BlackX UEFI Bootkit: Baton Drop Secure Boot Bypass Against Central Asian Diplomatic Agencies

// HUNT: BlackX installer inst.exe with the encrypted blob name or RC4 key argument
// MITRE: T1542.003, T1140, T1027 | CONF: high  FP: low  COST: low
// REQUIRES: process creation with command line (ProcessRollup2)
// LOOKBACK: 30d (set in the console time picker, not in the query)
// FALSE POSITIVES: very low; PVMDIJGKAX2 and the key are constants from the Securelist report
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^inst\.exe$/i
| CommandLine=/PVMDIJGKAX2|Q46F6MDLI3RX2KV1/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.cmdline

// HUNT: BlackX installer inst.exe with the encrypted blob name or RC4 key argument
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1542.003, T1140, T1027
// CONF: high | FP: low
// FALSE POSITIVES: very low; PVMDIJGKAX2 and the key are constants from the Securelist report
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the created process is inst.exe and its command line carries the blob name or the RC4 key. On a Process Creation event the created process is tgt.process.*. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne Process Creation events with the command line populated
// TUNING: None expected: both strings are constants from the report. Exclude nothing without a confirmed benign installer.
// LOOKBACK: 30d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A launch the agent did not observe is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('inst.exe') tgt.process.cmdline matches 'PVMDIJGKAX2|Q46F6MDLI3RX2KV1'
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, tgt.process.image.path, tgt.process.cmdline, src.process.name, tgt.process.image.sha256

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: BlackX installer inst.exe with the encrypted blob name or RC4 key argument
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1542.003, T1140, T1027
// CONF: high | FP: low
// FALSE POSITIVES: very low; PVMDIJGKAX2 and the key are constants from the Securelist report
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on DeviceProcessEvents: the created process is inst.exe and its command line carries the blob name or the RC4 key. contains is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected: both strings are constants from the report.
// LOOKBACK: 30d; Advanced Hunting retention is 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName =~ "inst.exe"
| where ProcessCommandLine contains "PVMDIJGKAX2" or ProcessCommandLine contains "Q46F6MDLI3RX2KV1"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: inst.exe in ProgramData launched with a blob argument and a long key argument
// MITRE: T1542.003, T1036.005 | CONF: medium  FP: low  COST: low
// REQUIRES: process creation with command line (ProcessRollup2)
// LOOKBACK: 30d (set in the console time picker, not in the query)
// FALSE POSITIVES: software installers that stage inst.exe under ProgramData and pass an ID plus a licence key
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^inst\.exe$/i
| ImageFileName=/\\ProgramData\\/i
| CommandLine=/inst\.exe"?\s+"?[A-Za-z0-9]{6,}"?\s+"?[A-Za-z0-9]{12,}"?\s*$/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.image.path, tgt.process.cmdline

// HUNT: inst.exe in ProgramData launched with a blob argument and a long key argument
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1542.003, T1036.005
// CONF: medium | FP: low
// FALSE POSITIVES: software installers that stage inst.exe under ProgramData and pass an ID plus a licence key
// EQUIVALENCE: equivalent-with-schema-assumptions - Same shape: inst.exe created from a ProgramData path with a short ID argument and a long key argument as the last two tokens. The created process is tgt.process.*. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne Process Creation events with the image path and command line populated
// TUNING: Exclude software installers that stage inst.exe under ProgramData after a baseline review.
// LOOKBACK: 30d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A launch the agent did not observe is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('inst.exe') tgt.process.image.path matches '\\\\ProgramData\\\\' tgt.process.cmdline matches 'inst\\.exe"?\\s+"?[A-Za-z0-9]{6,}"?\\s+"?[A-Za-z0-9]{12,}"?\\s*$'
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, tgt.process.image.path, tgt.process.cmdline, src.process.name, tgt.process.image.sha256

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath, ProcessCommandLine
| take 5

// HUNT: inst.exe in ProgramData launched with a blob argument and a long key argument
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1542.003, T1036.005
// CONF: medium | FP: low
// FALSE POSITIVES: software installers that stage inst.exe under ProgramData and pass an ID plus a licence key
// EQUIVALENCE: equivalent-with-schema-assumptions - Same shape on DeviceProcessEvents: inst.exe created from a ProgramData path with a short ID argument and a long key argument as the last two tokens. contains and the (?i) prefix reproduce the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude software installers that stage inst.exe under ProgramData after a baseline review.
// LOOKBACK: 30d; Advanced Hunting retention is 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName =~ "inst.exe"
| where FolderPath contains "\\ProgramData\\"
| where ProcessCommandLine matches regex @"(?i)inst\.exe\x22?\s+\x22?[A-Za-z0-9]{6,}\x22?\s+\x22?[A-Za-z0-9]{12,}\x22?\s*$"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: googleupdate.exe executing from a path other than a Google Update directory (DLL sideload host)
// MITRE: T1574.002, T1036.005 | CONF: medium  FP: low  COST: low
// REQUIRES: process creation with command line and image path (ProcessRollup2)
// LOOKBACK: 30d (set in the console time picker, not in the query)
// FALSE POSITIVES: portable or repackaged Google software run from a custom folder
// TUNING: if a managed Chrome fleet installs Update to a custom root, add that root to the ImageFileName exclusion
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^googleupdate(\.exe)?$/i
| ImageFileName!=/\\Google\\Update\\/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, MD5HashData, SHA256HashData], limit=200)

event.type = 'Process Creation' tgt.process.image.path = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.image.path

// HUNT: googleupdate.exe executing from a path other than a Google Update directory (DLL sideload host)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002, T1036.005
// CONF: medium | FP: low
// FALSE POSITIVES: portable or repackaged Google software run from a custom folder
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the created process is googleupdate and its image path is not under a Google Update directory. The created process is tgt.process.*. A null path also passes the negation, as in the CQL.
// REQUIRES: SentinelOne Process Creation events with the image path populated
// TUNING: If a managed Chrome fleet installs Update to a custom root, add that root to the path exclusion.
// LOOKBACK: 30d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A launch the agent did not observe is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name matches '^googleupdate(\\.exe)?$' !(tgt.process.image.path matches '\\\\Google\\\\Update\\\\')
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, tgt.process.image.path, tgt.process.cmdline, src.process.name, tgt.process.image.md5, tgt.process.image.sha256

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath
| take 5

// HUNT: googleupdate.exe executing from a path other than a Google Update directory (DLL sideload host)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.002, T1036.005
// CONF: medium | FP: low
// FALSE POSITIVES: portable or repackaged Google software run from a custom folder
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on DeviceProcessEvents: the created process is googleupdate and its path is not under a Google Update directory. !contains is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: If a managed Chrome fleet installs Update to a custom root, add that root to the path exclusion.
// LOOKBACK: 30d; Advanced Hunting retention is 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("googleupdate.exe", "googleupdate")
| where FolderPath !contains "\\Google\\Update\\"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, MD5, SHA1
| sort by Timestamp desc
| take 200

// HUNT: jcef_helper.exe hash executing under a different file name (googleupdate.exe in BlackX)
// MITRE: T1574.002, T1036.003 | CONF: high  FP: low  COST: low
// REQUIRES: process creation with MD5 hash (ProcessRollup2)
// LOOKBACK: 30d (set in the console time picker, not in the query)
// FALSE POSITIVES: a vendor that ships the same helper under a product-specific name
// NOTE: the hash is the legitimate helper. Never block it by hash; hunt the rename and the directory it sits in.
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| MD5HashData=/^AF8A983B9ADA07EAE1259BF2953ABD40$/i
| FileName!=/^jcef_helper(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, MD5HashData], limit=200)

event.type = 'Process Creation' tgt.process.image.md5 = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.image.md5

// HUNT: jcef_helper.exe hash executing under a different file name (googleupdate.exe in BlackX)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002, T1036.003
// CONF: high | FP: low
// FALSE POSITIVES: a vendor that ships the same helper under a product-specific name
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a created process whose MD5 is the legitimate jcef_helper hash but whose name is not jcef_helper. The created process is tgt.process.*.
// REQUIRES: SentinelOne Process Creation events with the MD5 populated
// TUNING: Exclude a vendor that ships the same helper under a product-specific name. Never block this hash: it is the legitimate helper.
// LOOKBACK: 30d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Where the agent does not populate MD5 on process creation, this hunt returns nothing.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.image.md5 in:anycase ('AF8A983B9ADA07EAE1259BF2953ABD40') !(tgt.process.name matches '^jcef_helper(\\.exe)?$')
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, src.process.name, tgt.process.image.md5

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, MD5
| take 5

// HUNT: jcef_helper.exe hash executing under a different file name (googleupdate.exe in BlackX)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.002, T1036.003
// CONF: high | FP: low
// FALSE POSITIVES: a vendor that ships the same helper under a product-specific name
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on DeviceProcessEvents: the created process carries the legitimate jcef_helper MD5 but not that name. MD5 is a documented column of the table.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude a vendor that ships the same helper under a product-specific name. Never block this hash: it is the legitimate helper.
// LOOKBACK: 30d; Advanced Hunting retention is 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Where the sensor does not populate MD5 the hunt returns nothing; hash columns are not guaranteed.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where MD5 =~ "AF8A983B9ADA07EAE1259BF2953ABD40"
| where FileName !in~ ("jcef_helper.exe", "jcef_helper")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, MD5
| sort by Timestamp desc
| take 200

// HUNT: DNS lookups for the BlackX Rust payload C2 domain
// MITRE: T1071.001, T1105 | CONF: high  FP: low  COST: low
// REQUIRES: DNS lookup with requesting process (DnsRequest)
// LOOKBACK: 90d (set in the console time picker, not in the query)
// FALSE POSITIVES: researchers and sinkhole traffic
#event_simpleName=DnsRequest
| DomainName=/(^|\.)archivetj\.com$/i
| table([@timestamp, aid, ComputerName, UserName, DomainName, ContextBaseFileName], limit=200)

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, event.type, event.dns.request, src.process.name

// HUNT: DNS lookups for the BlackX Rust payload C2 domain
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1105
// CONF: high | FP: low
// FALSE POSITIVES: researchers and sinkhole traffic
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a DNS lookup for archivetj.com or any subdomain of it. The acting process on a DNS event is src.process.*.
// REQUIRES: SentinelOne DNS Resolved events with the request name populated
// TUNING: Expect researchers and sinkhole traffic; confirm the requesting process before escalating.
// LOOKBACK: 90d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Lookups made by a process the agent does not attribute are still returned but show no process name.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' (event.dns.request in:anycase ('archivetj.com') or event.dns.request matches '\\.archivetj\\.com$')
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, event.dns.request, src.process.name

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: DNS lookups for the BlackX Rust payload C2 domain
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1105
// CONF: high | FP: low
// FALSE POSITIVES: researchers and sinkhole traffic
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a DNS lookup for archivetj.com or any subdomain of it. Defender has no endpoint DNS table, so the name is read from the DnsQueryResponse action in DeviceEvents.
// REQUIRES: Defender for Endpoint network telemetry with DnsQueryResponse actions in DeviceEvents
// TUNING: Expect researchers and sinkhole traffic; confirm the requesting process before escalating.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days; the CQL tab covers 90d. DnsQueryResponse coverage depends on the sensor build.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where DnsName =~ "archivetj.com" or DnsName endswith ".archivetj.com"
| project Timestamp, ReportId, DeviceId, DeviceName, DnsName, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: googleupdate process resolving names outside Google-owned domains
// MITRE: T1071.001, T1574.002 | CONF: medium  FP: low  COST: low
// REQUIRES: DNS lookup with requesting process (DnsRequest)
// LOOKBACK: 30d (set in the console time picker, not in the query)
// FALSE POSITIVES: captive-portal or proxy-discovery lookups made by the genuine updater
// TUNING: add any internal proxy or PAC hostnames your Chrome fleet resolves to the DomainName exclusion
#event_simpleName=DnsRequest
| ContextBaseFileName=/^googleupdate(\.exe)?$/i
| DomainName!=/(^|\.)(google|googleapis|gvt1|gvt2|gstatic|googleusercontent)\.com$/i
| table([@timestamp, aid, ComputerName, UserName, DomainName, ContextBaseFileName], limit=200)

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, event.type, src.process.name, event.dns.request

// HUNT: googleupdate process resolving names outside Google-owned domains
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1574.002
// CONF: medium | FP: low
// FALSE POSITIVES: captive-portal or proxy-discovery lookups made by the genuine updater
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a DNS lookup made by a googleupdate process for a name outside the Google-owned domains. The requesting process on a DNS event is src.process.*.
// REQUIRES: SentinelOne DNS Resolved events with the requesting process populated
// TUNING: Add internal proxy or PAC hostnames the Chrome fleet resolves to the name exclusion.
// LOOKBACK: 30d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A lookup the agent does not attribute to a process is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' src.process.name matches '^googleupdate(\\.exe)?$' !(event.dns.request matches '(^|\\.)(google|googleapis|gvt1|gvt2|gstatic|googleusercontent)\\.com$')
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, event.dns.request, src.process.name

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, InitiatingProcessFileName, AdditionalFields
| take 5

// HUNT: googleupdate process resolving names outside Google-owned domains
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1574.002
// CONF: medium | FP: low
// FALSE POSITIVES: captive-portal or proxy-discovery lookups made by the genuine updater
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a DNS lookup made by a googleupdate process for a name outside the Google-owned domains. The name is read from the DnsQueryResponse action in DeviceEvents.
// REQUIRES: Defender for Endpoint network telemetry with DnsQueryResponse actions in DeviceEvents
// TUNING: Add internal proxy or PAC hostnames the Chrome fleet resolves to the name exclusion.
// LOOKBACK: 30d; Advanced Hunting retention is 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: DnsQueryResponse coverage depends on the sensor build.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| where InitiatingProcessFileName in~ ("googleupdate.exe", "googleupdate")
| extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where not(DnsName matches regex @"(?i)(^|\.)(google|googleapis|gvt1|gvt2|gstatic|googleusercontent)\.com$")
| project Timestamp, ReportId, DeviceId, DeviceName, DnsName, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: Non-client processes resolving Google Drive, OneDrive or Yandex.Disk API hosts
// MITRE: T1102.002, T1567.002 | CONF: medium  FP: medium  COST: medium
// REQUIRES: DNS lookup with requesting process (DnsRequest)
// LOOKBACK: 14d (set in the console time picker, not in the query)
// FALSE POSITIVES: line-of-business apps, backup agents and scripts that use Google or Microsoft storage APIs
// TUNING: after a one-week baseline, exclude the signed business apps that show up on many hosts and keep the rare ones
// NOTE: the hostnames are inferred (the report names the services, not the hosts); validate against your proxy logs
#event_simpleName=DnsRequest
| DomainName=/^(drive\.google\.com|www\.googleapis\.com|api\.onedrive\.com|onedrive\.live\.com|graph\.microsoft\.com|cloud-api\.yandex\.net|disk\.yandex\.(com|ru)|webdav\.yandex\.(com|ru))$/i
| ContextBaseFileName!=/^(chrome|msedge|firefox|brave|opera|iexplore|msedgewebview2|onedrive|googledrivefs|yandexdisk|yandex|ms-teams|teams|outlook|winword|excel|powerpnt|olk)(\.exe)?$/i
| groupBy([ComputerName, ContextBaseFileName, DomainName], function=[count(as=Lookups), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=1000)
| sort(Lookups, order=desc, limit=200)

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, event.type, src.process.name, event.dns.request

// HUNT: Non-client processes resolving Google Drive, OneDrive or Yandex.Disk API hosts
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1102.002, T1567.002
// CONF: medium | FP: medium
// FALSE POSITIVES: line-of-business apps, backup agents and scripts that use Google or Microsoft storage APIs
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: lookups for the Google Drive, OneDrive and Yandex.Disk API hosts by a process outside the list of known clients, counted per host, process and name. The requesting process on a DNS event is src.process.*. The CQL anchors the host list on both ends, so an exact in:anycase match is equivalent.
// REQUIRES: SentinelOne DNS Resolved events with the requesting process populated
// TUNING: After a one-week baseline, exclude the signed business apps that show up on many hosts and keep the rare ones. The hostnames are inferred from the report, so validate them against proxy logs.
// LOOKBACK: 14d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A lookup the agent does not attribute to a process is grouped under an empty process name.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' event.dns.request matches '^(drive\\.google\\.com|www\\.googleapis\\.com|api\\.onedrive\\.com|onedrive\\.live\\.com|graph\\.microsoft\\.com|cloud-api\\.yandex\\.net|disk\\.yandex\\.(com|ru)|webdav\\.yandex\\.(com|ru))$' !(src.process.name matches '^(chrome|msedge|firefox|brave|opera|iexplore|msedgewebview2|onedrive|googledrivefs|yandexdisk|yandex|ms-teams|teams|outlook|winword|excel|powerpnt|olk)(\\.exe)?$')
| group lookups=count(), first_seen=min(event.time), last_seen=max(event.time) by endpoint.name, src.process.name, event.dns.request
| sort -lookups
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, InitiatingProcessFileName, AdditionalFields
| take 5

// HUNT: Non-client processes resolving Google Drive, OneDrive or Yandex.Disk API hosts
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1102.002, T1567.002
// CONF: medium | FP: medium
// FALSE POSITIVES: line-of-business apps, backup agents and scripts that use Google or Microsoft storage APIs
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: lookups for the Google Drive, OneDrive and Yandex.Disk API hosts by a process outside the list of known clients, counted per host, process and name. The name is read from the DnsQueryResponse action in DeviceEvents.
// REQUIRES: Defender for Endpoint network telemetry with DnsQueryResponse actions in DeviceEvents
// TUNING: After a one-week baseline, exclude the signed business apps that show up on many hosts and keep the rare ones. The hostnames are inferred from the report, so validate them against proxy logs.
// LOOKBACK: 14d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: DnsQueryResponse coverage depends on the sensor build.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(14d)
| where ActionType == "DnsQueryResponse"
| extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where DnsName matches regex @"(?i)^(drive\.google\.com|www\.googleapis\.com|api\.onedrive\.com|onedrive\.live\.com|graph\.microsoft\.com|cloud-api\.yandex\.net|disk\.yandex\.(com|ru)|webdav\.yandex\.(com|ru))$"
| where not(InitiatingProcessFileName matches regex @"(?i)^(chrome|msedge|firefox|brave|opera|iexplore|msedgewebview2|onedrive|googledrivefs|yandexdisk|yandex|ms-teams|teams|outlook|winword|excel|powerpnt|olk)(\.exe)?$")
| summarize Lookups = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessFileName, DnsName
| sort by Lookups desc
| take 200

// HUNT: scheduled task named Secure-Boot-Update registered outside the native Microsoft path
// MITRE: T1053.005, T1036.004 | CONF: medium  FP: low  COST: low
// REQUIRES: scheduled task registration (ScheduledTaskRegistered)
// LOOKBACK: 30d (set in the console time picker, not in the query)
// FALSE POSITIVES: servicing that re-registers the native task
// TUNING: if TaskName carries no folder on your sensor build, drop the second filter and instead exclude the genuine TaskExecutable
#event_simpleName=ScheduledTaskRegistered
| TaskName=/Secure-Boot-Update/i
| TaskName!=/^\\Microsoft\\Windows\\PI\\Secure-Boot-Update$/i
| table([@timestamp, aid, ComputerName, UserName, TaskName, TaskExecutable, TaskAuthor], limit=200)

event.type = 'Process Creation'
| limit 5
| columns event.type

// HUNT: scheduled task named Secure-Boot-Update registered outside the native Microsoft path
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1053.005, T1036.004
// CONF: medium | FP: low
// FALSE POSITIVES: servicing that re-registers the native task
// EQUIVALENCE: unsupported-without-redesign - The hunt reads the scheduled-task registration event and its task name. The field model attests no SentinelOne event type or task name field for scheduled-task registration, so any query written here would evaluate to null and read as a clean estate.
// REQUIRES: A SentinelOne scheduled-task event with a task name field, confirmed on the tenant
// TUNING: Use the CQL tab for this card, or the Defender KQL tab if that platform is deployed.
// LOOKBACK: 30d on the CQL tab
// CONFIGURATION: Use the CQL tab for this card.
// KNOWN GAPS: SentinelOne cannot show a scheduled task registered outside its native path here.
// VALIDATION LEVEL: static-reviewed

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "ScheduledTaskCreated"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: scheduled task named Secure-Boot-Update registered outside the native Microsoft path
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1053.005, T1036.004
// CONF: medium | FP: low
// FALSE POSITIVES: servicing that re-registers the native task
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a scheduled task whose name contains Secure-Boot-Update but is not the native task path. The task name is read from the ScheduledTaskCreated action in DeviceEvents.
// REQUIRES: Defender for Endpoint telemetry with ScheduledTaskCreated actions in DeviceEvents
// TUNING: If TaskName carries no folder on your sensor build, drop the exact-path filter and instead exclude the genuine task by its action.
// LOOKBACK: 30d; Advanced Hunting retention is 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Servicing that re-registers the native task under another path would match; the CQL has the same property.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "ScheduledTaskCreated"
| extend TaskName = tostring(parse_json(AdditionalFields)["TaskName"])
| where TaskName contains "Secure-Boot-Update"
| where TaskName !~ "\\Microsoft\\Windows\\PI\\Secure-Boot-Update"
| project Timestamp, ReportId, DeviceId, DeviceName, TaskName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Writes to Secureboot AvailableUpdates (certificate revocation trigger), for change control and exposure tracking
// MITRE: T1112, T1542.003 | CONF: medium  FP: medium  COST: low
// REQUIRES: registry value writes (RegGenericValueUpdate, AsepValueUpdate)
// LOOKBACK: 90d (set in the console time picker, not in the query)
// FALSE POSITIVES: the sanctioned Secure Boot certificate rollout, Windows servicing, imaging tools
// TUNING: join the host list to your change ticket for the rollout; alert only on writers outside the approved deployment tool
// NOTE: absence is the finding. Hosts with no write in 90 days have not triggered the revocation steps.
#event_simpleName=/RegGenericValueUpdate|AsepValueUpdate/
| RegObjectName=/\\Control\\SecureBoot(\\|$)/i
| RegValueName=/^AvailableUpdates$/i
| table([@timestamp, aid, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, ContextBaseFileName], limit=200)

event.type = 'Registry Value Modified' registry.keyPath = *
| limit 5
| columns event.time, event.type, registry.keyPath, registry.valueName

// HUNT: Writes to Secureboot AvailableUpdates (certificate revocation trigger), for change control and exposure tracking
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1112, T1542.003
// CONF: medium | FP: medium
// FALSE POSITIVES: the sanctioned Secure Boot certificate rollout, Windows servicing, imaging tools
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a write of the AvailableUpdates value under the SecureBoot control key. The acting process on a registry event is src.process.*. matches and in:anycase reproduce the CQL /i intent.
// REQUIRES: SentinelOne Registry Value Modified events
// TUNING: Join the host list to your change ticket for the rollout and alert only on writers outside the approved deployment tool. Absence of a write is the finding for exposure tracking.
// LOOKBACK: 90d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A host with no write in the window shows no row, so exposure tracking needs a host inventory to compare against.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified' registry.keyPath matches '\\\\Control\\\\SecureBoot(\\\\|$)' registry.valueName in:anycase ('AvailableUpdates')
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, registry.keyPath, registry.valueName, registry.value, src.process.name

DeviceRegistryEvents
| where Timestamp > ago(1d)
| where ActionType == "RegistryValueSet"
| project Timestamp, ActionType, RegistryKey, RegistryValueName
| take 5

// HUNT: Writes to Secureboot AvailableUpdates (certificate revocation trigger), for change control and exposure tracking
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1112, T1542.003
// CONF: medium | FP: medium
// FALSE POSITIVES: the sanctioned Secure Boot certificate rollout, Windows servicing, imaging tools
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on DeviceRegistryEvents: a value set of AvailableUpdates under the SecureBoot control key. The (?i) prefix and =~ reproduce the CQL /i intent.
// REQUIRES: Defender for Endpoint registry telemetry (DeviceRegistryEvents)
// TUNING: Join the host list to your change ticket for the rollout and alert only on writers outside the approved deployment tool. Absence of a write is the finding for exposure tracking.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days; the CQL tab covers 90d. A host with no write in the window shows no row, so exposure tracking needs a device inventory to compare against.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceRegistryEvents
| where Timestamp >= ago(30d)
| where ActionType == "RegistryValueSet"
| where RegistryKey matches regex @"(?i)\\Control\\SecureBoot(\\|$)"
| where RegistryValueName =~ "AvailableUpdates"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: EFI system partition mounts, boot file rewrites and boot-integrity changes by command line
// MITRE: T1542.003, T1553 | CONF: medium  FP: high  COST: medium
// REQUIRES: process creation with command line (ProcessRollup2)
// LOOKBACK: 14d (set in the console time picker, not in the query)
// FALSE POSITIVES: imaging and recovery workflows, Windows servicing, OEM tools
// TUNING: exclude OS servicing parents (applied below) and your imaging server accounts; keep interactive admin sessions on servers
// NOTE: inferred behaviour. The Securelist report names the partitions, not the tools.
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(mountvol|bcdboot|bcdedit|bootsect|powershell|pwsh)\.exe$/i
| CommandLine=/mountvol(\.exe)?"?\s+\S+\s+\/s\b|bcdboot(\.exe)?"?\s+\S+\s+\/s\b|bcdedit(\.exe)?"?\s+.*(bootmgr|nointegritychecks|testsigning|loadoptions|\\EFI\\)|bootsect(\.exe)?"?\s+.*\/nt|Set-SecureBootUEFI|Format-SecureBootUEFI/i
| ParentBaseFileName!=/^(TiWorker|TrustedInstaller)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.cmdline

// HUNT: EFI system partition mounts, boot file rewrites and boot-integrity changes by command line
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1542.003, T1553
// CONF: medium | FP: high
// FALSE POSITIVES: imaging and recovery workflows, Windows servicing, OEM tools
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the boot tooling or PowerShell as the created process with a command line that mounts the EFI partition, rewrites boot files or changes boot integrity, excluding OS servicing parents. On a Process Creation event the created process is tgt.process.* and its creator is src.process.*.
// REQUIRES: SentinelOne Process Creation events with the command line populated
// TUNING: Exclude your imaging server accounts and keep interactive admin sessions on servers. The behaviour is inferred: the report names the partitions, not the tools.
// LOOKBACK: 14d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: High false-positive risk on imaging and recovery workflows; expect tuning.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name matches '^(mountvol|bcdboot|bcdedit|bootsect|powershell|pwsh)\\.exe$' tgt.process.cmdline matches 'mountvol(\\.exe)?"?\\s+\\S+\\s+/s\\b|bcdboot(\\.exe)?"?\\s+\\S+\\s+/s\\b|bcdedit(\\.exe)?"?\\s+.*(bootmgr|nointegritychecks|testsigning|loadoptions|\\\\EFI\\\\)|bootsect(\\.exe)?"?\\s+.*/nt|Set-SecureBootUEFI|Format-SecureBootUEFI' !(src.process.name matches '^(TiWorker|TrustedInstaller)\\.exe$')
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine, InitiatingProcessFileName
| take 5

// HUNT: EFI system partition mounts, boot file rewrites and boot-integrity changes by command line
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1542.003, T1553
// CONF: medium | FP: high
// FALSE POSITIVES: imaging and recovery workflows, Windows servicing, OEM tools
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on DeviceProcessEvents: the boot tooling or PowerShell as the created process with a command line that mounts the EFI partition, rewrites boot files or changes boot integrity, excluding OS servicing parents. The (?i) prefix reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude your imaging server accounts and keep interactive admin sessions on servers. The behaviour is inferred: the report names the partitions, not the tools.
// LOOKBACK: 14d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: High false-positive risk on imaging and recovery workflows; expect tuning.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where FileName in~ ("mountvol.exe", "bcdboot.exe", "bcdedit.exe", "bootsect.exe", "powershell.exe", "pwsh.exe")
| where ProcessCommandLine matches regex @"(?i)mountvol(\.exe)?\x22?\s+\S+\s+/s\b|bcdboot(\.exe)?\x22?\s+\S+\s+/s\b|bcdedit(\.exe)?\x22?\s+.*(bootmgr|nointegritychecks|testsigning|loadoptions|\\EFI\\)|bootsect(\.exe)?\x22?\s+.*/nt|Set-SecureBootUEFI|Format-SecureBootUEFI"
| where InitiatingProcessFileName !in~ ("TiWorker.exe", "TrustedInstaller.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: Rare kernel drivers loaded from outside the Windows driver locations
// MITRE: T1014, T1547.006 | CONF: medium  FP: medium  COST: medium
// REQUIRES: driver load (DriverLoad). Validate field names on your sensor build.
// LOOKBACK: 30d (set in the console time picker, not in the query)
// FALSE POSITIVES: vendor utilities, anti-cheat and virtualisation drivers
// TUNING: baseline for a week, then exclude signed vendor drivers present on many hosts; keep the long tail
// NOTE: the revoked signer serial is not queryable in Falcon; check it with native hunt N3
#event_simpleName=DriverLoad
| ImageFileName!=/\\Windows\\System32\\(drivers|DriverStore)\\/i
| groupBy([ImageFileName], function=[count(aid, distinct=true, as=Hosts), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=1000)
| Hosts <= 3
| sort(Hosts, order=asc, limit=200)

event.type = 'Process Creation'
| limit 5
| columns event.type

// HUNT: Rare kernel drivers loaded from outside the Windows driver locations
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1014, T1547.006
// CONF: medium | FP: medium
// FALSE POSITIVES: vendor utilities, anti-cheat and virtualisation drivers
// EQUIVALENCE: unsupported-without-redesign - The hunt reads kernel driver-load events and counts distinct hosts per driver path. The field model attests no SentinelOne driver-load event type or driver path field, so any query written here would evaluate to null and read as a clean estate.
// REQUIRES: A SentinelOne driver-load event with an image path field, confirmed on the tenant
// TUNING: Use the CQL tab for this card, or the Defender KQL tab if that platform is deployed.
// LOOKBACK: 30d on the CQL tab
// CONFIGURATION: Use the CQL tab for this card.
// KNOWN GAPS: SentinelOne cannot show rare kernel drivers loaded from outside the driver store here.
// VALIDATION LEVEL: static-reviewed

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DriverLoad"
| project Timestamp, ActionType, FolderPath, DeviceId
| take 5

// HUNT: Rare kernel drivers loaded from outside the Windows driver locations
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1014, T1547.006
// CONF: medium | FP: medium
// FALSE POSITIVES: vendor utilities, anti-cheat and virtualisation drivers
// EQUIVALENCE: equivalent-with-schema-assumptions - Same analytic: driver loads from outside the Windows driver locations, counted per distinct host and kept when three or fewer hosts loaded the driver. The load is read from the DriverLoad action in DeviceEvents.
// REQUIRES: Defender for Endpoint telemetry with DriverLoad actions in DeviceEvents
// TUNING: Baseline for a week, then exclude signed vendor drivers present on many hosts and keep the long tail.
// LOOKBACK: 30d; Advanced Hunting retention is 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The revoked signer serial is not queried here; check it separately.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DriverLoad"
| where FolderPath !contains "\\Windows\\System32\\drivers\\" and FolderPath !contains "\\Windows\\System32\\DriverStore\\"
| summarize Hosts = dcount(DeviceId), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by FolderPath
| where Hosts <= 3
| sort by Hosts asc
| take 200

// HUNT: ETW autologger session values changed in the registry (adjacent to BlackX ETW tampering)
// MITRE: T1562.006 | CONF: low  FP: medium  COST: low
// REQUIRES: registry value writes (RegGenericValueUpdate)
// LOOKBACK: 30d (set in the console time picker, not in the query)
// FALSE POSITIVES: security tooling, Windows servicing, diagnostics tools
// TUNING: exclude the writer processes your EDR, SIEM agent and Windows servicing use; keep unsigned or user-writable-path writers
// NOTE: kernel-mode ETW tampering by the BlackX driver is not observable here; see the coverage map gap
#event_simpleName=/RegGenericValueUpdate|AsepValueUpdate/
| RegObjectName=/\\Control\\WMI\\Autologger\\/i
| RegValueName=/^(Start|Enabled)$/i
| table([@timestamp, aid, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, ContextBaseFileName], limit=200)

event.type = 'Registry Value Modified' registry.keyPath = *
| limit 5
| columns event.time, event.type, registry.keyPath, registry.valueName

// HUNT: ETW autologger session values changed in the registry (adjacent to BlackX ETW tampering)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1562.006
// CONF: low | FP: medium
// FALSE POSITIVES: security tooling, Windows servicing, diagnostics tools
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a write of the Start or Enabled value under an ETW autologger key. The acting process on a registry event is src.process.*. contains and in:anycase reproduce the CQL /i intent.
// REQUIRES: SentinelOne Registry Value Modified events
// TUNING: Exclude the writer processes your EDR, SIEM agent and Windows servicing use; keep unsigned or user-writable-path writers.
// LOOKBACK: 30d; set in the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Kernel-mode ETW tampering is not observable through registry events.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified' registry.keyPath contains '\\Control\\WMI\\Autologger\\' registry.valueName in:anycase ('Start', 'Enabled')
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, registry.keyPath, registry.valueName, registry.value, src.process.name

DeviceRegistryEvents
| where Timestamp > ago(1d)
| where ActionType == "RegistryValueSet"
| project Timestamp, ActionType, RegistryKey, RegistryValueName
| take 5

// HUNT: ETW autologger session values changed in the registry (adjacent to BlackX ETW tampering)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1562.006
// CONF: low | FP: medium
// FALSE POSITIVES: security tooling, Windows servicing, diagnostics tools
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on DeviceRegistryEvents: a value set of Start or Enabled under an ETW autologger key. contains and in~ are case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint registry telemetry (DeviceRegistryEvents)
// TUNING: Exclude the writer processes your EDR, SIEM agent and Windows servicing use; keep unsigned or user-writable-path writers.
// LOOKBACK: 30d; Advanced Hunting retention is 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Kernel-mode ETW tampering is not observable through registry events.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceRegistryEvents
| where Timestamp >= ago(30d)
| where ActionType == "RegistryValueSet"
| where RegistryKey contains "\\Control\\WMI\\Autologger\\"
| where RegistryValueName in~ ("Start", "Enabled")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName
| sort by Timestamp desc
| take 200