AvisLoader: Tox P2P Windows Loader

// HUNT: AvisLoader published SHA-256 hashes (78324.exe, auto.exe, hmn_hook.dll)
// MITRE: T1204.002, T1548.002, T1014
// CONF: high  FP: low  COST: low | REQUIRES: process creation and PE-write telemetry with SHA256HashData
// FALSE POSITIVES: none expected; the hashes are campaign specific (single origin: Varonis Threat Labs)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| in(field=SHA256HashData, values=["35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc", "f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975", "cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5"])
| table([@timestamp, aid, ComputerName, #event_simpleName, UserName, FileName, CommandLine, ParentBaseFileName, SHA256HashData])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.image.sha256 = *
| limit 5
| columns event.type, tgt.process.image.sha256, tgt.file.sha256

// HUNT: AvisLoader published SHA-256 hashes (78324.exe, auto.exe, hmn_hook.dll)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.002, T1548.002, T1014
// CONF: high | FP: low
// FALSE POSITIVES: none expected; the hashes are campaign specific (single origin: Varonis Threat Labs)
// EQUIVALENCE: equivalent-with-schema-assumptions - Same published SHA-256 set matched on a created process image (Process Creation) or a newly written file (File Creation). The CQL's executable-write population is approximated by File Creation.
// REQUIRES: SentinelOne process-creation and file-creation telemetry with SHA-256 populated
// TUNING: None expected: the hashes are campaign specific. Pair any hit with Q2 and Q8.
// LOOKBACK: 30d; the hashes are durable indicators
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A payload modified in place after an earlier write is seen only if the hash matches at process start.
// VALIDATION LEVEL: static-reviewed
(event.type = 'Process Creation' tgt.process.image.sha256 in ('35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc', 'f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975', 'cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5')) or (event.type = 'File Creation' tgt.file.sha256 in ('35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc', 'f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975', 'cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5'))
| sort -event.time
| limit 200
| columns event.time, endpoint.name, event.type, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.file.path, tgt.process.image.sha256, tgt.file.sha256

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, SHA256, FileName
| take 5

// HUNT: AvisLoader published SHA-256 hashes (78324.exe, auto.exe, hmn_hook.dll)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.002, T1548.002, T1014
// CONF: high | FP: low
// FALSE POSITIVES: none expected; the hashes are campaign specific (single origin: Varonis Threat Labs)
// EQUIVALENCE: telemetry-gap - Partial pivot: the same three SHA-256 values matched on process creation only. SHA256 is often unpopulated in DeviceProcessEvents and the CQL's executable-write half is not covered by one table.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) with SHA256 populated
// TUNING: None expected: the hashes are campaign specific. Pair any hit with Q2 and Q8.
// LOOKBACK: 30d (Advanced Hunting retention); the hashes are durable indicators
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Files written but never executed are not covered: that needs DeviceFileEvents, a second table. SHA256 is documented as usually not populated in DeviceProcessEvents; the source publishes no SHA1 to pivot on, so an empty result is not a clean result until the readiness test shows SHA256 is populated. The query covers 30 days (Advanced Hunting retention); the CQL tab covers the full retention of the Falcon tenant.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where SHA256 in~ ("35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc", "f0a6870cb774a55775eda15fd39e8a17eb3169d5b9365186dae8edff07ff3975", "cd1e835f52e5f55279dcdf3857e11bc9298ea6caa88eb214ea2d40ff5d38b5f5")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: AvisLoader bundled filenames (execution or write)
// MITRE: T1548.002, T1014
// CONF: medium  FP: medium  COST: low | REQUIRES: process creation and PE-write telemetry
// FALSE POSITIVES: auto.exe is a generic name; unrelated software and installers use it
// TUNING: pair every auto.exe hit with Q1 (hash) or Q8 (dllhost child); exclude signed vendor installs with | ImageFileName!=/REPLACE_WITH_APPROVED_VENDOR_PATH/i
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| FileName=/^(auto\.exe|hmn_hook\.dll|78324\.exe)$/i
| table([@timestamp, aid, ComputerName, #event_simpleName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])
| sort(@timestamp, order=desc)

event.type = 'File Creation' tgt.file.path = *
| limit 5
| columns event.type, tgt.process.name, tgt.file.path

// HUNT: AvisLoader bundled filenames (execution or write)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1548.002, T1014
// CONF: medium | FP: medium
// FALSE POSITIVES: auto.exe is a generic name; unrelated software and installers use it
// EQUIVALENCE: equivalent-with-schema-assumptions - Same three artifact names matched case-insensitively on a created process name (Process Creation) or on the last segment of a written file path (File Creation).
// REQUIRES: SentinelOne process-creation and file-creation telemetry
// TUNING: Pair every auto.exe hit with Q1 (hash) or Q8 (dllhost child); exclude signed vendor installs by image path after a baseline review.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: auto.exe is a generic name, so unrelated installers can match; the hash in Q1 is the confirming pivot.
// VALIDATION LEVEL: static-reviewed
(event.type = 'Process Creation' tgt.process.name in:anycase ('auto.exe', 'hmn_hook.dll', '78324.exe')) or (event.type = 'File Creation' tgt.file.path matches '(^|[^A-Za-z0-9_.-])(auto\\.exe|hmn_hook\\.dll|78324\\.exe)$')
| sort -event.time
| limit 200
| columns event.time, endpoint.name, event.type, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.file.path, tgt.process.image.sha256, tgt.file.sha256

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, FileName
| take 5

// HUNT: AvisLoader bundled filenames (execution or write)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1548.002, T1014
// CONF: medium | FP: medium
// FALSE POSITIVES: auto.exe is a generic name; unrelated software and installers use it
// EQUIVALENCE: approximate-analytic - Same three artifact names matched on written files in DeviceFileEvents. The CQL also matches the name of a started process, which needs DeviceProcessEvents, a second table.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: Pair every auto.exe hit with Q1 (hash) or Q8 (dllhost child); exclude signed vendor installs by FolderPath after a baseline review.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A copy of auto.exe or 78324.exe that is started without the sensor having seen it written is not caught here; the CQL and PowerQuery tabs cover process names.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(7d)
| where ActionType in ("FileCreated", "FileModified")
| where FileName in~ ("auto.exe", "hmn_hook.dll", "78324.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: command shell or downloader whose command line references trycloudflare.com
// MITRE: T1204.004, T1105
// CONF: high  FP: low  COST: low | REQUIRES: process creation with command line
// FALSE POSITIVES: developers demoing a tunnel with curl or PowerShell
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/trycloudflare\.com/i
| FileName=/^(powershell|pwsh|cmd|mshta|curl|wget|certutil|bitsadmin|wscript|cscript|msiexec|rundll32|regsvr32)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.type, tgt.process.name, tgt.process.cmdline

// HUNT: command shell or downloader whose command line references trycloudflare.com
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.004, T1105
// CONF: high | FP: low
// FALSE POSITIVES: developers demoing a tunnel with curl or PowerShell
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a shell, script host or downloader whose command line references trycloudflare.com. contains is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation telemetry with command line
// TUNING: Exclude developer hosts that demo tunnels on purpose by endpoint.name after a baseline review.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A tunnel host split across variables or encoded in the command line is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('powershell.exe', 'pwsh.exe', 'cmd.exe', 'mshta.exe', 'curl.exe', 'wget.exe', 'certutil.exe', 'bitsadmin.exe', 'wscript.exe', 'cscript.exe', 'msiexec.exe', 'rundll32.exe', 'regsvr32.exe') tgt.process.cmdline contains 'trycloudflare.com'
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.process.image.sha256

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: command shell or downloader whose command line references trycloudflare.com
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.004, T1105
// CONF: high | FP: low
// FALSE POSITIVES: developers demoing a tunnel with curl or PowerShell
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a shell, script host or downloader whose command line references trycloudflare.com. contains is case-insensitive, which reproduces the CQL /i intent. The creator is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude developer hosts that demo tunnels on purpose by DeviceName after a baseline review.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A tunnel host split across variables or encoded in the command line is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "mshta.exe", "curl.exe", "wget.exe", "certutil.exe", "bitsadmin.exe", "wscript.exe", "cscript.exe", "msiexec.exe", "rundll32.exe", "regsvr32.exe")
| where ProcessCommandLine contains "trycloudflare.com"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: non-browser process resolving a Cloudflare Quick Tunnel host
// MITRE: T1105, T1071
// CONF: medium  FP: medium  COST: low | REQUIRES: DNS request telemetry with the requesting process
// FALSE POSITIVES: developers and IT staff using cloudflared or quick tunnels on purpose
// TUNING: exclude approved tunnel users by host group with | ComputerName!=/^REPLACE_WITH_DEV_HOST_PREFIX/i
#event_simpleName=DnsRequest
| DomainName=/(^|\.)trycloudflare\.com$/i
| ContextBaseFileName!=/^(chrome|msedge|firefox|brave|opera|vivaldi|cloudflared)\.exe$/i
| groupBy([aid, ComputerName, ContextBaseFileName, DomainName], function=[count(as=Lookups), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])
| sort(Lookups, order=desc)

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.type, event.dns.request, src.process.name

// HUNT: non-browser process resolving a Cloudflare Quick Tunnel host
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1105, T1071
// CONF: medium | FP: medium
// FALSE POSITIVES: developers and IT staff using cloudflared or quick tunnels on purpose
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: lookups of trycloudflare.com or any subdomain by a process that is not a browser or cloudflared, counted per host, process and name with first and last seen.
// REQUIRES: SentinelOne DNS telemetry (DNS Resolved) with the requesting process
// TUNING: Exclude approved tunnel users by endpoint.name prefix after a baseline review.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A lookup with no attributed process is included, because a null process name is not excluded by the negated list.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' event.dns.request matches '(^|\\.)trycloudflare\\.com$' !(src.process.name in:anycase ('chrome.exe', 'msedge.exe', 'firefox.exe', 'brave.exe', 'opera.exe', 'vivaldi.exe', 'cloudflared.exe'))
| group lookups = count(), first_seen = min(event.time), last_seen = max(event.time) by agent.uuid, endpoint.name, src.process.name, event.dns.request
| sort -lookups
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields, InitiatingProcessFileName
| take 5

// HUNT: non-browser process resolving a Cloudflare Quick Tunnel host
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1105, T1071
// CONF: medium | FP: medium
// FALSE POSITIVES: developers and IT staff using cloudflared or quick tunnels on purpose
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate on DeviceEvents DnsQueryResponse: lookups of trycloudflare.com or any subdomain by a process that is not a browser or cloudflared. The query name is read from AdditionalFields.
// REQUIRES: Defender for Endpoint DNS action telemetry (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: Exclude approved tunnel users by DeviceName prefix after a baseline review.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A DNS lookup whose initiating process the sensor could not attribute is included, not excluded.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "DnsQueryResponse"
| extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where DnsName matches regex @"(?i)(^|\.)trycloudflare\.com$"
| where not(InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe", "vivaldi.exe", "cloudflared.exe"))
| summarize Lookups = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName, InitiatingProcessFileName, DnsName
| sort by Lookups desc
| take 200

// HUNT: Run-dialog or terminal paste launching a downloader one-liner (ClickFix)
// MITRE: T1204.004, T1059.001
// CONF: medium  FP: medium  COST: medium | REQUIRES: process creation with command line and parent
// FALSE POSITIVES: admins running one-liners from the Run dialog; some software updaters
// TUNING: exclude known admin hosts and signed updater commands with | CommandLine!=/REPLACE_WITH_APPROVED_COMMAND_FRAGMENT/i
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(explorer|WindowsTerminal|wt)\.exe$/i
| FileName=/^(powershell|pwsh|cmd|mshta)\.exe$/i
| CommandLine=/(iex|invoke-expression|irm |iwr |invoke-restmethod|invoke-webrequest|downloadstring|curl |mshta +https?:|-enc |-encodedcommand|https?:)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.type, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: Run-dialog or terminal paste launching a downloader one-liner (ClickFix)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.004, T1059.001
// CONF: medium | FP: medium
// FALSE POSITIVES: admins running one-liners from the Run dialog; some software updaters
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a PowerShell, cmd or mshta process started by explorer.exe, Windows Terminal or wt.exe whose command line carries a download-and-run marker. matches is case-insensitive, which reproduces the CQL /i intent. The creator is src.process.name.
// REQUIRES: SentinelOne process-creation telemetry with command line and creator
// TUNING: Exclude known admin hosts and signed updater command fragments after a baseline review.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The https? marker is broad, so any URL on the command line from an explorer-launched shell matches; expect admin and updater noise.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name in:anycase ('explorer.exe', 'WindowsTerminal.exe', 'wt.exe') tgt.process.name in:anycase ('powershell.exe', 'pwsh.exe', 'cmd.exe', 'mshta.exe') tgt.process.cmdline matches '(iex|invoke-expression|irm |iwr |invoke-restmethod|invoke-webrequest|downloadstring|curl |mshta +https?:|-enc |-encodedcommand|https?:)'
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName, ProcessCommandLine
| take 5

// HUNT: Run-dialog or terminal paste launching a downloader one-liner (ClickFix)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.004, T1059.001
// CONF: medium | FP: medium
// FALSE POSITIVES: admins running one-liners from the Run dialog; some software updaters
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a PowerShell, cmd or mshta process started by explorer.exe, Windows Terminal or wt.exe whose command line carries a download-and-run marker. The creator is InitiatingProcessFileName and the (?i) prefix reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude known admin hosts and signed updater command fragments after a baseline review.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The https? marker is broad, so any URL on the command line from an explorer-launched shell matches; expect admin and updater noise.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName in~ ("explorer.exe", "WindowsTerminal.exe", "wt.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "mshta.exe")
| where ProcessCommandLine matches regex @"(?i)(iex|invoke-expression|irm |iwr |invoke-restmethod|invoke-webrequest|downloadstring|curl |mshta +https?:|-enc |-encodedcommand|https?:)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: VLCAssistant VBScript launcher / shortcut-persistence name in any command line
// MITRE: T1547.009, T1059.005
// CONF: high  FP: low  COST: low | REQUIRES: process creation with command line
// FALSE POSITIVES: a legitimately named VLC helper script, which Varonis does not describe
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/VLCAssistant/i or ImageFileName=/VLCAssistant/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.type, tgt.process.cmdline, tgt.process.image.path

// HUNT: VLCAssistant VBScript launcher / shortcut-persistence name in any command line
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1547.009, T1059.005
// CONF: high | FP: low
// FALSE POSITIVES: a legitimately named VLC helper script, which Varonis does not describe
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the string VLCAssistant in the created process command line or its image path. contains is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation telemetry with command line and image path
// TUNING: None expected: the string is campaign specific. Review any hit that is not a script host.
// LOOKBACK: 30d; the launcher persists across reboots
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A shortcut that exists on disk but has not launched since the sensor was installed produces no process event.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' (tgt.process.cmdline contains 'VLCAssistant' or tgt.process.image.path contains 'VLCAssistant')
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine, FolderPath
| take 5

// HUNT: VLCAssistant VBScript launcher / shortcut-persistence name in any command line
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1547.009, T1059.005
// CONF: high | FP: low
// FALSE POSITIVES: a legitimately named VLC helper script, which Varonis does not describe
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the string VLCAssistant in the created process command line or its image path. contains is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected: the string is campaign specific. Review any hit that is not a script host.
// LOOKBACK: 30d (Advanced Hunting retention); the launcher persists across reboots
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A shortcut that exists on disk but has not launched since the sensor was installed produces no process event. The query covers 30 days (Advanced Hunting retention); the CQL tab covers the full retention of the Falcon tenant.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine contains "VLCAssistant" or FolderPath contains "VLCAssistant"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: wscript/cscript run a .vbs from a user-writable path with explorer as parent (shortcut-launcher shape)
// MITRE: T1547.009, T1059.005
// CONF: medium  FP: medium  COST: low | REQUIRES: process creation with command line and parent
// FALSE POSITIVES: logon scripts and IT tooling that launch .vbs from a profile or ProgramData
// TUNING: exclude known script paths with | CommandLine!=/REPLACE_WITH_APPROVED_SCRIPT_PATH/i
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^explorer\.exe$/i
| FileName=/^(wscript|cscript)\.exe$/i
| CommandLine=/\.vbs/i
| CommandLine=/\\(AppData|ProgramData|Users\\Public|Temp)\\/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.type, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: wscript/cscript run a .vbs from a user-writable path with explorer as parent (shortcut-launcher shape)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1547.009, T1059.005
// CONF: medium | FP: medium
// FALSE POSITIVES: logon scripts and IT tooling that launch .vbs from a profile or ProgramData
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: wscript or cscript started by explorer.exe with a .vbs argument and a user-writable folder (AppData, ProgramData, Users\Public or Temp) in the command line. The creator is src.process.name; matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation telemetry with command line and creator
// TUNING: Exclude known logon-script paths after a baseline review.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A script launched with a relative path, so the folder never appears on the command line, is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name in:anycase ('explorer.exe') tgt.process.name in:anycase ('wscript.exe', 'cscript.exe') tgt.process.cmdline contains '.vbs' tgt.process.cmdline matches '\\\\(AppData|ProgramData|Users\\\\Public|Temp)\\\\'
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName, ProcessCommandLine
| take 5

// HUNT: wscript/cscript run a .vbs from a user-writable path with explorer as parent (shortcut-launcher shape)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1547.009, T1059.005
// CONF: medium | FP: medium
// FALSE POSITIVES: logon scripts and IT tooling that launch .vbs from a profile or ProgramData
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: wscript or cscript started by explorer.exe with a .vbs argument and a user-writable folder (AppData, ProgramData, Users\Public or Temp) in the command line. The creator is InitiatingProcessFileName; contains is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude known logon-script paths after a baseline review.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A script launched with a relative path, so the folder never appears on the command line, is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("wscript.exe", "cscript.exe")
| where ProcessCommandLine contains ".vbs"
| where ProcessCommandLine contains "\\AppData\\" or ProcessCommandLine contains "\\ProgramData\\" or ProcessCommandLine contains "\\Users\\Public\\" or ProcessCommandLine contains "\\Temp\\"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: shell or script host spawned by dllhost.exe, the COM surrogate abused by ICMLuaUtil elevation
// MITRE: T1548.002
// CONF: medium  FP: medium  COST: low | REQUIRES: process creation with parent
// NOTE: Varonis ties auto.exe to COM class 3E5FC7F9-9A51-4367-9063-A120244FBEC7 and says successful elevation was not confirmed
// FALSE POSITIVES: installers and management tools that elevate through COM surrogates
// TUNING: exclude known management parents or signed installers with | ComputerName!=/^REPLACE_WITH_ADMIN_HOST_PREFIX/i
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^dllhost\.exe$/i
| FileName=/^(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|auto)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' src.process.name = * tgt.process.name = *
| limit 5
| columns event.type, src.process.name, tgt.process.name

// HUNT: shell or script host spawned by dllhost.exe, the COM surrogate abused by ICMLuaUtil elevation
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1548.002
// CONF: medium | FP: medium
// FALSE POSITIVES: installers and management tools that elevate through COM surrogates
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a shell, script host or auto.exe started by dllhost.exe. The creator is src.process.name; the query does not test whether the child is elevated, as the CQL does not.
// REQUIRES: SentinelOne process-creation telemetry with creator
// TUNING: Exclude known management hosts and signed installers by endpoint.name after a baseline review.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Elevation is not tested: the query finds the spawn, not whether the child holds a high integrity token.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name in:anycase ('dllhost.exe') tgt.process.name in:anycase ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe', 'rundll32.exe', 'regsvr32.exe', 'auto.exe')
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.process.image.sha256

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName
| take 5

// HUNT: shell or script host spawned by dllhost.exe, the COM surrogate abused by ICMLuaUtil elevation
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1548.002
// CONF: medium | FP: medium
// FALSE POSITIVES: installers and management tools that elevate through COM surrogates
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a shell, script host or auto.exe started by dllhost.exe. The creator is InitiatingProcessFileName; the query does not test whether the child is elevated, as the CQL does not.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude known management hosts and signed installers by DeviceName after a baseline review.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Elevation is not tested: the query finds the spawn, not whether the child holds a high integrity token.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName =~ "dllhost.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "auto.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: executable named only with digits (78324.exe pattern) running from a user-writable folder
// MITRE: T1204.002, T1036
// CONF: medium  FP: medium  COST: low | REQUIRES: process creation with image path
// FALSE POSITIVES: temp-named installers and updaters
// TUNING: exclude signed installer parents with | ParentBaseFileName!=/^(msiexec|setup)\.exe$/i
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^[0-9]{3,8}\.exe$/i
| ImageFileName=/\\(Users|ProgramData|Windows\\Temp)\\/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.image.path = *
| limit 5
| columns event.type, tgt.process.name, tgt.process.image.path

// HUNT: executable named only with digits (78324.exe pattern) running from a user-writable folder
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.002, T1036
// CONF: medium | FP: medium
// FALSE POSITIVES: temp-named installers and updaters
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: an executable named with only three to eight digits whose image path sits under Users, ProgramData or Windows\Temp. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation telemetry with image path
// TUNING: Exclude signed installer parents by src.process.name after a baseline review.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Temp-named installers and updaters match; use Q1 or Q2 to confirm.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name matches '^[0-9]{3,8}\\.exe$' tgt.process.image.path matches '\\\\(Users|ProgramData|Windows\\\\Temp)\\\\'
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha256

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath
| take 5

// HUNT: executable named only with digits (78324.exe pattern) running from a user-writable folder
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.002, T1036
// CONF: medium | FP: medium
// FALSE POSITIVES: temp-named installers and updaters
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: an executable named with only three to eight digits whose image path sits under Users, ProgramData or Windows\Temp. The (?i) prefix reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude signed installer parents by InitiatingProcessFileName after a baseline review.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Temp-named installers and updaters match; use Q1 or Q2 to confirm.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName matches regex @"(?i)^[0-9]{3,8}\.exe$"
| where FolderPath matches regex @"(?i)\\(Users|ProgramData|Windows\\Temp)\\"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: outbound connections to port 33445, the default Tox bootstrap port (analyst knowledge, NOT in the Varonis report)
// MITRE: T1071
// CONF: medium  FP: low  COST: low | REQUIRES: network connection telemetry with the owning process
// FALSE POSITIVES: people running a Tox chat client on purpose
// NOTE: Tox is encrypted P2P and can use other ports; absence of hits proves nothing
#event_simpleName=NetworkConnectIP4
| RemotePort=33445
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8"])
| groupBy([aid, ComputerName, ContextBaseFileName, RemotePort], function=[count(as=Connections), count(RemoteAddressIP4, distinct=true, as=DistinctPeers), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])
| sort(Connections, order=desc)

event.type = 'IP Connect' dst.port.number = * dst.ip.address = *
| limit 5
| columns event.type, dst.port.number, dst.ip.address

// HUNT: outbound connections to port 33445, the default Tox bootstrap port (analyst knowledge, NOT in the Varonis report)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071
// CONF: medium | FP: low
// FALSE POSITIVES: people running a Tox chat client on purpose
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate: outbound connections to destination port 33445 where the destination is not RFC 1918 or loopback, counted per host, process and port with first and last seen and the number of distinct peers.
// REQUIRES: SentinelOne network telemetry (IP Connect) with the owning process
// TUNING: Exclude hosts where a Tox client is sanctioned by endpoint.name after a baseline review. Tox can use other ports, so an empty result proves nothing.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Tox peers on other ports are not seen; this indicator is analyst knowledge and is not in the source report.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' dst.port.number = 33445 !(net_rfc1918(dst.ip.address)) !(net_ipsubnet(dst.ip.address, '127.0.0.0/8'))
| group connections = count(), distinct_peers = estimate_distinct(dst.ip.address), first_seen = min(event.time), last_seen = max(event.time) by agent.uuid, endpoint.name, src.process.name, dst.port.number
| sort -connections
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, RemotePort, RemoteIPType
| take 5

// HUNT: outbound connections to port 33445, the default Tox bootstrap port (analyst knowledge, NOT in the Varonis report)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071
// CONF: medium | FP: low
// FALSE POSITIVES: people running a Tox chat client on purpose
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate: outbound connections to remote port 33445 where the remote address is public, counted per host, process and port with first and last seen and the number of distinct peers. RemoteIPType replaces the CQL subnet exclusions.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Exclude hosts where a Tox client is sanctioned by DeviceName after a baseline review. Tox can use other ports, so an empty result proves nothing.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Tox peers on other ports are not seen; this indicator is analyst knowledge and is not in the source report. RemoteIPType Public excludes link-local and carrier-grade NAT addresses, which the CQL treats as external.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where ActionType in ("ConnectionSuccess", "ConnectionFailed", "ConnectionRequest")
| where RemotePort == 33445
| where RemoteIPType == "Public"
| summarize Connections = count(), DistinctPeers = dcount(RemoteIP), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName, InitiatingProcessFileName, RemotePort
| sort by Connections desc
| take 200

// HUNT: single non-browser process connecting to many distinct public IPs on one port (P2P fan-out)
// MITRE: T1071
// CONF: low  FP: high  COST: medium | REQUIRES: network connection telemetry with the owning process
// FALSE POSITIVES: torrent, VoIP, game, backup and CDN clients; this is a weak heuristic
// TUNING: exclude known P2P-like software with | ContextBaseFileName!=/^(Teams|Zoom|Slack|OneDrive|Dropbox|Steam)\.exe$/i and baseline per host group
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName!=/^(chrome|msedge|firefox|brave|opera|vivaldi|svchost)\.exe$/i
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16"])
| groupBy([aid, ComputerName, ContextBaseFileName, RemotePort], function=[count(RemoteAddressIP4, distinct=true, as=DistinctPeers), count(as=Connections)])
| test(DistinctPeers >= 15)
| sort(DistinctPeers, order=desc)

event.type = 'IP Connect' dst.ip.address = * src.process.name = *
| limit 5
| columns event.type, dst.ip.address, src.process.name, dst.port.number

// HUNT: single non-browser process connecting to many distinct public IPs on one port (P2P fan-out)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071
// CONF: low | FP: high
// FALSE POSITIVES: torrent, VoIP, game, backup and CDN clients; this is a weak heuristic
// EQUIVALENCE: approximate-analytic - Same fan-out analytic: a process that is not a browser or svchost connecting to fifteen or more distinct public addresses per host and port. The distinct count is estimate_distinct, an approximation, so rows near the threshold may differ from the CQL's exact count.
// REQUIRES: SentinelOne network telemetry (IP Connect) with the owning process
// TUNING: Exclude known P2P-like software (Teams, Zoom, Slack, OneDrive, Dropbox, Steam) by src.process.name and baseline per host group. This is a weak heuristic with a high false-positive rate.
// LOOKBACK: 1d; the threshold is a daily fan-out and grows with the window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: estimate_distinct is approximate, so counts near fifteen can differ from the CQL's exact distinct count.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' !(src.process.name in:anycase ('chrome.exe', 'msedge.exe', 'firefox.exe', 'brave.exe', 'opera.exe', 'vivaldi.exe', 'svchost.exe')) !(net_rfc1918(dst.ip.address)) !(net_ipsubnet(dst.ip.address, '127.0.0.0/8')) !(net_ipsubnet(dst.ip.address, '169.254.0.0/16'))
| group distinct_peers = estimate_distinct(dst.ip.address), connections = count() by agent.uuid, endpoint.name, src.process.name, dst.port.number
| filter distinct_peers >= 15
| sort -distinct_peers
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, RemoteIPType, InitiatingProcessFileName, RemoteIP, RemotePort
| take 5

// HUNT: single non-browser process connecting to many distinct public IPs on one port (P2P fan-out)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071
// CONF: low | FP: high
// FALSE POSITIVES: torrent, VoIP, game, backup and CDN clients; this is a weak heuristic
// EQUIVALENCE: approximate-analytic - Same fan-out analytic: a process that is not a browser or svchost connecting to fifteen or more distinct public addresses per host and port. RemoteIPType replaces the CQL subnet exclusions and dcount is an estimate.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Exclude known P2P-like software (Teams, Zoom, Slack, OneDrive, Dropbox, Steam) by InitiatingProcessFileName and baseline per host group. This is a weak heuristic with a high false-positive rate.
// LOOKBACK: 1d; the threshold is a daily fan-out and grows with the window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: dcount is approximate, so counts near fifteen can differ from the CQL's exact distinct count. RemoteIPType Public excludes link-local and carrier-grade NAT addresses, which the CQL treats as external.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(1d)
| where ActionType in ("ConnectionSuccess", "ConnectionFailed", "ConnectionRequest")
| where RemoteIPType == "Public"
| where not(InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe", "vivaldi.exe", "svchost.exe"))
| summarize DistinctPeers = dcount(RemoteIP), Connections = count() by DeviceId, DeviceName, InitiatingProcessFileName, RemotePort
| where DistinctPeers >= 15
| sort by DistinctPeers desc
| take 200