BRONZE SANDCASTLE: Sandboxie DLL Sideloading and Modified Meterpreter Backdoor

// HUNT: BRONZE SANDCASTLE known loader / payload SHA256 (retro-hunt)
// MITRE: T1574.001, T1055
// CONF: high  FP: low  COST: low
// REQUIRES: file hashing on process start and PE write (Falcon sensor, default)
// FALSE POSITIVES: none expected; hashes are vendor-listed malicious samples
// LOOKBACK: 90d (set with the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| in(SHA256HashData, values=[
    "7afd292994ff214ca4dd880c834532274c957963e9838c7fa2e4d1318af75756",
    "b39e41be217fe2c690f75e9861cf64df52b302c66619fad608ca60a959288842",
    "7515417e523a776e371877e868536fa1d1961826d4bc478734be993985d9df03",
    "ab200eda30dd1868f597ac42e7876894c5838df84605bbd4fca8dbc91c90ea28",
    "dd9223c381893f493ca581e5bd35f16f778689e58fc459c1b0c39b0d33b41290",
    "95c6e9447585670b1a50551c36abe22154f6e010bfb23275fc467d2b20a423d9",
    "548d5add2b27ab8c2d506b81623a37f3d27a0f4e22e6fa938c6a008b70775989",
    "592a6e74366bcd0c8a47657a88a6e81f99d2876baa6f923bb928bba4477054fc",
    "2332d924b1404961bc65280e782c787a4b048da7519fe73ccf4dc687b843d060",
    "425177b18cb386f359796576e51666b7350489579550e564f51f8973b2f0979b",
    "72259376f63116d1aca64bf2ef42a5d211c1ebdb01516ef3b53778ed1347c238",
    "2411a678e4de91451e69c27369bab4329c3cd969d4ebd851ba91dcfdba7e7db2",
    "fdef7b1f4c013d686bf5dbfc92f37191c04beb0dc8b53c608bb8019a8c678052",
    "e50dc9db568c272d7b019ec8e5fb1f111dd071baa4b3a00bc3c8c885ade46fbc",
    "6c5c332428d914fd8eac0164947a70ec3d71bcd3f6cdcccb5e875dcb68ea076d",
    "91ef27b1e83f324348ca51466ab17e2464f927b9c84758898fd7ce7ae6a6008b",
    "437ba4b0db084c261f7843f85329b5204a2dedecdacf29b25a53a90bcf8d7d2e",
    "c7f1c6cfd87e4c4f492a6da634ae6a264467aaee5a3eed14e89c2297a58e5d30",
    "c39ac4e1fe11639a9d46e026850cc3146eb809b542daf38e1a00eab11eaa1834",
    "e404b2b9f9f203dad81bdc1ef8bfcbe4f42eb616f113a89ed504202212af1c1e",
    "5e2b035ae40f8eaab40792a92573171df0011c2fbed55582268a824effa7cb91"
  ])
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, TargetFileName, SHA256HashData])

event.type = 'Process Creation' tgt.process.image.sha256 = *
| limit 5
| columns event.time, event.type, tgt.process.image.sha256, tgt.file.sha256

// HUNT: BRONZE SANDCASTLE known loader / payload SHA256 (retro-hunt)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.001, T1055
// CONF: high | FP: low
// FALSE POSITIVES: none expected; hashes are vendor-listed malicious samples
// EQUIVALENCE: equivalent-with-schema-assumptions - Same SHA256 retro-hunt over both populations the CQL reads: created processes (image hash on a Process Creation event) and written files (file hash on a File Creation event). in:anycase keeps the match independent of hash letter case.
// REQUIRES: SentinelOne Deep Visibility process and file telemetry with SHA256 populated on Process Creation and File Creation events
// TUNING: None needed: the hashes are vendor-listed malicious samples. Add newly reported sample hashes to both lists.
// LOOKBACK: 90d (set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A sample that was only renamed or moved into place, or executed from a path the sensor did not hash, is not matched.
// VALIDATION LEVEL: static-reviewed
event.type in ('Process Creation', 'File Creation') and (tgt.process.image.sha256 in:anycase (
  '7afd292994ff214ca4dd880c834532274c957963e9838c7fa2e4d1318af75756',
  'b39e41be217fe2c690f75e9861cf64df52b302c66619fad608ca60a959288842',
  '7515417e523a776e371877e868536fa1d1961826d4bc478734be993985d9df03',
  'ab200eda30dd1868f597ac42e7876894c5838df84605bbd4fca8dbc91c90ea28',
  'dd9223c381893f493ca581e5bd35f16f778689e58fc459c1b0c39b0d33b41290',
  '95c6e9447585670b1a50551c36abe22154f6e010bfb23275fc467d2b20a423d9',
  '548d5add2b27ab8c2d506b81623a37f3d27a0f4e22e6fa938c6a008b70775989',
  '592a6e74366bcd0c8a47657a88a6e81f99d2876baa6f923bb928bba4477054fc',
  '2332d924b1404961bc65280e782c787a4b048da7519fe73ccf4dc687b843d060',
  '425177b18cb386f359796576e51666b7350489579550e564f51f8973b2f0979b',
  '72259376f63116d1aca64bf2ef42a5d211c1ebdb01516ef3b53778ed1347c238',
  '2411a678e4de91451e69c27369bab4329c3cd969d4ebd851ba91dcfdba7e7db2',
  'fdef7b1f4c013d686bf5dbfc92f37191c04beb0dc8b53c608bb8019a8c678052',
  'e50dc9db568c272d7b019ec8e5fb1f111dd071baa4b3a00bc3c8c885ade46fbc',
  '6c5c332428d914fd8eac0164947a70ec3d71bcd3f6cdcccb5e875dcb68ea076d',
  '91ef27b1e83f324348ca51466ab17e2464f927b9c84758898fd7ce7ae6a6008b',
  '437ba4b0db084c261f7843f85329b5204a2dedecdacf29b25a53a90bcf8d7d2e',
  'c7f1c6cfd87e4c4f492a6da634ae6a264467aaee5a3eed14e89c2297a58e5d30',
  'c39ac4e1fe11639a9d46e026850cc3146eb809b542daf38e1a00eab11eaa1834',
  'e404b2b9f9f203dad81bdc1ef8bfcbe4f42eb616f113a89ed504202212af1c1e',
  '5e2b035ae40f8eaab40792a92573171df0011c2fbed55582268a824effa7cb91'
) or tgt.file.sha256 in:anycase (
  '7afd292994ff214ca4dd880c834532274c957963e9838c7fa2e4d1318af75756',
  'b39e41be217fe2c690f75e9861cf64df52b302c66619fad608ca60a959288842',
  '7515417e523a776e371877e868536fa1d1961826d4bc478734be993985d9df03',
  'ab200eda30dd1868f597ac42e7876894c5838df84605bbd4fca8dbc91c90ea28',
  'dd9223c381893f493ca581e5bd35f16f778689e58fc459c1b0c39b0d33b41290',
  '95c6e9447585670b1a50551c36abe22154f6e010bfb23275fc467d2b20a423d9',
  '548d5add2b27ab8c2d506b81623a37f3d27a0f4e22e6fa938c6a008b70775989',
  '592a6e74366bcd0c8a47657a88a6e81f99d2876baa6f923bb928bba4477054fc',
  '2332d924b1404961bc65280e782c787a4b048da7519fe73ccf4dc687b843d060',
  '425177b18cb386f359796576e51666b7350489579550e564f51f8973b2f0979b',
  '72259376f63116d1aca64bf2ef42a5d211c1ebdb01516ef3b53778ed1347c238',
  '2411a678e4de91451e69c27369bab4329c3cd969d4ebd851ba91dcfdba7e7db2',
  'fdef7b1f4c013d686bf5dbfc92f37191c04beb0dc8b53c608bb8019a8c678052',
  'e50dc9db568c272d7b019ec8e5fb1f111dd071baa4b3a00bc3c8c885ade46fbc',
  '6c5c332428d914fd8eac0164947a70ec3d71bcd3f6cdcccb5e875dcb68ea076d',
  '91ef27b1e83f324348ca51466ab17e2464f927b9c84758898fd7ce7ae6a6008b',
  '437ba4b0db084c261f7843f85329b5204a2dedecdacf29b25a53a90bcf8d7d2e',
  'c7f1c6cfd87e4c4f492a6da634ae6a264467aaee5a3eed14e89c2297a58e5d30',
  'c39ac4e1fe11639a9d46e026850cc3146eb809b542daf38e1a00eab11eaa1834',
  'e404b2b9f9f203dad81bdc1ef8bfcbe4f42eb616f113a89ed504202212af1c1e',
  '5e2b035ae40f8eaab40792a92573171df0011c2fbed55582268a824effa7cb91'
))
| columns event.time, endpoint.name, src.process.user, event.type, src.process.name, tgt.process.image.path, tgt.process.image.sha256, tgt.file.path, tgt.file.sha256
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, SHA256, FileName
| take 5

// HUNT: BRONZE SANDCASTLE known loader / payload SHA256 (retro-hunt)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.001, T1055
// CONF: high | FP: low
// FALSE POSITIVES: none expected; hashes are vendor-listed malicious samples
// EQUIVALENCE: telemetry-gap - A partial pivot: the hash list is matched against files written or touched on endpoints (DeviceFileEvents). The CQL also matches the hash of a created process; that population lives in a different table and one query reads one table.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents) with SHA256 populated
// TUNING: None needed: the hashes are vendor-listed malicious samples. Add newly reported sample hashes to the list.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The created-process half of the CQL hash match is not covered: a sample that only ran, without a file event the sensor recorded, is missed. Advanced Hunting keeps 30 days; the 90d retro-hunt window of the CQL tab is not reachable here.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where SHA256 in~ (
    "7afd292994ff214ca4dd880c834532274c957963e9838c7fa2e4d1318af75756",
    "b39e41be217fe2c690f75e9861cf64df52b302c66619fad608ca60a959288842",
    "7515417e523a776e371877e868536fa1d1961826d4bc478734be993985d9df03",
    "ab200eda30dd1868f597ac42e7876894c5838df84605bbd4fca8dbc91c90ea28",
    "dd9223c381893f493ca581e5bd35f16f778689e58fc459c1b0c39b0d33b41290",
    "95c6e9447585670b1a50551c36abe22154f6e010bfb23275fc467d2b20a423d9",
    "548d5add2b27ab8c2d506b81623a37f3d27a0f4e22e6fa938c6a008b70775989",
    "592a6e74366bcd0c8a47657a88a6e81f99d2876baa6f923bb928bba4477054fc",
    "2332d924b1404961bc65280e782c787a4b048da7519fe73ccf4dc687b843d060",
    "425177b18cb386f359796576e51666b7350489579550e564f51f8973b2f0979b",
    "72259376f63116d1aca64bf2ef42a5d211c1ebdb01516ef3b53778ed1347c238",
    "2411a678e4de91451e69c27369bab4329c3cd969d4ebd851ba91dcfdba7e7db2",
    "fdef7b1f4c013d686bf5dbfc92f37191c04beb0dc8b53c608bb8019a8c678052",
    "e50dc9db568c272d7b019ec8e5fb1f111dd071baa4b3a00bc3c8c885ade46fbc",
    "6c5c332428d914fd8eac0164947a70ec3d71bcd3f6cdcccb5e875dcb68ea076d",
    "91ef27b1e83f324348ca51466ab17e2464f927b9c84758898fd7ce7ae6a6008b",
    "437ba4b0db084c261f7843f85329b5204a2dedecdacf29b25a53a90bcf8d7d2e",
    "c7f1c6cfd87e4c4f492a6da634ae6a264467aaee5a3eed14e89c2297a58e5d30",
    "c39ac4e1fe11639a9d46e026850cc3146eb809b542daf38e1a00eab11eaa1834",
    "e404b2b9f9f203dad81bdc1ef8bfcbe4f42eb616f113a89ed504202212af1c1e",
    "5e2b035ae40f8eaab40792a92573171df0011c2fbed55582268a824effa7cb91"
  )
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, ActionType, FolderPath, FileName, SHA256, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: SandboxieWUAU.exe executing outside a Sandboxie install directory
// MITRE: T1574.001, T1036.005
// CONF: high  FP: low  COST: low
// REQUIRES: process creation with image path (Falcon sensor, default)
// FALSE POSITIVES: portable or per-user Sandboxie copies in an unusual folder
// LOOKBACK: 30d
// NOTE: path exclusion is evadable by naming a folder Sandboxie; pair with Q3
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^SandboxieWUAU\.exe$/i
| ImageFileName!=/\\Sandboxie(-Plus)?\\/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])

event.type = 'Process Creation' tgt.process.image.path = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.image.path

// HUNT: SandboxieWUAU.exe executing outside a Sandboxie install directory
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.001, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: portable or per-user Sandboxie copies in an unusual folder
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on a Process Creation event: the created process is named SandboxieWUAU.exe and its image path has no Sandboxie or Sandboxie-Plus directory. The created process is tgt.process.*, its creator src.process.*. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne Process Creation telemetry with the created process image path
// TUNING: Exclude portable or per-user Sandboxie copies by image path after a baseline review. The directory exclusion is evadable by naming a folder Sandboxie, so pair it with the sbiedll.dll card.
// LOOKBACK: 30d (set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name matches '^SandboxieWUAU\\.exe$' tgt.process.image.path = * !(tgt.process.image.path matches '\\\\Sandboxie(-Plus)?\\\\')
| columns event.time, endpoint.name, src.process.user, tgt.process.image.path, tgt.process.cmdline, src.process.name, tgt.process.image.sha256
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath
| take 5

// HUNT: SandboxieWUAU.exe executing outside a Sandboxie install directory
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.001, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: portable or per-user Sandboxie copies in an unusual folder
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the created process is SandboxieWUAU.exe and its folder path has no Sandboxie or Sandboxie-Plus directory. contains and =~ are case-insensitive, which reproduces the CQL /i intent. The creator is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude portable or per-user Sandboxie copies by FolderPath after a baseline review. The directory exclusion is evadable by naming a folder Sandboxie, so pair it with the sbiedll.dll card.
// LOOKBACK: 30d (the CQL tab uses the same window)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName =~ "SandboxieWUAU.exe"
| where isnotempty(FolderPath)
| where not (FolderPath contains "\\Sandboxie\\" or FolderPath contains "\\Sandboxie-Plus\\")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA1
| sort by Timestamp desc
| take 200

// HUNT: sbiedll.dll dropped outside a Sandboxie directory
// MITRE: T1574.001
// CONF: high  FP: low  COST: low
// REQUIRES: PE write telemetry (Falcon sensor, default)
// FALSE POSITIVES: Sandboxie installer or updater staging into a temp folder
// LOOKBACK: 30d
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| FileName=/^sbiedll\.dll$/i
| TargetFileName!=/\\Sandboxie(-Plus)?\\/i
| table([@timestamp, aid, ComputerName, UserName, TargetFileName, SHA256HashData, ContextBaseFileName])

event.type = 'File Creation' tgt.file.path = *
| limit 5
| columns event.time, event.type, tgt.file.path

// HUNT: sbiedll.dll dropped outside a Sandboxie directory
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.001
// CONF: high | FP: low
// FALSE POSITIVES: Sandboxie installer or updater staging into a temp folder
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on a File Creation event: the written file is named sbiedll.dll and its path has no Sandboxie or Sandboxie-Plus directory. The writer is the acting process, src.process.*, on a non-process event.
// REQUIRES: SentinelOne File Creation telemetry with the written file path
// TUNING: Exclude Sandboxie installer or updater staging folders by path after a baseline review.
// LOOKBACK: 30d (set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A DLL that arrives by rename or move rather than creation is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'File Creation' tgt.file.path matches '(^|\\\\)sbiedll\\.dll$' !(tgt.file.path matches '\\\\Sandboxie(-Plus)?\\\\')
| columns event.time, endpoint.name, src.process.user, tgt.file.path, tgt.file.sha256, src.process.name
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, FileName, FolderPath
| take 5

// HUNT: sbiedll.dll dropped outside a Sandboxie directory
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.001
// CONF: high | FP: low
// FALSE POSITIVES: Sandboxie installer or updater staging into a temp folder
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on file creation events: the file is named sbiedll.dll and its folder path has no Sandboxie or Sandboxie-Plus directory. The CQL reads PE write telemetry; DeviceFileEvents with FileCreated covers every file type, so the name predicate does the narrowing.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: Exclude Sandboxie installer or updater staging folders by FolderPath after a baseline review.
// LOOKBACK: 30d (the CQL tab uses the same window)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A DLL that arrives by rename is recorded with a different action type and is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where ActionType == "FileCreated"
| where FileName =~ "sbiedll.dll"
| where not (FolderPath contains "\\Sandboxie\\" or FolderPath contains "\\Sandboxie-Plus\\")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, FolderPath, SHA1, SHA256, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: rare sideload-pair DLL names in user-writable folders (rarity stack)
// MITRE: T1574.001
// CONF: medium  FP: medium  COST: medium
// REQUIRES: PE write telemetry (Falcon sensor, default)
// FALSE POSITIVES: per-user installs of Java, Krita, NVDA, LINE and Chromium-embedded apps
// TUNING: exclude your sanctioned app folders, e.g. add | TargetFileName!=/\\AppData\\Local\\Programs\\Krita\\/i
// TUNING: raise the host threshold only after reviewing the stacked output once
// LOOKBACK: 30d
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| FileName=/^(jli|krita|nvdahelperremote|libcef|version|msvcp140|snmpapi|corefoundation|msimg32)\.dll$/i
| TargetFileName=/\\(ProgramData|Users\\Public|Windows\\Temp|AppData|Perflogs)\\/i
| groupBy([FileName, TargetFileName], function=[count(aid, distinct=true, as=Hosts), min(@timestamp, as=FirstSeen), collect(ComputerName, limit=5)], limit=500)
| Hosts < 4
| sort(Hosts, order=asc, limit=200)

event.type = 'File Creation' tgt.file.path = * agent.uuid = *
| limit 5
| columns event.time, event.type, tgt.file.path, agent.uuid

// HUNT: rare sideload-pair DLL names in user-writable folders (rarity stack)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.001
// CONF: medium | FP: medium
// FALSE POSITIVES: per-user installs of Java, Krita, NVDA, LINE and Chromium-embedded apps
// EQUIVALENCE: approximate-analytic - Same rarity stack: sideload-pair DLL names written under user-writable folders, grouped by written path, kept when fewer than 4 hosts wrote it. The CQL collects up to 5 host names per row; PowerQuery shows one sample host name, and distinct hosts are an estimate.
// REQUIRES: SentinelOne File Creation telemetry with the written file path and a stable endpoint identifier
// TUNING: Exclude your sanctioned app folders by path, for example a per-user Krita install, after reviewing the stacked output once. Raise the host threshold only after that review.
// LOOKBACK: 30d (set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Only one sample host name is shown per row instead of up to five. A DLL that arrives by rename or move rather than creation is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'File Creation' tgt.file.path matches '\\\\(jli|krita|nvdahelperremote|libcef|version|msvcp140|snmpapi|corefoundation|msimg32)\\.dll$' tgt.file.path matches '\\\\(ProgramData|Users\\\\Public|Windows\\\\Temp|AppData|Perflogs)\\\\'
| group hosts=estimate_distinct(agent.uuid), first_seen=min(event.time), sample_host=any(endpoint.name) by tgt.file.path
| filter hosts < 4
| sort +hosts
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, FileName, FolderPath, DeviceId
| take 5

// HUNT: rare sideload-pair DLL names in user-writable folders (rarity stack)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.001
// CONF: medium | FP: medium
// FALSE POSITIVES: per-user installs of Java, Krita, NVDA, LINE and Chromium-embedded apps
// EQUIVALENCE: equivalent-with-schema-assumptions - Same rarity stack on file creation events: sideload-pair DLL names under user-writable folders, grouped by name and path, kept when fewer than 4 devices wrote it. contains and in~ are case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: Exclude your sanctioned app folders by FolderPath, for example a per-user Krita install, after reviewing the stacked output once. Raise the host threshold only after that review.
// LOOKBACK: 30d (the CQL tab uses the same window)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A DLL that arrives by rename is recorded with a different action type and is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where ActionType == "FileCreated"
| where FileName in~ ("jli.dll", "krita.dll", "nvdahelperremote.dll", "libcef.dll", "version.dll", "msvcp140.dll", "snmpapi.dll", "corefoundation.dll", "msimg32.dll")
| where FolderPath contains "\\ProgramData\\" or FolderPath contains "\\Users\\Public\\" or FolderPath contains "\\Windows\\Temp\\" or FolderPath contains "\\AppData\\" or FolderPath contains "\\Perflogs\\"
| summarize Hosts = dcount(DeviceId), FirstSeen = min(Timestamp), SampleHosts = make_set(DeviceName, 5) by FileName, FolderPath
| where Hosts < 4
| sort by Hosts asc
| take 200

// HUNT: sideload host executable launched from a user-writable folder
// MITRE: T1574.001, T1036.005
// CONF: medium  FP: medium  COST: low
// REQUIRES: process creation with image path (Falcon sensor, default)
// FALSE POSITIVES: admin tools run from Downloads, per-user app installs, generic Start.exe
// TUNING: exclude sanctioned per-user installs, e.g. | ImageFileName!=/\\AppData\\Local\\Programs\\/i
// TUNING: baseline the SHA256 of your own Vmmap.exe and bginfo64.exe and exclude them with !in(SHA256HashData, values=[...])
// LOOKBACK: 30d
// GAP: renamed host executables are not matched by name; see Coverage Map
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(javaw|Krita|NvdaHelper|Jcef_helper|Vmmap|LineAppMgr|bginfo64|SandboxieWUAU|Start)\.exe$/i
| ImageFileName=/\\(ProgramData|Users\\Public|Windows\\Temp|AppData\\Local\\Temp|Downloads|Perflogs|\$Recycle\.Bin)\\/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])

event.type = 'Process Creation' tgt.process.image.path = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.image.path

// HUNT: sideload host executable launched from a user-writable folder
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.001, T1036.005
// CONF: medium | FP: medium
// FALSE POSITIVES: admin tools run from Downloads, per-user app installs, generic Start.exe
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on a Process Creation event: the created process is one of the sideload host executables and its image path is under a user-writable folder. The created process is tgt.process.*. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne Process Creation telemetry with the created process image path
// TUNING: Exclude sanctioned per-user installs by image path, for example under AppData Local Programs. Baseline the SHA256 of your own Vmmap.exe and bginfo64.exe and exclude them with a negated in list on tgt.process.image.sha256.
// LOOKBACK: 30d (set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed host executable is not matched by name.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name matches '^(javaw|Krita|NvdaHelper|Jcef_helper|Vmmap|LineAppMgr|bginfo64|SandboxieWUAU|Start)\\.exe$' tgt.process.image.path matches '\\\\(ProgramData|Users\\\\Public|Windows\\\\Temp|AppData\\\\Local\\\\Temp|Downloads|Perflogs|[$]Recycle\\.Bin)\\\\'
| columns event.time, endpoint.name, src.process.user, tgt.process.image.path, tgt.process.cmdline, src.process.name, tgt.process.image.sha256
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath
| take 5

// HUNT: sideload host executable launched from a user-writable folder
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.001, T1036.005
// CONF: medium | FP: medium
// FALSE POSITIVES: admin tools run from Downloads, per-user app installs, generic Start.exe
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the created process is one of the sideload host executables and its folder path is under a user-writable folder. in~ and contains are case-insensitive, which reproduces the CQL /i intent. The creator is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude sanctioned per-user installs by FolderPath, for example under AppData Local Programs. Baseline the SHA1 of your own Vmmap.exe and bginfo64.exe and exclude them.
// LOOKBACK: 30d (the CQL tab uses the same window)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed host executable is not matched by name.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("javaw.exe", "Krita.exe", "NvdaHelper.exe", "Jcef_helper.exe", "Vmmap.exe", "LineAppMgr.exe", "bginfo64.exe", "SandboxieWUAU.exe", "Start.exe")
| where FolderPath contains "\\ProgramData\\" or FolderPath contains "\\Users\\Public\\" or FolderPath contains "\\Windows\\Temp\\" or FolderPath contains "\\AppData\\Local\\Temp\\" or FolderPath contains "\\Downloads\\" or FolderPath contains "\\Perflogs\\" or FolderPath contains "\\$Recycle.Bin\\"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA1
| sort by Timestamp desc
| take 200

// HUNT: BRONZE SANDCASTLE v1.1.5 C2 domain lookups
// MITRE: T1071.001, T1102
// CONF: high  FP: low  COST: low
// REQUIRES: DNS request telemetry with process context (Falcon sensor, default)
// FALSE POSITIVES: none expected; lookalike domains registered by the actor
// LOOKBACK: 90d
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(cathaypacifice\.com|dpworldto\.com)$/i
| table([@timestamp, aid, ComputerName, UserName, DomainName, ContextBaseFileName, ContextProcessId_decimal])

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, event.type, event.dns.request, src.process.name

// HUNT: BRONZE SANDCASTLE v1.1.5 C2 domain lookups
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1102
// CONF: high | FP: low
// FALSE POSITIVES: none expected; lookalike domains registered by the actor
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on a DNS Resolved event: the looked-up name is either C2 domain or any subdomain of it. The explicit list matches the apex name and the matches clause adds subdomains, which reproduces the CQL boundary anchored suffix match. The resolving process is the acting process, src.process.*.
// REQUIRES: SentinelOne DNS Resolved telemetry with the process context
// TUNING: None needed: the domains are actor-registered lookalikes.
// LOOKBACK: 90d (set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A lookup made through a resolver the sensor does not see, such as DNS over HTTPS from a browser, is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' and (event.dns.request in:anycase ('cathaypacifice.com', 'dpworldto.com') or event.dns.request matches '\\.(cathaypacifice\\.com|dpworldto\\.com)$')
| columns event.time, endpoint.name, src.process.user, event.dns.request, src.process.name, src.process.pid
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: BRONZE SANDCASTLE v1.1.5 C2 domain lookups
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1102
// CONF: high | FP: low
// FALSE POSITIVES: none expected; lookalike domains registered by the actor
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on endpoint DNS responses: the looked-up name is either C2 domain or any subdomain of it. DnsQueryResponse events on DeviceEvents carry the name inside AdditionalFields, read here by bracket access. =~ and endswith with a leading dot reproduce the CQL boundary anchored suffix match.
// REQUIRES: Defender for Endpoint DnsQueryResponse events (DeviceEvents)
// TUNING: None needed: the domains are actor-registered lookalikes.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days; the 90d window of the CQL tab is not reachable here. A lookup made through a resolver the sensor does not see is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where DnsName =~ "cathaypacifice.com" or DnsName =~ "dpworldto.com" or DnsName endswith ".cathaypacifice.com" or DnsName endswith ".dpworldto.com"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, DnsName, InitiatingProcessFileName, InitiatingProcessId
| sort by Timestamp desc
| take 200

// HUNT: sideload host processes contacting abused file-sharing, messaging and GitHub API services
// MITRE: T1102, T1567, T1105
// CONF: medium  FP: medium  COST: low
// REQUIRES: DNS request telemetry with process context (Falcon sensor, default)
// FALSE POSITIVES: Java applications that call the GitHub API from javaw.exe
// TUNING: exclude sanctioned Java apps, e.g. | !(ContextBaseFileName=/^javaw\.exe$/i DomainName=/^api\.github\.com$/i)
// LOOKBACK: 30d
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(file\.io|gofile\.io|ably\.net|ably\.io|api\.github\.com)$/i
| ContextBaseFileName=/^(javaw|Krita|NvdaHelper|Jcef_helper|Vmmap|LineAppMgr|bginfo64|SandboxieWUAU|Start)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, DomainName, ContextBaseFileName, ContextProcessId_decimal])

event.type = 'DNS Resolved' event.dns.request = * src.process.name = *
| limit 5
| columns event.time, event.type, event.dns.request, src.process.name

// HUNT: sideload host processes contacting abused file-sharing, messaging and GitHub API services
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1102, T1567, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: Java applications that call the GitHub API from javaw.exe
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on a DNS Resolved event: the looked-up name is one of the abused service domains or a subdomain, and the resolving process is one of the sideload host executables. The explicit list matches apex names and the matches clause adds subdomains. The resolving process is the acting process, src.process.*.
// REQUIRES: SentinelOne DNS Resolved telemetry with the process context
// TUNING: Exclude sanctioned Java applications, for example javaw.exe resolving api.github.com, by negating that process and name pair.
// LOOKBACK: 30d (set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A lookup made through a resolver the sensor does not see is not captured, and a renamed host executable is not matched by name.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' and (event.dns.request in:anycase ('file.io', 'gofile.io', 'ably.net', 'ably.io', 'api.github.com') or event.dns.request matches '\\.(file\\.io|gofile\\.io|ably\\.net|ably\\.io|api\\.github\\.com)$') and src.process.name matches '^(javaw|Krita|NvdaHelper|Jcef_helper|Vmmap|LineAppMgr|bginfo64|SandboxieWUAU|Start)\\.exe$'
| columns event.time, endpoint.name, src.process.user, event.dns.request, src.process.name, src.process.pid
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields, InitiatingProcessFileName
| take 5

// HUNT: sideload host processes contacting abused file-sharing, messaging and GitHub API services
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1102, T1567, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: Java applications that call the GitHub API from javaw.exe
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on endpoint DNS responses: the looked-up name is one of the abused service domains or a subdomain, and the initiating process is one of the sideload host executables. DnsQueryResponse events on DeviceEvents carry the name inside AdditionalFields, read here by bracket access.
// REQUIRES: Defender for Endpoint DnsQueryResponse events (DeviceEvents)
// TUNING: Exclude sanctioned Java applications, for example javaw.exe resolving api.github.com, by negating that process and name pair.
// LOOKBACK: 30d (the CQL tab uses the same window)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A lookup made through a resolver the sensor does not see is not captured, and a renamed host executable is not matched by name.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| where InitiatingProcessFileName in~ ("javaw.exe", "Krita.exe", "NvdaHelper.exe", "Jcef_helper.exe", "Vmmap.exe", "LineAppMgr.exe", "bginfo64.exe", "SandboxieWUAU.exe", "Start.exe")
| extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where DnsName in~ ("file.io", "gofile.io", "ably.net", "ably.io", "api.github.com") or DnsName endswith ".file.io" or DnsName endswith ".gofile.io" or DnsName endswith ".ably.net" or DnsName endswith ".ably.io" or DnsName endswith ".api.github.com"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, DnsName, InitiatingProcessFileName, InitiatingProcessId
| sort by Timestamp desc
| take 200

// HUNT: shell and discovery tools spawned by sideload host executables
// MITRE: T1087, T1018, T1003.003, T1574.001
// CONF: high  FP: medium  COST: low
// REQUIRES: process creation with parent name (Falcon sensor, default)
// FALSE POSITIVES: Java applications that shell out, generic Start.exe
// TUNING: exclude a known-good Java app with | !(ParentBaseFileName=/^javaw\.exe$/i FileName=/^cmd\.exe$/i)
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(javaw|Krita|NvdaHelper|Jcef_helper|Vmmap|LineAppMgr|bginfo64|SandboxieWUAU|Start)\.exe$/i
| FileName=/^(cmd|powershell|net|net1|vssadmin|whoami|ipconfig|nltest|tasklist|systeminfo|esentutl|ntdsutil)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, ImageFileName])

event.type = 'Process Creation' tgt.process.name = * src.process.name = *
| limit 5
| columns event.time, event.type, src.process.name, tgt.process.name

// HUNT: shell and discovery tools spawned by sideload host executables
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1087, T1018, T1003.003, T1574.001
// CONF: high | FP: medium
// FALSE POSITIVES: Java applications that shell out, generic Start.exe
// EQUIVALENCE: equivalent-with-schema-assumptions - Same lineage predicate on a Process Creation event: the creator is one of the sideload host executables and the created process is a shell or discovery tool. On Process Creation the creator is src.process.* and the created process is tgt.process.*. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne Process Creation telemetry with the creating process name
// TUNING: Exclude a known-good Java application by negating the javaw.exe creator and cmd.exe child pair after a baseline review.
// LOOKBACK: 30d (set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed host executable is not matched by name, and a child launched through a grandchild is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name matches '^(javaw|Krita|NvdaHelper|Jcef_helper|Vmmap|LineAppMgr|bginfo64|SandboxieWUAU|Start)\\.exe$' tgt.process.name matches '^(cmd|powershell|net|net1|vssadmin|whoami|ipconfig|nltest|tasklist|systeminfo|esentutl|ntdsutil)\\.exe$'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.process.image.path
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName
| take 5

// HUNT: shell and discovery tools spawned by sideload host executables
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1087, T1018, T1003.003, T1574.001
// CONF: high | FP: medium
// FALSE POSITIVES: Java applications that shell out, generic Start.exe
// EQUIVALENCE: equivalent-with-schema-assumptions - Same lineage predicate: the creator is one of the sideload host executables and the created process is a shell or discovery tool. The creator is InitiatingProcessFileName and the created process is FileName. in~ is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude a known-good Java application by negating the javaw.exe creator and cmd.exe child pair after a baseline review.
// LOOKBACK: 30d (the CQL tab uses the same window)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed host executable is not matched by name, and a child launched through a grandchild is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName in~ ("javaw.exe", "Krita.exe", "NvdaHelper.exe", "Jcef_helper.exe", "Vmmap.exe", "LineAppMgr.exe", "bginfo64.exe", "SandboxieWUAU.exe", "Start.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "net.exe", "net1.exe", "vssadmin.exe", "whoami.exe", "ipconfig.exe", "nltest.exe", "tasklist.exe", "systeminfo.exe", "esentutl.exe", "ntdsutil.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath
| sort by Timestamp desc
| take 200

// HUNT: vssadmin create shadow (precursor to ntds.dit copy)
// MITRE: T1003.003, T1490
// CONF: medium  FP: medium  COST: low
// REQUIRES: process creation with command line (Falcon sensor, default)
// FALSE POSITIVES: backup and snapshot software, admin maintenance
// TUNING: exclude the backup service account, e.g. | UserName!=/^svc-backup$/i
// TUNING: scope to domain controllers by hostname pattern once your DC naming is known
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^vssadmin\.exe$/i
| CommandLine=/create\s+shadow/i
| table([@timestamp, aid, ComputerName, UserName, CommandLine, ParentBaseFileName])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.cmdline

// HUNT: vssadmin create shadow (precursor to ntds.dit copy)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1003.003, T1490
// CONF: medium | FP: medium
// FALSE POSITIVES: backup and snapshot software, admin maintenance
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on a Process Creation event: the created process is vssadmin.exe and its command line contains create followed by whitespace and shadow. The created process is tgt.process.*. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne Process Creation telemetry with the created process command line
// TUNING: Exclude the backup service account by src.process.user, and scope to domain controllers by host name once your naming is known.
// LOOKBACK: 30d (set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Shadow copies created through WMI or the VSS API without vssadmin.exe are not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name matches '^vssadmin\\.exe$' tgt.process.cmdline matches 'create\\s+shadow'
| columns event.time, endpoint.name, src.process.user, tgt.process.cmdline, src.process.name
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: vssadmin create shadow (precursor to ntds.dit copy)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1003.003, T1490
// CONF: medium | FP: medium
// FALSE POSITIVES: backup and snapshot software, admin maintenance
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the created process is vssadmin.exe and its command line matches create, whitespace, shadow. The case-insensitive regex prefix reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude the backup service account by AccountName, and scope to domain controllers by DeviceName once your naming is known.
// LOOKBACK: 30d (the CQL tab uses the same window)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Shadow copies created through WMI or the VSS API without vssadmin.exe are not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName =~ "vssadmin.exe"
| where ProcessCommandLine matches regex @"(?i)create\\s+shadow"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: ntds.dit referenced in a command line by a copy-capable tool
// MITRE: T1003.003
// CONF: high  FP: medium  COST: low
// REQUIRES: process creation with command line (Falcon sensor, default)
// FALSE POSITIVES: ntdsutil IFM creation, AD health tooling, backup software
// TUNING: exclude the AD admin accounts that run IFM during change windows, e.g. | UserName!=/^adm-ifm$/i
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/ntds\.dit/i
| FileName=/^(cmd|powershell|pwsh|copy|xcopy|robocopy|esentutl|ntdsutil|vssadmin|7z|rar)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.cmdline

// HUNT: ntds.dit referenced in a command line by a copy-capable tool
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1003.003
// CONF: high | FP: medium
// FALSE POSITIVES: ntdsutil IFM creation, AD health tooling, backup software
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on a Process Creation event: the created process is a copy-capable tool and its command line contains ntds.dit. The created process is tgt.process.*. contains and matches are case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne Process Creation telemetry with the created process command line
// TUNING: Exclude the AD admin accounts that run IFM during change windows by src.process.user.
// LOOKBACK: 30d (set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A copy tool outside the listed names, or an ntds.dit path built at run time, is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.cmdline contains 'ntds.dit' tgt.process.name matches '^(cmd|powershell|pwsh|copy|xcopy|robocopy|esentutl|ntdsutil|vssadmin|7z|rar)\\.exe$'
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: ntds.dit referenced in a command line by a copy-capable tool
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1003.003
// CONF: high | FP: medium
// FALSE POSITIVES: ntdsutil IFM creation, AD health tooling, backup software
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the created process is a copy-capable tool and its command line contains ntds.dit. contains and in~ are case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude the AD admin accounts that run IFM during change windows by AccountName.
// LOOKBACK: 30d (the CQL tab uses the same window)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A copy tool outside the listed names, or an ntds.dit path built at run time, is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine contains "ntds.dit"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "copy.exe", "xcopy.exe", "robocopy.exe", "esentutl.exe", "ntdsutil.exe", "vssadmin.exe", "7z.exe", "rar.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200