BeyondTrust Remote Support CVE-2026-102764: ARMORY CASTLE Zero-Day, SAWFLY and BARECLAW

// HUNT: BeyondTrust Remote Support agent inventory and process-name baseline
// MITRE: T1219
// CONF: low | FP: low | COST: medium | REQUIRES: ProcessRollup2 on Windows endpoints that run a Jump Client or customer client
// SOURCE: product naming convention, analyst-supplied (NOT in any cited source). Amend the agent pattern in Q2 to Q4 and Q7 from this output
// FALSE POSITIVES: none; this is an inventory, not an alert
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| (FileName=/^(bomgar|beyondtrust)[-_a-z0-9.]*\.exe$/i or ImageFileName=/\\(bomgar|beyondtrust)/i)
| groupBy([FileName, ImageFileName], function=[count(aid, distinct=true, as=Hosts), count(as=Execs)], limit=200)
| sort(Hosts, order=desc, limit=100)

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.image.path, agent.uuid

// HUNT: BeyondTrust Remote Support agent inventory and process-name baseline
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1219
// CONF: low | FP: low
// FALSE POSITIVES: none; this is an inventory, not an alert
// EQUIVALENCE: equivalent-with-schema-assumptions - Same inventory: processes whose name matches the BeyondTrust agent pattern, or whose image path has a directory or file component starting with that pattern, grouped by name and path with a distinct-host count. matches is case-insensitive, which reproduces the CQL /i intent. The created process is tgt.process on a Process Creation event.
// REQUIRES: SentinelOne process-creation telemetry with image path
// TUNING: Inventory only, not an alert. Review the names and paths, then amend the agent pattern used by the later queries.
// LOOKBACK: 30d; set the console time picker, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Processes already running when the sensor started (the CQL also reads the synthetic start-up event) are not in Process Creation events.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and (tgt.process.name matches '^(bomgar|beyondtrust)[-_a-z0-9.]*\\.exe$' or tgt.process.image.path matches '\\\\(bomgar|beyondtrust)')
| group execs=count(), hosts=estimate_distinct(agent.uuid) by tgt.process.name, tgt.process.image.path
| sort -hosts
| limit 100

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath, DeviceId
| take 5

// HUNT: BeyondTrust Remote Support agent inventory and process-name baseline
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1219
// CONF: low | FP: low
// FALSE POSITIVES: none; this is an inventory, not an alert
// EQUIVALENCE: equivalent-with-schema-assumptions - Same inventory: created processes whose name matches the BeyondTrust agent pattern, or whose path has a component starting with it, grouped by name and path with a distinct-device count. matches regex with (?i) reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Inventory only, not an alert. Review the names and paths, then amend the agent pattern used by the later queries.
// LOOKBACK: 30d (Advanced Hunting retention is 30 days; the CQL tab uses the same 30d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName matches regex @"(?i)^(bomgar|beyondtrust)[-_a-z0-9.]*\.exe$" or FolderPath matches regex @"(?i)\\(bomgar|beyondtrust)"
| summarize Execs = count(), Hosts = dcount(DeviceId), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by FileName, FolderPath
| sort by Hosts desc
| take 100

// HUNT: BeyondTrust agent spawns a shell, recon, download or archive tool
// MITRE: T1219 | T1059.003 | T1059.001 | T1082 | T1083 | T1105 | T1560.001
// CONF: medium | FP: medium | COST: low | REQUIRES: ProcessRollup2 with ParentBaseFileName and CommandLine; agent pattern validated with Q1
// FALSE POSITIVES: help desk console command shell, remote PowerShell and scripted fixes during a legitimate support session
// TUNING: baseline by ComputerName and CommandLine for 30 days, exclude your help desk's exact command lines, then reconcile each remaining hit with the appliance session report (who, when, Jump Item)
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(bomgar|beyondtrust)[-_a-z0-9.]*\.exe$/i
| FileName=/^(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|curl|wmic|nltest|net1?|whoami|systeminfo|ipconfig|tasklist|reg|arp|netstat|7z|7za|rar|tar)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid], limit=500)

event.type = 'Process Creation' src.process.name = *
| limit 5
| columns event.time, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: BeyondTrust agent spawns a shell, recon, download or archive tool
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1219, T1059.003, T1059.001, T1082, T1083, T1105, T1560.001
// CONF: medium | FP: medium
// FALSE POSITIVES: help desk console command shell, remote PowerShell and scripted fixes during a legitimate support session
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a shell, recon, download or archive tool created by a process matching the BeyondTrust agent pattern. The creator is src.process and the new process is tgt.process on a Process Creation event. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation telemetry with creator process name and command line; agent pattern validated with Q1
// TUNING: Baseline by host and command line for 30 days, exclude the help desk's exact command lines, then reconcile each remaining hit with the appliance session report (who, when, Jump Item).
// LOOKBACK: 7d; set the console time picker, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Help desk activity that goes through a different agent executable name than the pattern is not captured; widen the pattern from Q1.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and src.process.name matches '^(bomgar|beyondtrust)[-_a-z0-9.]*\\.exe$' and tgt.process.name matches '^(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|curl|wmic|nltest|net1?|whoami|systeminfo|ipconfig|tasklist|reg|arp|netstat|7z|7za|rar|tar)\\.exe$'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, agent.uuid
| sort -event.time
| limit 500

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName, ProcessCommandLine
| take 5

// HUNT: BeyondTrust agent spawns a shell, recon, download or archive tool
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1219, T1059.003, T1059.001, T1082, T1083, T1105, T1560.001
// CONF: medium | FP: medium
// FALSE POSITIVES: help desk console command shell, remote PowerShell and scripted fixes during a legitimate support session
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a shell, recon, download or archive tool created by a process matching the BeyondTrust agent pattern. The creator is InitiatingProcessFileName and the new process is FileName. matches regex with (?i) reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents); agent pattern validated with Q1
// TUNING: Baseline by device and command line for 30 days, exclude the help desk's exact command lines, then reconcile each remaining hit with the appliance session report (who, when, Jump Item).
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Help desk activity that goes through a different agent executable name than the pattern is not captured; widen the pattern from Q1.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName matches regex @"(?i)^(bomgar|beyondtrust)[-_a-z0-9.]*\.exe$"
| where FileName matches regex @"(?i)^(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|curl|wmic|nltest|net1?|whoami|systeminfo|ipconfig|tasklist|reg|arp|netstat|7z|7za|rar|tar)\.exe$"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 500

// HUNT: Support-session burst under the BeyondTrust agent (distinct tools per host per day)
// MITRE: T1219 | T1082 | T1083 | T1005
// CONF: medium | FP: medium | COST: low | REQUIRES: ProcessRollup2 with ParentBaseFileName; agent pattern validated with Q1
// FALSE POSITIVES: routine break-fix sessions that run several diagnostic commands
// TUNING: raise the distinct-tool threshold from 4 after a 30-day baseline, exclude known help desk endpoints by aid, and confirm each hit against the appliance session report
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(bomgar|beyondtrust)[-_a-z0-9.]*\.exe$/i
| FileName=/^(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|curl|wmic|nltest|net1?|whoami|systeminfo|ipconfig|tasklist|reg|arp|netstat|7z|7za|rar|tar)\.exe$/i
| Day := formatTime("%Y-%m-%d", field=@timestamp)
| groupBy([aid, ComputerName, Day], function=[count(FileName, distinct=true, as=DistinctTools), count(as=Execs), collect([FileName]), min(@timestamp, as=First), max(@timestamp, as=Last)], limit=500)
| test(DistinctTools >= 4)
| FirstSeen := formatTime("%Y-%m-%d %H:%M:%S", field=First)
| LastSeen := formatTime("%Y-%m-%d %H:%M:%S", field=Last)
| sort(DistinctTools, order=desc, limit=100)
| table([ComputerName, Day, DistinctTools, Execs, FileName, FirstSeen, LastSeen, aid], limit=100)

event.type = 'Process Creation' src.process.name = *
| limit 5
| columns event.time, agent.uuid, src.process.name, tgt.process.name

// HUNT: Support-session burst under the BeyondTrust agent (distinct tools per host per day)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1219, T1082, T1083, T1005
// CONF: medium | FP: medium
// FALSE POSITIVES: routine break-fix sessions that run several diagnostic commands
// EQUIVALENCE: approximate-analytic - Same burst analytic: four or more distinct tools created by the BeyondTrust agent on one host in one day. Two group stages give an exact distinct-tool count, but the CQL's collected list of tool names becomes a single example tool, and tool names are lower-cased before counting.
// REQUIRES: SentinelOne process-creation telemetry with creator process name; agent pattern validated with Q1
// TUNING: Raise the distinct-tool threshold from 4 after a 30-day baseline, exclude known help desk endpoints by agent.uuid, and confirm each hit against the appliance session report.
// LOOKBACK: 7d; set the console time picker, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The full list of tool names is not returned; example_tool shows one, so pull the rest with Q2 for the flagged host and day.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and src.process.name matches '^(bomgar|beyondtrust)[-_a-z0-9.]*\\.exe$' and tgt.process.name matches '^(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|curl|wmic|nltest|net1?|whoami|systeminfo|ipconfig|tasklist|reg|arp|netstat|7z|7za|rar|tar)\\.exe$'
| group execs=count(), t_first=min(event.time), t_last=max(event.time) by agent.uuid, endpoint.name, day_bucket=timebucket('1d'), tool=lower(tgt.process.name)
| group distinct_tools=count(), total_execs=sum(execs), example_tool=any(tool), first_seen=min(t_first), last_seen=max(t_last) by agent.uuid, endpoint.name, day_bucket
| filter distinct_tools >= 4
| sort -distinct_tools
| limit 100

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceId, InitiatingProcessFileName, FileName
| take 5

// HUNT: Support-session burst under the BeyondTrust agent (distinct tools per host per day)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1219, T1082, T1083, T1005
// CONF: medium | FP: medium
// FALSE POSITIVES: routine break-fix sessions that run several diagnostic commands
// EQUIVALENCE: equivalent-with-schema-assumptions - Same burst analytic: four or more distinct tools created by the BeyondTrust agent on one device in one day, with the tool names collected. Names are lower-cased before counting and dcount is an estimate.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents); agent pattern validated with Q1
// TUNING: Raise the distinct-tool threshold from 4 after a 30-day baseline, exclude known help desk devices by DeviceId, and confirm each hit against the appliance session report.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A burst split across two UTC days can fall under the threshold on both.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName matches regex @"(?i)^(bomgar|beyondtrust)[-_a-z0-9.]*\.exe$"
| where FileName matches regex @"(?i)^(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|curl|wmic|nltest|net1?|whoami|systeminfo|ipconfig|tasklist|reg|arp|netstat|7z|7za|rar|tar)\.exe$"
| summarize DistinctTools = dcount(tolower(FileName)), Execs = count(), Tools = make_set(tolower(FileName)), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName, Day = bin(Timestamp, 1d)
| where DistinctTools >= 4
| sort by DistinctTools desc
| take 100

// HUNT: BeyondTrust agent outbound destinations (appliance discovery and rogue-destination check)
// MITRE: T1219 | T1071.001
// CONF: low | FP: low | COST: low | REQUIRES: NetworkConnectIP4 with ContextBaseFileName; agent pattern validated with Q1
// SOURCE: baseline and discovery query; no indicator is asserted
// FALSE POSITIVES: none; this lists destinations for review
// LOOKBACK: 30d
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^(bomgar|beyondtrust)[-_a-z0-9.]*\.exe$/i
| groupBy([RemoteAddressIP4, RemotePort], function=[count(aid, distinct=true, as=Hosts), count(as=Conns), min(@timestamp, as=First), max(@timestamp, as=Last)], limit=200)
| FirstSeen := formatTime("%Y-%m-%d %H:%M:%S", field=First)
| LastSeen := formatTime("%Y-%m-%d %H:%M:%S", field=Last)
| sort(Hosts, order=asc, limit=100)
| table([RemoteAddressIP4, RemotePort, Hosts, Conns, FirstSeen, LastSeen], limit=100)

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.time, agent.uuid, src.process.name, dst.ip.address, dst.port.number

// HUNT: BeyondTrust agent outbound destinations (appliance discovery and rogue-destination check)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1219, T1071.001
// CONF: low | FP: low
// FALSE POSITIVES: none; this lists destinations for review
// EQUIVALENCE: equivalent-with-schema-assumptions - Same discovery: outbound connections made by a process matching the BeyondTrust agent pattern, grouped by remote address and port with a distinct-host count, rarest destinations first. On an IP Connect event the acting process is src.process.
// REQUIRES: SentinelOne IP Connect telemetry with the acting process name; agent pattern validated with Q1
// TUNING: Discovery query, no indicator is asserted. Record the appliance address and port, then review every destination seen on few hosts.
// LOOKBACK: 30d; set the console time picker, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connections made through a proxy show the proxy address, not the appliance.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' and src.process.name matches '^(bomgar|beyondtrust)[-_a-z0-9.]*\\.exe$' and dst.ip.address = *
| group conns=count(), hosts=estimate_distinct(agent.uuid), first_seen=min(event.time), last_seen=max(event.time) by dst.ip.address, dst.port.number
| sort +hosts
| limit 100

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceId, InitiatingProcessFileName, ActionType, RemoteIP, RemotePort
| take 5

// HUNT: BeyondTrust agent outbound destinations (appliance discovery and rogue-destination check)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1219, T1071.001
// CONF: low | FP: low
// FALSE POSITIVES: none; this lists destinations for review
// EQUIVALENCE: equivalent-with-schema-assumptions - Same discovery: outbound connections made by a process matching the BeyondTrust agent pattern, grouped by remote address and port with a distinct-device count, rarest destinations first. Only successful connections are listed.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Discovery query, no indicator is asserted. Record the appliance address and port, then review every destination seen on few devices.
// LOOKBACK: 30d (Advanced Hunting retention is 30 days; the CQL tab uses the same 30d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Failed connection attempts are not listed. Connections made through a proxy show the proxy address, not the appliance.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where ActionType == "ConnectionSuccess"
| where InitiatingProcessFileName matches regex @"(?i)^(bomgar|beyondtrust)[-_a-z0-9.]*\.exe$"
| summarize Conns = count(), Hosts = dcount(DeviceId), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by RemoteIP, RemotePort
| sort by Hosts asc
| take 100

// HUNT: Endpoint accepts a connection from the BeyondTrust appliance address (SOCKS5 pivot)
// MITRE: T1090 | T1572 | T1021
// CONF: medium | FP: medium | COST: low | REQUIRES: NetworkReceiveAcceptIP4 with RemoteAddressIP4 (policy dependent; validate in tenant). EDIT THE PLACEHOLDER FIRST
// SOURCE: Mandiant GTIG BARECLAW description (SOCKS5 over WebSocket relays TCP connections); the appliance address is YOURS, not a published indicator
// FALSE POSITIVES: appliance integrations with directory, mail, syslog and ITSM servers
// TUNING: exclude the integration servers by aid or by LocalPort (for example the directory and syslog ports you allow from the appliance); investigate every other host
// LOOKBACK: 30d
#event_simpleName=NetworkReceiveAcceptIP4
| in(field="RemoteAddressIP4", values=["REPLACE_WITH_APPLIANCE_IP"])
| table([@timestamp, ComputerName, LocalAddressIP4, LocalPort, RemoteAddressIP4, RemotePort, aid], limit=500)

event.type = 'IP Connect' event.network.direction = 'INCOMING'
| limit 5
| columns event.time, event.network.direction, src.ip.address, dst.port.number

// HUNT: Endpoint accepts a connection from the BeyondTrust appliance address (SOCKS5 pivot)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1090, T1572, T1021
// CONF: medium | FP: medium
// FALSE POSITIVES: appliance integrations with directory, mail, syslog and ITSM servers
// EQUIVALENCE: approximate-analytic - The CQL reads the sensor's accepted-inbound-connection event. SentinelOne has no event of that name, so this reads IP Connect events whose direction is INCOMING and whose source address is the appliance address. The direction field is documented but not attested in shipped queries.
// REQUIRES: SentinelOne IP Connect telemetry with inbound direction (policy dependent; validate in the tenant). Replace REPLACE_WITH_APPLIANCE_IP with the appliance address before running
// TUNING: Exclude the integration servers by agent.uuid or by dst.port.number (for example the directory and syslog ports you allow from the appliance); investigate every other host.
// LOOKBACK: 30d; set the console time picker, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Inbound connections are only recorded when the policy collects them; an empty result is not proof of absence. Direction and peer-address semantics on inbound events are not verified on a tenant.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' and event.network.direction = 'INCOMING' and src.ip.address in ('REPLACE_WITH_APPLIANCE_IP')
| columns event.time, endpoint.name, dst.ip.address, dst.port.number, src.ip.address, src.port.number, src.process.name, agent.uuid
| sort -event.time
| limit 500

DeviceNetworkEvents
| where Timestamp > ago(1d)
| where ActionType == "InboundConnectionAccepted"
| project Timestamp, ActionType, RemoteIP, LocalPort
| take 5

// HUNT: Endpoint accepts a connection from the BeyondTrust appliance address (SOCKS5 pivot)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1090, T1572, T1021
// CONF: medium | FP: medium
// FALSE POSITIVES: appliance integrations with directory, mail, syslog and ITSM servers
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an accepted inbound connection whose remote address is the appliance address, read from DeviceNetworkEvents InboundConnectionAccepted.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents) with inbound events (policy dependent; validate in the tenant). Replace REPLACE_WITH_APPLIANCE_IP with the appliance address before running
// TUNING: Exclude the integration servers by DeviceId or by LocalPort (for example the directory and syslog ports you allow from the appliance); investigate every other device.
// LOOKBACK: 30d (Advanced Hunting retention is 30 days; the CQL tab uses the same 30d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Inbound events are not recorded on every sensor configuration; an empty result is not proof of absence.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where ActionType == "InboundConnectionAccepted"
| where RemoteIP in ("REPLACE_WITH_APPLIANCE_IP")
| project Timestamp, ReportId, DeviceId, DeviceName, LocalIP, LocalPort, RemoteIP, RemotePort, InitiatingProcessFileName
| sort by Timestamp desc
| take 500

// HUNT: Network or remote-interactive logon sourced from the BeyondTrust appliance address
// MITRE: T1078 | T1021 | T1090
// CONF: medium | FP: medium | COST: low | REQUIRES: UserLogon with RemoteAddressIP4 and LogonType. EDIT THE PLACEHOLDER FIRST
// SOURCE: Mandiant GTIG (credential vault access and SOCKS5 tunnel); the appliance address is YOURS, not a published indicator
// FALSE POSITIVES: appliance service accounts used for directory lookups and integrations
// TUNING: exclude the appliance's own integration UserName values once each has a named owner; investigate every other account
// LOOKBACK: 30d
#event_simpleName=UserLogon
| LogonType=/^(3|10)$/
| in(field="RemoteAddressIP4", values=["REPLACE_WITH_APPLIANCE_IP"])
| table([@timestamp, ComputerName, UserName, LogonType, RemoteAddressIP4, aid], limit=500)

event.type = 'Login' src.endpoint.ip.address = *
| limit 5
| columns event.time, event.login.type, event.login.loginIsSuccessful, src.endpoint.ip.address

// HUNT: Network or remote-interactive logon sourced from the BeyondTrust appliance address
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1078, T1021, T1090
// CONF: medium | FP: medium
// FALSE POSITIVES: appliance service accounts used for directory lookups and integrations
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a successful network or remote-interactive logon whose source address is the appliance address. CQL logon types 3 and 10 map to NETWORK and REMOTE_INTERACTIVE. The source address field is documented but not attested in shipped queries.
// REQUIRES: SentinelOne Login telemetry with the source endpoint address. Replace REPLACE_WITH_APPLIANCE_IP with the appliance address before running
// TUNING: Exclude the appliance's own integration account names once each has a named owner; investigate every other account.
// LOOKBACK: 30d; set the console time picker, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A cached or unlock logon type (CACHED_REMOTE_INTERACTIVE) is not included, as in the CQL. If src.endpoint.ip.address is not populated on the tenant the query returns nothing.
// VALIDATION LEVEL: static-reviewed
event.type = 'Login' and event.login.type in ('NETWORK', 'REMOTE_INTERACTIVE') and event.login.loginIsSuccessful = true and src.endpoint.ip.address in ('REPLACE_WITH_APPLIANCE_IP')
| columns event.time, endpoint.name, event.login.userName, event.login.type, src.endpoint.ip.address, agent.uuid
| sort -event.time
| limit 500

DeviceLogonEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, LogonType, RemoteIP
| take 5

// HUNT: Network or remote-interactive logon sourced from the BeyondTrust appliance address
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1078, T1021, T1090
// CONF: medium | FP: medium
// FALSE POSITIVES: appliance service accounts used for directory lookups and integrations
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a successful network or remote-interactive logon whose source address is the appliance address. CQL logon types 3 and 10 map to Network and RemoteInteractive.
// REQUIRES: Defender for Endpoint logon telemetry (DeviceLogonEvents). Replace REPLACE_WITH_APPLIANCE_IP with the appliance address before running
// TUNING: Exclude the appliance's own integration account names once each has a named owner; investigate every other account.
// LOOKBACK: 30d (Advanced Hunting retention is 30 days; the CQL tab uses the same 30d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: RemoteIP is empty on some logons, which the predicate cannot match.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceLogonEvents
| where Timestamp >= ago(30d)
| where ActionType == "LogonSuccess"
| where LogonType in~ ("Network", "RemoteInteractive")
| where RemoteIP in ("REPLACE_WITH_APPLIANCE_IP")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, LogonType, RemoteIP
| sort by Timestamp desc
| take 500

// HUNT: Executable or archive written by the BeyondTrust agent process
// MITRE: T1219 | T1105 | T1570
// CONF: low | FP: medium | COST: low | REQUIRES: PeFileWritten, NewExecutableWritten, ZipFileWritten with ContextBaseFileName; agent pattern validated with Q1
// SOURCE: general remote-support abuse coverage; NOT observed in the ARMORY CASTLE reporting (snapshot 01 describes downloads FROM endpoints)
// FALSE POSITIVES: help desk software pushes and scripted fixes delivered through a session
// TUNING: exclude sanctioned deployment folders by TargetFileName and reconcile remaining hits with the appliance session report
// LOOKBACK: 7d
#event_simpleName=/^(PeFileWritten|NewExecutableWritten|ZipFileWritten)$/
| ContextBaseFileName=/^(bomgar|beyondtrust)[-_a-z0-9.]*\.exe$/i
| table([@timestamp, ComputerName, #event_simpleName, ContextBaseFileName, TargetFileName, SHA256HashData, aid], limit=500)

event.type = 'File Creation' tgt.file.path = *
| limit 5
| columns event.time, src.process.name, tgt.file.path

// HUNT: Executable or archive written by the BeyondTrust agent process
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1219, T1105, T1570
// CONF: low | FP: medium
// FALSE POSITIVES: help desk software pushes and scripted fixes delivered through a session
// EQUIVALENCE: approximate-analytic - The CQL reads the sensor's content-based executable and archive write events. SentinelOne has no content-typed file event, so this reads File Creation events by the BeyondTrust agent process and selects executable and archive files by extension. A renamed payload is missed and a non-PE file with an executable extension is included. On a File Creation event the acting process is src.process.
// REQUIRES: SentinelOne File Creation telemetry with the writing process name and file path; agent pattern validated with Q1
// TUNING: Exclude sanctioned deployment folders by tgt.file.path and reconcile remaining hits with the appliance session report.
// LOOKBACK: 7d; set the console time picker, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A payload written with a non-listed extension is not captured. Writes to an existing file (File Modification) are not included.
// VALIDATION LEVEL: static-reviewed
event.type = 'File Creation' and src.process.name matches '^(bomgar|beyondtrust)[-_a-z0-9.]*\\.exe$' and tgt.file.path matches '\\.(exe|dll|sys|scr|msi|zip|7z|rar)$'
| columns event.time, endpoint.name, src.process.name, tgt.file.path, tgt.file.sha256, agent.uuid
| sort -event.time
| limit 500

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, InitiatingProcessFileName, FileName
| take 5

// HUNT: Executable or archive written by the BeyondTrust agent process
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1219, T1105, T1570
// CONF: low | FP: medium
// FALSE POSITIVES: help desk software pushes and scripted fixes delivered through a session
// EQUIVALENCE: approximate-analytic - The CQL reads the sensor's content-based executable and archive write events. Defender has no content-typed file event, so this reads file creation and rename events by the BeyondTrust agent process and selects executable and archive files by extension. A renamed payload is missed.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents); agent pattern validated with Q1
// TUNING: Exclude sanctioned deployment folders by FolderPath and reconcile remaining hits with the appliance session report.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A payload written with a non-listed extension is not captured. Writes to an existing file (FileModified) are not included.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(7d)
| where ActionType in ("FileCreated", "FileRenamed")
| where InitiatingProcessFileName matches regex @"(?i)^(bomgar|beyondtrust)[-_a-z0-9.]*\.exe$"
| where FileName matches regex @"(?i)\.(exe|dll|sys|scr|msi|zip|7z|rar)$"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, FolderPath, FileName, SHA1, SHA256
| sort by Timestamp desc
| take 500

// HUNT: Published ARMORY CASTLE hashes, tool names and command-line tokens on any sensored host
// MITRE: T1505.003 | T1090 | T1548.001 | T1070.004
// CONF: high | FP: low | COST: medium | REQUIRES: ProcessRollup2 with SHA256HashData, FileName, CommandLine
// SOURCE: Mandiant GTIG File Indicators table and recovered commands (snapshot 01). Appliance-resident: expected zero on a sensored estate
// FALSE POSITIVES: none expected; a sandbox or analyst host that holds a sample will hit by design
// LOOKBACK: 90d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| (SHA256HashData=/^(dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb|1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462)$/i or FileName=/^(ingredi_ws|mangoapi\.php|dbus-authd)$/i or CommandLine=/(uidchanarge|zz-root-persist|bt-secrets|bt-sysconfig)/i)
| table([@timestamp, ComputerName, UserName, FileName, SHA256HashData, ParentBaseFileName, CommandLine, aid], limit=200)

event.type = 'Process Creation' tgt.process.image.sha256 = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.image.sha256, tgt.process.cmdline

// HUNT: Published ARMORY CASTLE hashes, tool names and command-line tokens on any sensored host
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1505.003, T1090, T1548.001, T1070.004
// CONF: high | FP: low
// FALSE POSITIVES: none expected; a sandbox or analyst host that holds a sample will hit by design
// EQUIVALENCE: equivalent-with-schema-assumptions - Same indicator predicate on process creation: either published SHA256, one of the three published tool names, or one of the four recovered command-line tokens. in:anycase and matches are case-insensitive, which reproduces the CQL /i intent. The created process is tgt.process on a Process Creation event.
// REQUIRES: SentinelOne process-creation telemetry with image hash, name and command line
// TUNING: None expected; treat every hit as an incident. A sandbox or analyst host that holds a sample will hit by design.
// LOOKBACK: 90d; set the console time picker, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The indicators are appliance-resident, so a clean result on a sensored estate is the expected outcome and does not clear the appliance.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and (tgt.process.image.sha256 in:anycase ('dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb', '1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462') or tgt.process.name in:anycase ('ingredi_ws', 'mangoapi.php', 'dbus-authd') or tgt.process.cmdline matches '(uidchanarge|zz-root-persist|bt-secrets|bt-sysconfig)')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.sha256, src.process.name, tgt.process.cmdline, agent.uuid
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, SHA256, ProcessCommandLine
| take 5

// HUNT: Published ARMORY CASTLE hashes, tool names and command-line tokens on any sensored host
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1505.003, T1090, T1548.001, T1070.004
// CONF: high | FP: low
// FALSE POSITIVES: none expected; a sandbox or analyst host that holds a sample will hit by design
// EQUIVALENCE: equivalent-with-schema-assumptions - Same indicator predicate on process creation: either published SHA256, one of the three published tool names, or one of the four recovered command-line tokens. in~ and contains are case-insensitive, which reproduces the CQL /i intent. SHA256 is often unpopulated, so the hash arm may not fire on a healthy tenant.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected; treat every hit as an incident. A sandbox or analyst device that holds a sample will hit by design.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days, so the CQL's 90d window is shortened to 30d here; the CQL tab covers 90d. The indicators are appliance-resident, so a clean result on a sensored estate is the expected outcome and does not clear the appliance.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where SHA256 in~ ("dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb", "1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462") or FileName in~ ("ingredi_ws", "mangoapi.php", "dbus-authd") or ProcessCommandLine contains "uidchanarge" or ProcessCommandLine contains "zz-root-persist" or ProcessCommandLine contains "bt-secrets" or ProcessCommandLine contains "bt-sysconfig"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, SHA256, InitiatingProcessFileName, ProcessCommandLine
| sort by Timestamp desc
| take 200