-class expression for the double-backslash, dot and pipe prefix.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude known software that echoes to a pipe; correlate with a service or SYSTEM token change.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Pipe writes made by an API call rather than a command line are not captured, the same as the CQL tab.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine matches regex @"(?i)echo\s.*>\s*[\\]{2}[.][\\]pipe[\\]"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Cobalt Strike stager persistence: service-launched encoded PowerShell
// MITRE: T1543.003, T1059.001
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Process creation with parent and command line (CrowdStrike: ProcessRollup2)
// FALSE POSITIVES: management agents; legacy services that launch PowerShell
// TUNING: exclude named management agents by hash or signer; keep the encoded and hidden-window variants
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^services(\.exe)?$/i
| CommandLine=/(cmd(\.exe)?\s+\/[ck]\s+.*powershell|powershell.*(-nop|-noni|-w\s+hidden|-enc|-encodedcommand))/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

event.type = 'Process Creation' src.process.name = *
| limit 5
| columns event.time, event.type, endpoint.name, src.process.name, tgt.process.cmdline

// HUNT: Cobalt Strike stager persistence: service-launched encoded PowerShell
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1543.003, T1059.001
// CONF: medium | FP: medium
// FALSE POSITIVES: management agents; legacy services that launch PowerShell
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the service control manager as the creator, and a command line that wraps PowerShell in a shell or passes a stealth, encoded or hidden-window switch. The creator is src.process.* on a Process Creation event.
// REQUIRES: SentinelOne process-creation telemetry with creator name and command line
// TUNING: Exclude named management agents by hash or signer; keep the encoded and hidden-window variants.
// LOOKBACK: 7d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A service whose payload is launched through an intermediate process is not matched, the same as the CQL tab.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and src.process.name matches '^services(\\.exe)?$' and tgt.process.cmdline matches '.*(cmd(\\.exe)?\\s+/[ck]\\s+.*powershell|powershell.*(-nop|-noni|-w\\s+hidden|-enc|-encodedcommand)).*'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName, ProcessCommandLine
| take 5

// HUNT: Cobalt Strike stager persistence: service-launched encoded PowerShell
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1543.003, T1059.001
// CONF: medium | FP: medium
// FALSE POSITIVES: management agents; legacy services that launch PowerShell
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the service control manager as the creator, and a command line that wraps PowerShell in a shell or passes a stealth, encoded or hidden-window switch. The creator is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude named management agents by hash or signer; keep the encoded and hidden-window variants.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A service whose payload is launched through an intermediate process is not matched, the same as the CQL tab.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName matches regex @"(?i)^services(\.exe)?$"
| where ProcessCommandLine matches regex @"(?i)(cmd(\.exe)?\s+/[ck]\s+.*powershell|powershell.*(-nop|-noni|-w\s+hidden|-enc|-encodedcommand))"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Renamed S3 client (VeeamTransport) exfiltrating with --endpoint-url
// MITRE: T1567.002, T1048
// CONF: high
// FP: medium
// COST: low
// REQUIRES: Process creation with command line (CrowdStrike: ProcessRollup2)
// FALSE POSITIVES: legitimate Veeam services (name only); admins using an S3 client with a custom endpoint
// TUNING: exclude the genuine signed Veeam binary by hash or signer; keep any run with a cp or s3 destination
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^veeamtransport(\.exe)?$/i or CommandLine=/--endpoint-url/i
| CommandLine=/(--endpoint-url|\bcp\b.*s3:\/\/|s3:\/\/)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.name, tgt.process.name, tgt.process.cmdline

// HUNT: Renamed S3 client (VeeamTransport) exfiltrating with --endpoint-url
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1567.002, T1048
// CONF: high | FP: medium
// FALSE POSITIVES: legitimate Veeam services (name only); admins using an S3 client with a custom endpoint
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the renamed backup-agent binary name, or a custom S3 endpoint argument, and in both cases a command line carrying an endpoint argument or an S3 destination.
// REQUIRES: SentinelOne process-creation telemetry with the command line
// TUNING: Exclude the genuine signed backup binary by hash or signer; keep any run with a copy or S3 destination.
// LOOKBACK: 7d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed S3 client that takes its endpoint from environment variables or a config file leaves no marker in the command line and is not matched, the same as the CQL tab.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and (tgt.process.name matches '^veeamtransport(\\.exe)?$' or tgt.process.cmdline contains '--endpoint-url') and tgt.process.cmdline contains ('--endpoint-url', 's3://')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine, InitiatingProcessFileName
| take 5

// HUNT: Renamed S3 client (VeeamTransport) exfiltrating with --endpoint-url
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1567.002, T1048
// CONF: high | FP: medium
// FALSE POSITIVES: legitimate Veeam services (name only); admins using an S3 client with a custom endpoint
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the renamed backup-agent binary name, or a custom S3 endpoint argument, and in both cases a command line carrying an endpoint argument or an S3 destination.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude the genuine signed backup binary by hash or signer; keep any run with a copy or S3 destination.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed S3 client that takes its endpoint from environment variables or a config file leaves no marker in the command line and is not matched, the same as the CQL tab.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName matches regex @"(?i)^veeamtransport(\.exe)?$" or ProcessCommandLine contains "--endpoint-url"
| where ProcessCommandLine contains "--endpoint-url" or ProcessCommandLine contains "s3://"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Connections to the seven published Sophos indicator addresses and to port 54410
// MITRE: T1071.001, T1090, T1567.002
// CONF: high
// FP: low
// COST: low
// REQUIRES: Network connection telemetry (CrowdStrike: NetworkConnectIP4)
// FALSE POSITIVES: reallocated addresses; unrelated services on port 54410
// TUNING: when only the port matches, confirm the destination before escalating
#event_simpleName=NetworkConnectIP4
| RemoteAddressIP4="152.236.4.14" or RemoteAddressIP4="152.236.3.8" or RemoteAddressIP4="172.86.89.124" or RemoteAddressIP4="144.172.101.72" or RemoteAddressIP4="206.223.230.107" or RemoteAddressIP4="45.59.113.63" or RemoteAddressIP4="172.86.113.245" or RemotePort=54410
| case {
    RemoteAddressIP4="152.236.4.14" | Role := "exfiltration server";
    RemoteAddressIP4="152.236.3.8" or RemoteAddressIP4="172.86.89.124" or RemoteAddressIP4="144.172.101.72" or RemoteAddressIP4="206.223.230.107" | Role := "Cobalt Strike C2";
    RemoteAddressIP4="45.59.113.63" | Role := "SOCKS proxy node";
    RemoteAddressIP4="172.86.113.245" | Role := "open directory server";
    * | Role := "port 54410 only" }
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort, Role], limit=200)

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.time, event.type, endpoint.name, src.process.name, dst.ip.address, dst.port.number

// HUNT: Connections to the seven published Sophos indicator addresses and to port 54410
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1090, T1567.002
// CONF: high | FP: low
// FALSE POSITIVES: reallocated addresses; unrelated services on port 54410
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate: a connection to any of the seven published addresses, or to the one published port. The CQL role label is not computed here because the language has no case construct the offline engine can check.
// REQUIRES: SentinelOne network telemetry (event type IP Connect)
// TUNING: When only the port matches, confirm the destination before escalating.
// LOOKBACK: 30d; set in the console time picker, since these are retrospective indicators
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The role label per address (exfiltration server, Cobalt Strike C2, SOCKS proxy node, open directory server, port only) is not computed; read it from the CQL tab.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' and (dst.ip.address in ('152.236.4.14', '152.236.3.8', '172.86.89.124', '144.172.101.72', '206.223.230.107', '45.59.113.63', '172.86.113.245') or dst.port.number = 54410)
| columns event.time, endpoint.name, src.process.user, src.process.name, dst.ip.address, dst.port.number
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| take 5

// HUNT: Connections to the seven published Sophos indicator addresses and to port 54410
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1090, T1567.002
// CONF: high | FP: low
// FALSE POSITIVES: reallocated addresses; unrelated services on port 54410
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate: a connection to any of the seven published addresses, or to the one published port, with the same role label per address.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: When only the port matches, confirm the destination before escalating.
// LOOKBACK: 30d (Advanced Hunting retention); the CQL tab covers the full retention of your Falcon tenant
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days, so older connections are visible only on the CQL tab.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemoteIP in ("152.236.4.14", "152.236.3.8", "172.86.89.124", "144.172.101.72", "206.223.230.107", "45.59.113.63", "172.86.113.245") or RemotePort == 54410
| extend Role = case(RemoteIP == "152.236.4.14", "exfiltration server", RemoteIP in ("152.236.3.8", "172.86.89.124", "144.172.101.72", "206.223.230.107"), "Cobalt Strike C2", RemoteIP == "45.59.113.63", "SOCKS proxy node", RemoteIP == "172.86.113.245", "open directory server", "port 54410 only")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteIP, RemotePort, Role
| sort by Timestamp desc
| take 200