CikaBika Bot: Discord RAT via Nim Loader and Edge DLL Sideload

// HUNT: PowerShell Reading a PDF as Bytes and XOR-Decoding an Embedded Executable
// MITRE: T1204.002, T1059.001, T1140, T1027.013
// CONF: medium  FP: low  COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2
// FALSE POSITIVES: PDF-processing admin scripts that read bytes are rare; legitimate use almost never pairs a PDF path with a bitwise XOR
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^powershell(\.exe)?$/i
| CommandLine=/\.pdf/i
| CommandLine=/(ReadAllBytes|-bxor|AsByteStream|Encoding\s+Byte)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: PowerShell Reading a PDF as Bytes and XOR-Decoding an Embedded Executable
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.002, T1059.001, T1140, T1027.013
// CONF: medium | FP: low
// FALSE POSITIVES: PDF-processing admin scripts that read bytes are rare; legitimate use almost never pairs a PDF path with a bitwise XOR
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: PowerShell by name, a .pdf in the command line, and one of the byte-read or XOR markers. Lineage re-mapped for SentinelOne.
// REQUIRES: SentinelOne Process Creation telemetry with command lines
// TUNING: PDF-processing admin scripts are rare; exclude a reviewed script by its full command line.
// LOOKBACK: 7d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A script that reads the PDF through a file path built at run time and never shows .pdf on the command line is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name matches '^powershell(\\.exe)?$'
tgt.process.cmdline contains '.pdf'
tgt.process.cmdline matches '(ReadAllBytes|-bxor|AsByteStream|Encoding\\s+Byte)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, agent.uuid
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: PowerShell Reading a PDF as Bytes and XOR-Decoding an Embedded Executable
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.002, T1059.001, T1140, T1027.013
// CONF: medium | FP: low
// FALSE POSITIVES: PDF-processing admin scripts that read bytes are rare; legitimate use almost never pairs a PDF path with a bitwise XOR
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: PowerShell by name, a .pdf in the command line, and one of the byte-read or XOR markers. The parent is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: PDF-processing admin scripts are rare; exclude a reviewed script by its full command line.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A script that builds the PDF path at run time and never shows .pdf on the command line is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName matches regex @"(?i)^powershell(\.exe)?$"
| where ProcessCommandLine contains ".pdf"
| where ProcessCommandLine matches regex @"(?i)(ReadAllBytes|-bxor|AsByteStream|Encoding\s+Byte)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Published CikaBika Lure and Loader Filenames
// MITRE: T1204.002, T1036.007, T1036.005
// CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2, PeFileWritten, NewExecutableWritten
// FALSE POSITIVES: none expected for IfyuUapz; the Proposition_Projet and Presentation_Generale strings are generic French business wording, so a hit on those alone needs a look at the file type and path
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| CommandLine=/(IfyuUapz|Proposition_Projet|Presentation_Generale)/i or FileName=/IfyuUapz/i or ParentBaseFileName=/IfyuUapz/i or TargetFileName=/(IfyuUapz|Proposition_Projet|Presentation_Generale)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, TargetFileName, MD5HashData, SHA256HashData])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.file.path

// HUNT: Published CikaBika Lure and Loader Filenames
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.002, T1036.007, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected for IfyuUapz; the Proposition_Projet and Presentation_Generale strings are generic French business wording, so a hit on those alone needs a look at the file type and path
// EQUIVALENCE: equivalent-with-schema-assumptions - Same name test on command lines, created and creating process names, and (PE writes mapped to File Creation) written file paths. Only the loader name is tested against process names, as in the CQL.
// REQUIRES: SentinelOne Process Creation and File Creation telemetry
// TUNING: A hit on Proposition_Projet or Presentation_Generale alone is generic French business wording: check the file type and path before escalating.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A lure name that exists only inside an archive or in a field the agent does not record is not captured.
// VALIDATION LEVEL: static-reviewed
(event.type = 'Process Creation' (tgt.process.cmdline contains ('IfyuUapz','Proposition_Projet','Presentation_Generale') or tgt.process.name contains 'IfyuUapz' or src.process.name contains 'IfyuUapz')) or (event.type = 'File Creation' tgt.file.path contains ('IfyuUapz','Proposition_Projet','Presentation_Generale'))
| columns event.type, event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.file.path, tgt.file.md5, tgt.file.sha256, agent.uuid
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine, FolderPath
| take 5

// HUNT: Published CikaBika Lure and Loader Filenames
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.002, T1036.007, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected for IfyuUapz; the Proposition_Projet and Presentation_Generale strings are generic French business wording, so a hit on those alone needs a look at the file type and path
// EQUIVALENCE: telemetry-gap - Partial pivot: DeviceProcessEvents covers the lure names on a created process (command line, name, path, creator), not the written-file half the CQL also tests.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: A hit on Proposition_Projet or Presentation_Generale alone is generic French business wording: check the file type and path before escalating.
// LOOKBACK: 30d; extend only within Advanced Hunting retention
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The written-file half of the CQL (a lure file written but never executed) is not covered; run a DeviceFileEvents search on FileName for the same three names.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine contains "IfyuUapz" or ProcessCommandLine contains "Proposition_Projet" or ProcessCommandLine contains "Presentation_Generale" or FileName contains "IfyuUapz" or FolderPath contains "IfyuUapz" or InitiatingProcessFileName contains "IfyuUapz"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, SHA1, MD5
| sort by Timestamp desc
| take 200

// HUNT: PE Image Written to Temp With a Non-Executable Extension
// MITRE: T1036.005, T1027, T1140
// CONF: medium  FP: medium  COST: low
// REQUIRES: PeFileWritten, NewExecutableWritten
// FALSE POSITIVES: installers and self-extractors occasionally stage binaries with odd extensions in Temp
// TUNING: exclude the writing process for your software-deployment agent and known installer parents after a 30-day baseline; an extension-disguised PE written by powershell.exe, cmd.exe or a user-profile process is the high-confidence tier
// LOOKBACK: 7d
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| TargetFileName=/\\(AppData\\Local\\Temp|Windows\\Temp)\\[^\\]+\.(txt|pdf|png|jpg|log)$/i
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, TargetFileName, MD5HashData, SHA256HashData])

event.type = 'File Creation'
| limit 5
| columns event.type

// HUNT: PE Image Written to Temp With a Non-Executable Extension
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1036.005, T1027, T1140
// CONF: medium | FP: medium
// FALSE POSITIVES: installers and self-extractors occasionally stage binaries with odd extensions in Temp
// EQUIVALENCE: unsupported-without-redesign - A PE image written under a document or text extension cannot be told from any other file in a SentinelOne File Creation event: there is no attested PE-type field, so the extension test alone would match every log and text file in Temp.
// REQUIRES: A file-type or PE-header field on File Creation events
// TUNING: Use the CQL tab, or hunt Q9 and Q10 for the specific staging files.
// LOOKBACK: 7d on the CQL tab
// CONFIGURATION: Use the CQL tab for this card.
// KNOWN GAPS: A file's real type (PE image) is not visible in the attested field model, so the disguised-extension test cannot be made precise.
// VALIDATION LEVEL: static-reviewed

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp
| take 5

// HUNT: PE Image Written to Temp With a Non-Executable Extension
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1036.005, T1027, T1140
// CONF: medium | FP: medium
// FALSE POSITIVES: installers and self-extractors occasionally stage binaries with odd extensions in Temp
// EQUIVALENCE: unsupported-without-redesign - DeviceFileEvents has no PE-type column, so an executable written under a document or text extension cannot be separated from ordinary logs and documents in Temp.
// REQUIRES: A PE-type column on file write events
// TUNING: Use the CQL tab, or hunt Q9 and Q10 for the specific staging files.
// LOOKBACK: 7d on the CQL tab
// CONFIGURATION: Use the CQL tab for this card.
// KNOWN GAPS: A file's real type (PE image) is not visible in DeviceFileEvents, so the disguised-extension test cannot be made precise.
// VALIDATION LEVEL: static-reviewed

// HUNT: Published CikaBika MD5 Hashes
// MITRE: T1204.002, T1027, T1574.001
// CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2, PeFileWritten, NewExecutableWritten
// FALSE POSITIVES: none expected. Single-source (Darktrace) hashes of campaign-specific files
// LOOKBACK: 90d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| MD5HashData=/^(2deb724a709b0b892248405323350e9b|c66858718d883bcfb9ce2c19b59f96c9|62e3e85eca78a0cd7e6669e9f33d936d|eeb52cb95113a131c2c7713c17872da6)$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, TargetFileName, MD5HashData, SHA256HashData])

event.type = 'Process Creation' tgt.process.image.md5 = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.process.image.md5, tgt.file.md5

// HUNT: Published CikaBika MD5 Hashes
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.002, T1027, T1574.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected. Single-source (Darktrace) hashes of campaign-specific files
// EQUIVALENCE: equivalent-with-schema-assumptions - Same four published MD5 values tested on the created image of a process and on the written file. in:anycase reproduces the CQL /i flag.
// REQUIRES: SentinelOne Process Creation and File Creation events with MD5 populated
// TUNING: Hashes change on rebuild; treat a miss as no evidence. The values are single-sourced.
// LOOKBACK: 90d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A rebuilt payload with a different MD5 is not captured. The values come from one vendor report and may not be re-observed.
// VALIDATION LEVEL: static-reviewed
(event.type = 'Process Creation' tgt.process.image.md5 in:anycase ('2deb724a709b0b892248405323350e9b','c66858718d883bcfb9ce2c19b59f96c9','62e3e85eca78a0cd7e6669e9f33d936d','eeb52cb95113a131c2c7713c17872da6')) or (event.type = 'File Creation' tgt.file.md5 in:anycase ('2deb724a709b0b892248405323350e9b','c66858718d883bcfb9ce2c19b59f96c9','62e3e85eca78a0cd7e6669e9f33d936d','eeb52cb95113a131c2c7713c17872da6'))
| columns event.type, event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.md5, tgt.file.path, tgt.file.md5, tgt.file.sha256, agent.uuid
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, MD5, FileName, FolderPath
| take 5

// HUNT: Published CikaBika MD5 Hashes
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.002, T1027, T1574.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected. Single-source (Darktrace) hashes of campaign-specific files
// EQUIVALENCE: telemetry-gap - Partial pivot: the four published MD5 values are tested on files written (DeviceFileEvents). The execution half the CQL also tests, a process image with the same MD5, is not covered.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: Hashes change on rebuild; treat a miss as no evidence. The values are single-sourced.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days; the CQL tab covers 90d, so older writes are only on the CQL tab. A process image that was never written inside the window is not covered; search DeviceProcessEvents on MD5 for the same four values.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where MD5 in~ ("2deb724a709b0b892248405323350e9b", "c66858718d883bcfb9ce2c19b59f96c9", "62e3e85eca78a0cd7e6669e9f33d936d", "eeb52cb95113a131c2c7713c17872da6")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FileName, FolderPath, MD5, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: regsvr32 Registering a DLL From Temp, ProgramData or Public
// MITRE: T1218.010, T1574.001
// CONF: low  FP: medium  COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2
// FALSE POSITIVES: installers and legacy line-of-business software register DLLs from Temp during setup
// TUNING: exclude msiexec.exe and your deployment agent as ParentBaseFileName; prioritise hits whose parent is a Temp-resident or user-profile binary
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^regsvr32(\.exe)?$/i
| CommandLine=/\\(AppData\\Local\\Temp|Windows\\Temp|ProgramData|Users\\Public)\\/i
| ParentBaseFileName!=/^msiexec\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: regsvr32 Registering a DLL From Temp, ProgramData or Public
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1218.010, T1574.001
// CONF: low | FP: medium
// FALSE POSITIVES: installers and legacy line-of-business software register DLLs from Temp during setup
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: regsvr32 by name, a command line naming Temp, ProgramData or Users\Public, and a creator that is not msiexec. Lineage re-mapped for SentinelOne.
// REQUIRES: SentinelOne Process Creation telemetry with command lines
// TUNING: Exclude msiexec and your deployment agent as the creator (src.process.name); prioritise hits whose creator is a Temp-resident or user-profile binary.
// LOOKBACK: 7d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A DLL registered by a process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name matches '^regsvr32(\\.exe)?$'
tgt.process.cmdline matches '\\\\(AppData\\\\Local\\\\Temp|Windows\\\\Temp|ProgramData|Users\\\\Public)\\\\'
!(src.process.name matches '^msiexec\\.exe$')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, agent.uuid
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine, InitiatingProcessFileName
| take 5

// HUNT: regsvr32 Registering a DLL From Temp, ProgramData or Public
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1218.010, T1574.001
// CONF: low | FP: medium
// FALSE POSITIVES: installers and legacy line-of-business software register DLLs from Temp during setup
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: regsvr32 by name, a command line naming Temp, ProgramData or Users\Public, and a creator that is not msiexec. The creator is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude msiexec and your deployment agent as the initiating process; prioritise hits whose parent is a Temp-resident or user-profile binary.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A DLL registered by a process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName matches regex @"(?i)^regsvr32(\.exe)?$"
| where ProcessCommandLine contains "\\AppData\\Local\\Temp\\" or ProcessCommandLine contains "\\Windows\\Temp\\" or ProcessCommandLine contains "\\ProgramData\\" or ProcessCommandLine contains "\\Users\\Public\\"
| where InitiatingProcessFileName !~ "msiexec.exe"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: HKCU ms-settings Shell Open Command Hijack
// MITRE: T1548.002, T1112
// CONF: high  FP: medium  COST: low
// REQUIRES: AsepValueUpdate, RegGenericValueUpdate
// FALSE POSITIVES: very few legitimate products write this key; red-team and pen-test tooling does
// TUNING: exclude authorised test hosts by aid; any write whose RegStringValue points to a Temp, ProgramData or cmd/powershell command is the high-confidence tier
// LOOKBACK: 30d
#event_simpleName=/^(AsepValueUpdate|RegGenericValueUpdate)$/
| RegObjectName=/\\ms-settings\\shell\\open\\command/i
| table([@timestamp, aid, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, ContextBaseFileName])

event.type = 'Registry Value Modified' registry.keyPath = *
| limit 5
| columns event.type, event.time, endpoint.name, registry.keyPath

// HUNT: HKCU ms-settings Shell Open Command Hijack
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1548.002, T1112
// CONF: high | FP: medium
// FALSE POSITIVES: very few legitimate products write this key; red-team and pen-test tooling does
// EQUIVALENCE: equivalent-with-schema-assumptions - Same key-path test for the ms-settings shell open command on registry value writes. The acting process is src.process.* on registry events.
// REQUIRES: SentinelOne Registry Value Modified telemetry
// TUNING: Exclude authorised test hosts by agent.uuid; any write whose registry.value points to a Temp, ProgramData or shell command is the high-confidence tier.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A registry write made through a path the agent does not record is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified'
registry.keyPath contains '\\ms-settings\\shell\\open\\command'
| columns event.time, endpoint.name, src.process.user, registry.keyPath, registry.valueName, registry.value, src.process.name, agent.uuid
| limit 200

DeviceRegistryEvents
| where Timestamp > ago(1d) | where ActionType == "RegistryValueSet"
| project Timestamp, ActionType, RegistryKey
| take 5

// HUNT: HKCU ms-settings Shell Open Command Hijack
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1548.002, T1112
// CONF: high | FP: medium
// FALSE POSITIVES: very few legitimate products write this key; red-team and pen-test tooling does
// EQUIVALENCE: equivalent-with-schema-assumptions - Same key-path test for the ms-settings shell open command on registry value writes (RegistryValueSet).
// REQUIRES: Defender for Endpoint registry telemetry (DeviceRegistryEvents)
// TUNING: Exclude authorised test hosts by DeviceId; any write whose RegistryValueData points to a Temp, ProgramData or shell command is the high-confidence tier.
// LOOKBACK: 30d; extend only within Advanced Hunting retention
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A key created without a value write is not covered.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceRegistryEvents
| where Timestamp >= ago(30d)
| where ActionType == "RegistryValueSet"
| where RegistryKey contains "\\ms-settings\\shell\\open\\command"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: ms-settings Hijack Command Referencing dbghelp or the Edge Application Directory
// MITRE: T1548.002, T1574.001, T1112
// CONF: high  FP: low  COST: low
// REQUIRES: AsepValueUpdate, RegGenericValueUpdate
// FALSE POSITIVES: none expected. A UAC-bypass command that mentions dbghelp or the Edge install path is campaign behavior
// LOOKBACK: 30d
#event_simpleName=/^(AsepValueUpdate|RegGenericValueUpdate)$/
| RegObjectName=/\\ms-settings\\shell\\open\\command/i
| RegStringValue=/(dbghelp|\\Microsoft\\Edge\\Application)/i
| table([@timestamp, aid, ComputerName, UserName, RegObjectName, RegStringValue, ContextBaseFileName])

event.type = 'Registry Value Modified' registry.keyPath = * registry.value = *
| limit 5
| columns event.type, event.time, endpoint.name, registry.keyPath, registry.value

// HUNT: ms-settings Hijack Command Referencing dbghelp or the Edge Application Directory
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1548.002, T1574.001, T1112
// CONF: high | FP: low
// FALSE POSITIVES: none expected. A UAC-bypass command that mentions dbghelp or the Edge install path is campaign behavior
// EQUIVALENCE: equivalent-with-schema-assumptions - Same two-part test: the ms-settings shell open command key and a written value that names dbghelp or the Edge Application directory.
// REQUIRES: SentinelOne Registry Value Modified telemetry
// TUNING: No exclusions expected; the pairing is campaign behavior.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A command that moves the file through a different name or an environment variable is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified'
registry.keyPath contains '\\ms-settings\\shell\\open\\command'
registry.value contains ('dbghelp','\\Microsoft\\Edge\\Application')
| columns event.time, endpoint.name, src.process.user, registry.keyPath, registry.value, src.process.name, agent.uuid
| limit 200

DeviceRegistryEvents
| where Timestamp > ago(1d) | where ActionType == "RegistryValueSet"
| project Timestamp, ActionType, RegistryKey, RegistryValueData
| take 5

// HUNT: ms-settings Hijack Command Referencing dbghelp or the Edge Application Directory
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1548.002, T1574.001, T1112
// CONF: high | FP: low
// FALSE POSITIVES: none expected. A UAC-bypass command that mentions dbghelp or the Edge install path is campaign behavior
// EQUIVALENCE: equivalent-with-schema-assumptions - Same two-part test: the ms-settings shell open command key and a written value that names dbghelp or the Edge Application directory.
// REQUIRES: Defender for Endpoint registry telemetry (DeviceRegistryEvents)
// TUNING: No exclusions expected; the pairing is campaign behavior.
// LOOKBACK: 30d; extend only within Advanced Hunting retention
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A command that moves the file through a different name or an environment variable is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceRegistryEvents
| where Timestamp >= ago(30d)
| where ActionType == "RegistryValueSet"
| where RegistryKey contains "\\ms-settings\\shell\\open\\command"
| where RegistryValueData contains "dbghelp" or RegistryValueData contains "\\Microsoft\\Edge\\Application"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueData, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: computerdefaults.exe Parent of a Command Interpreter or File-Move Utility
// MITRE: T1548.002
// CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2
// FALSE POSITIVES: none expected from a standard Windows build
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^computerdefaults(\.exe)?$/i
| FileName!=/^(SystemSettings|ApplicationFrameHost)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' src.process.name = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: computerdefaults.exe Parent of a Command Interpreter or File-Move Utility
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1548.002
// CONF: high | FP: low
// FALSE POSITIVES: none expected from a standard Windows build
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: computerdefaults as the creator and any child other than the two expected Windows hosts. Lineage re-mapped for SentinelOne.
// REQUIRES: SentinelOne Process Creation telemetry
// TUNING: No exclusions expected on a standard Windows build.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A child launched by a process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
src.process.name matches '^computerdefaults(\\.exe)?$'
!(tgt.process.name matches '^(SystemSettings|ApplicationFrameHost)\\.exe$')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, agent.uuid
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, InitiatingProcessFileName
| take 5

// HUNT: computerdefaults.exe Parent of a Command Interpreter or File-Move Utility
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1548.002
// CONF: high | FP: low
// FALSE POSITIVES: none expected from a standard Windows build
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: computerdefaults as the creator and any child other than the two expected Windows hosts. The creator is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: No exclusions expected on a standard Windows build.
// LOOKBACK: 30d; extend only within Advanced Hunting retention
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A child launched by a process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName matches regex @"(?i)^computerdefaults(\.exe)?$"
| where FileName !in~ ("SystemSettings.exe", "ApplicationFrameHost.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: dbghelp.tmp Staging File in Windows\Temp
// MITRE: T1574.001, T1074.001, T1036.005
// CONF: high  FP: low  COST: low
// REQUIRES: PeFileWritten, NewExecutableWritten, ProcessRollup2, SyntheticProcessRollup2
// FALSE POSITIVES: none expected; a dbghelp.tmp in Windows\Temp is not a normal product artifact (validate once on your baseline)
// LOOKBACK: 30d
#event_simpleName=/^(PeFileWritten|NewExecutableWritten|ProcessRollup2|SyntheticProcessRollup2)$/
| TargetFileName=/\\Windows\\Temp\\dbghelp\.tmp$/i or CommandLine=/dbghelp\.tmp/i
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, FileName, TargetFileName, CommandLine, MD5HashData, SHA256HashData])

event.type = 'File Creation' tgt.file.path = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.file.path, tgt.process.cmdline

// HUNT: dbghelp.tmp Staging File in Windows\Temp
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.001, T1074.001, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected; a dbghelp.tmp in Windows\Temp is not a normal product artifact (validate once on your baseline)
// EQUIVALENCE: equivalent-with-schema-assumptions - Same two-part test: a dbghelp.tmp file written under Windows\Temp, or a process command line that names dbghelp.tmp. PE-write events map to File Creation.
// REQUIRES: SentinelOne File Creation and Process Creation telemetry
// TUNING: Validate once on your baseline; a dbghelp.tmp in Windows\Temp is not a normal product artifact.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A staging file renamed before it is written is not captured.
// VALIDATION LEVEL: static-reviewed
(event.type = 'File Creation' tgt.file.path matches '\\\\Windows\\\\Temp\\\\dbghelp\\.tmp$') or (event.type = 'Process Creation' tgt.process.cmdline contains 'dbghelp.tmp')
| columns event.type, event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.file.path, tgt.process.cmdline, tgt.file.md5, tgt.file.sha256, agent.uuid
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath
| take 5

// HUNT: dbghelp.tmp Staging File in Windows\Temp
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.001, T1074.001, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected; a dbghelp.tmp in Windows\Temp is not a normal product artifact (validate once on your baseline)
// EQUIVALENCE: telemetry-gap - Partial pivot: the dbghelp.tmp file written under Windows\Temp (DeviceFileEvents). The CQL's second branch, a process command line naming dbghelp.tmp, is not covered.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: Validate once on your baseline; a dbghelp.tmp in Windows\Temp is not a normal product artifact.
// LOOKBACK: 30d; extend only within Advanced Hunting retention
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The process command-line branch (a command that names dbghelp.tmp) is not covered; search DeviceProcessEvents on ProcessCommandLine for it.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where FileName =~ "dbghelp.tmp"
| where FolderPath endswith "\\Windows\\Temp\\dbghelp.tmp"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FileName, FolderPath, MD5, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: dbghelp.dll Written Beside msedge.exe in the Edge Application Directory
// MITRE: T1574.001, T1036.005
// CONF: high  FP: medium  COST: low
// REQUIRES: PeFileWritten, NewExecutableWritten
// FALSE POSITIVES: not expected from Edge servicing, which writes into versioned subfolders; validate against one clean reference host before alerting broadly
// TUNING: on a hit, confirm the file is unsigned or not Microsoft-signed and compare MD5HashData to the published value (Q4); exclude the Edge updater writer only after confirming it on your own baseline
// LOOKBACK: 30d
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| TargetFileName=/\\Program Files( \(x86\))?\\Microsoft\\Edge\\Application\\dbghelp\.dll$/i
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, TargetFileName, MD5HashData, SHA256HashData])

event.type = 'File Creation' tgt.file.path = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.file.path

// HUNT: dbghelp.dll Written Beside msedge.exe in the Edge Application Directory
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.001, T1036.005
// CONF: high | FP: medium
// FALSE POSITIVES: not expected from Edge servicing, which writes into versioned subfolders; validate against one clean reference host before alerting broadly
// EQUIVALENCE: equivalent-with-schema-assumptions - Same exact-path test for dbghelp.dll written directly into the Edge Application directory under either Program Files root.
// REQUIRES: SentinelOne File Creation telemetry
// TUNING: On a hit, confirm the file is unsigned or not Microsoft-signed and compare tgt.file.md5 to the published values in Q4; exclude the Edge updater writer only after confirming it on your own baseline.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A DLL placed into a versioned subfolder is outside this test, as in the CQL.
// VALIDATION LEVEL: static-reviewed
event.type = 'File Creation'
tgt.file.path matches '\\\\Program Files( \\(x86\\))?\\\\Microsoft\\\\Edge\\\\Application\\\\dbghelp\\.dll$'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.file.path, tgt.file.md5, tgt.file.sha256, agent.uuid
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath
| take 5

// HUNT: dbghelp.dll Written Beside msedge.exe in the Edge Application Directory
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.001, T1036.005
// CONF: high | FP: medium
// FALSE POSITIVES: not expected from Edge servicing, which writes into versioned subfolders; validate against one clean reference host before alerting broadly
// EQUIVALENCE: equivalent-with-schema-assumptions - Same exact-path test for dbghelp.dll written directly into the Edge Application directory under a Program Files root.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: On a hit, confirm the file is unsigned or not Microsoft-signed and compare MD5 to the published values in Q4; exclude the Edge updater writer only after confirming it on your own baseline.
// LOOKBACK: 30d; extend only within Advanced Hunting retention
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A DLL placed into a versioned subfolder is outside this test, as in the CQL.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where FileName =~ "dbghelp.dll"
| where FolderPath contains "\\Program Files" and FolderPath endswith "\\Microsoft\\Edge\\Application\\dbghelp.dll"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FileName, FolderPath, MD5, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: msedge.exe Parent of a Shell or Recon Utility
// MITRE: T1574.001, T1059.003, T1057, T1016
// CONF: low  FP: medium  COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2
// FALSE POSITIVES: native-messaging helpers and enterprise extensions can launch cmd.exe from the browser
// TUNING: baseline for 30 days and exclude the specific CommandLine of known native-messaging hosts; keep any hit whose child is tasklist.exe, ipconfig.exe or an encoded PowerShell
// LOOKBACK: 14d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^msedge\.exe$/i
| FileName=/^(cmd|powershell|pwsh|tasklist|ipconfig|regsvr32|systeminfo|whoami)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' src.process.name = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: msedge.exe Parent of a Shell or Recon Utility
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.001, T1059.003, T1057, T1016
// CONF: low | FP: medium
// FALSE POSITIVES: native-messaging helpers and enterprise extensions can launch cmd.exe from the browser
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: msedge as the creator and a shell or recon utility as the child. Lineage re-mapped for SentinelOne.
// REQUIRES: SentinelOne Process Creation telemetry
// TUNING: Baseline for 30 days and exclude the specific tgt.process.cmdline of known native-messaging hosts; keep any hit whose child is tasklist, ipconfig or an encoded PowerShell.
// LOOKBACK: 14d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A recon tool launched through a helper that is not on the child list is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
src.process.name matches '^msedge\\.exe$'
tgt.process.name matches '^(cmd|powershell|pwsh|tasklist|ipconfig|regsvr32|systeminfo|whoami)\\.exe$'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, agent.uuid
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, InitiatingProcessFileName
| take 5

// HUNT: msedge.exe Parent of a Shell or Recon Utility
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.001, T1059.003, T1057, T1016
// CONF: low | FP: medium
// FALSE POSITIVES: native-messaging helpers and enterprise extensions can launch cmd.exe from the browser
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: msedge as the creator and a shell or recon utility as the child. The creator is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Baseline for 30 days and exclude the specific ProcessCommandLine of known native-messaging hosts; keep any hit whose child is tasklist, ipconfig or an encoded PowerShell.
// LOOKBACK: 14d; extend only within Advanced Hunting retention
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A recon tool launched through a helper that is not on the child list is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where InitiatingProcessFileName =~ "msedge.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "tasklist.exe", "ipconfig.exe", "regsvr32.exe", "systeminfo.exe", "whoami.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: tasklist.exe and ipconfig.exe Under the Same Parent Process
// MITRE: T1057, T1016, T1082
// CONF: low  FP: medium  COST: medium
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2
// FALSE POSITIVES: inventory scripts and RMM agents run both tools routinely
// TUNING: exclude your RMM and inventory agents by ParentBaseFileName after a baseline; weight hits whose parent is a user-profile binary or msedge.exe
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(tasklist|ipconfig)\.exe$/i
| ParentBaseFileName!=/^(explorer|WindowsTerminal|conhost)\.exe$/i
| groupBy([aid, ParentProcessId], function=[count(FileName, distinct=true, as=distinctTools), collect([ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])])
| distinctTools > 1

event.type = 'Process Creation' tgt.process.name = * src.process.pid = *
| limit 5
| columns event.type, event.time, endpoint.name, agent.uuid, src.process.pid, src.process.name, tgt.process.name

// HUNT: tasklist.exe and ipconfig.exe Under the Same Parent Process
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1057, T1016, T1082
// CONF: low | FP: medium
// FALSE POSITIVES: inventory scripts and RMM agents run both tools routinely
// EQUIVALENCE: approximate-analytic - Same idea as the CQL: two different recon tools under one creating process on one host. The grouping key is agent.uuid plus the creator's process ID, and the distinct count is an estimate over lower-cased names.
// REQUIRES: SentinelOne Process Creation telemetry
// TUNING: Exclude your RMM and inventory agents by src.process.name after a baseline; weight hits whose creator is a user-profile binary or msedge.
// LOOKBACK: 7d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: PID reuse inside the time range can group two unrelated creators. The CQL groups on its own parent process ID field; the PowerQuery groups on the creator's PID, which is the same concept.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name matches '^(tasklist|ipconfig)\\.exe$'
!(src.process.name matches '^(explorer|WindowsTerminal|conhost)\\.exe$')
| let tool_name = lower(tgt.process.name)
| group process_events = count(), tool_count = estimate_distinct(tool_name), first_seen = min(event.time), last_seen = max(event.time), host = any(endpoint.name), user_name = any(src.process.user), parent_name = any(src.process.name), sample_cmdline = any(tgt.process.cmdline) by agent.uuid, src.process.pid
| filter tool_count > 1
| sort -last_seen
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceId, InitiatingProcessId, FileName, InitiatingProcessFileName
| take 5

// HUNT: tasklist.exe and ipconfig.exe Under the Same Parent Process
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1057, T1016, T1082
// CONF: low | FP: medium
// FALSE POSITIVES: inventory scripts and RMM agents run both tools routinely
// EQUIVALENCE: approximate-analytic - Same idea as the CQL: two different recon tools under one creating process on one device. The grouping key is DeviceId plus the creator's process ID, and the distinct count is over lower-cased names.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude your RMM and inventory agents by InitiatingProcessFileName after a baseline; weight hits whose creator is a user-profile binary or msedge.
// LOOKBACK: 7d; extend only within Advanced Hunting retention
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: PID reuse inside the time range can group two unrelated creators.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ("tasklist.exe", "ipconfig.exe")
| where InitiatingProcessFileName !in~ ("explorer.exe", "WindowsTerminal.exe", "conhost.exe")
| summarize ProcessEvents = count(), DistinctTools = dcount(tolower(FileName)), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Host = any(DeviceName), ParentName = any(InitiatingProcessFileName), Commands = make_set(ProcessCommandLine, 5) by DeviceId, InitiatingProcessId
| where DistinctTools > 1
| sort by LastSeen desc
| take 200

// HUNT: Discord Domain Lookup by an Unexpected Process
// MITRE: T1102.002, T1071.001
// CONF: medium  FP: medium  COST: medium
// REQUIRES: DnsRequest, NetworkConnectIP4
// FALSE POSITIVES: any app embedding the Discord SDK, game launchers, and bot or webhook integrations run by IT
// TUNING: baseline the processes that legitimately reach Discord, then exclude them by ContextBaseFileName; prioritise user-profile or Temp binaries, msedge.exe, powershell.exe and unsigned images. Do not turn Discord domains into IOC blocks
// LOOKBACK: 7d
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(discord\.com|discordapp\.com|discord\.gg|discordapp\.net)$/i
| join(query={#event_simpleName=NetworkConnectIP4}, field=[aid, ContextProcessId_decimal], include=[ContextBaseFileName, RemoteAddressIP4, RemotePort], mode=left)
| ContextBaseFileName!=/^(chrome|msedge|firefox|brave|opera|iexplore|discord|update|ms-teams|teams|slack)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, DomainName, ContextBaseFileName, RemoteAddressIP4, RemotePort])

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.type, event.time, endpoint.name, event.dns.request, src.process.name

// HUNT: Discord Domain Lookup by an Unexpected Process
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1102.002, T1071.001
// CONF: medium | FP: medium
// FALSE POSITIVES: any app embedding the Discord SDK, game launchers, and bot or webhook integrations run by IT
// EQUIVALENCE: approximate-analytic - The CQL joins DNS requests to network connections to learn the process; a SentinelOne DNS Resolved event already names the acting process, so the join is dropped and the remote address and port columns are not returned.
// REQUIRES: SentinelOne DNS Resolved telemetry with the acting process
// TUNING: Baseline the processes that legitimately reach Discord, then exclude them by src.process.name; prioritise user-profile or Temp binaries, msedge, powershell and unsigned images. Do not turn Discord domains into IOC blocks.
// LOOKBACK: 7d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: The remote address and port the CQL returns from the connection join are not returned. Lookups made through an encrypted resolver that bypasses the host stack are not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved'
event.dns.request matches '(^|\\.)(discord\\.com|discordapp\\.com|discord\\.gg|discordapp\\.net)$'
!(src.process.name matches '^(chrome|msedge|firefox|brave|opera|iexplore|discord|update|ms-teams|teams|slack)\\.exe$')
| columns event.time, endpoint.name, src.process.user, event.dns.request, src.process.name, src.process.image.path, agent.uuid
| limit 200

DeviceEvents
| where Timestamp > ago(1d) | where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields, InitiatingProcessFileName
| take 5

// HUNT: Discord Domain Lookup by an Unexpected Process
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1102.002, T1071.001
// CONF: medium | FP: medium
// FALSE POSITIVES: any app embedding the Discord SDK, game launchers, and bot or webhook integrations run by IT
// EQUIVALENCE: equivalent-with-schema-assumptions - Defender has no endpoint DNS table: the name is read from DnsQueryResponse events in DeviceEvents and the acting process is InitiatingProcessFileName. The CQL's connection join (remote address and port) is dropped.
// REQUIRES: Defender for Endpoint network inspection DNS events (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: Baseline the processes that legitimately reach Discord, then exclude them by InitiatingProcessFileName; prioritise user-profile or Temp binaries, msedge, powershell and unsigned images. Do not turn Discord domains into IOC blocks.
// LOOKBACK: 7d; extend only within Advanced Hunting retention
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The remote address and port the CQL returns from the connection join are not returned. Hosts without the network inspection DNS events enabled return nothing.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "DnsQueryResponse"
| extend QueryName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where QueryName matches regex @"(?i)(^|\.)(discord\.com|discordapp\.com|discord\.gg|discordapp\.net)$"
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe", "iexplore.exe", "discord.exe", "update.exe", "ms-teams.exe", "teams.exe", "slack.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, QueryName, InitiatingProcessFileName, InitiatingProcessFolderPath
| sort by Timestamp desc
| take 200

// HUNT: ngrok Tunnel Service Name Resolution
// MITRE: T1567, T1041
// CONF: low  FP: medium  COST: low
// REQUIRES: DnsRequest
// FALSE POSITIVES: developers, demo environments and webhook testing use ngrok legitimately
// TUNING: exclude known developer subnets or host groups; weight hits from hosts that also fired Q9, Q10 or Q13. ngrok is a shared service, so never convert this into an IOC block
// LOOKBACK: 14d
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(ngrok\.com|ngrok\.io|ngrok\.app|ngrok\.dev|ngrok-free\.app|ngrok-free\.dev|ngrok-agent\.com)$/i
| table([@timestamp, aid, ComputerName, UserName, DomainName, ContextProcessId])

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.type, event.time, endpoint.name, event.dns.request

// HUNT: ngrok Tunnel Service Name Resolution
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1567, T1041
// CONF: low | FP: medium
// FALSE POSITIVES: developers, demo environments and webhook testing use ngrok legitimately
// EQUIVALENCE: equivalent-with-schema-assumptions - Same domain-suffix test across the seven ngrok service domains on DNS resolution events.
// REQUIRES: SentinelOne DNS Resolved telemetry
// TUNING: Exclude known developer subnets or host groups; weight hits from hosts that also fired Q9, Q10 or Q13. ngrok is a shared service, so never convert this into an IOC block.
// LOOKBACK: 14d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: Lookups made through an encrypted resolver that bypasses the host stack are not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved'
event.dns.request matches '(^|\\.)(ngrok\\.com|ngrok\\.io|ngrok\\.app|ngrok\\.dev|ngrok-free\\.app|ngrok-free\\.dev|ngrok-agent\\.com)$'
| columns event.time, endpoint.name, src.process.user, event.dns.request, src.process.name, agent.uuid
| limit 200

DeviceEvents
| where Timestamp > ago(1d) | where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: ngrok Tunnel Service Name Resolution
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1567, T1041
// CONF: low | FP: medium
// FALSE POSITIVES: developers, demo environments and webhook testing use ngrok legitimately
// EQUIVALENCE: equivalent-with-schema-assumptions - Defender has no endpoint DNS table: the name is read from DnsQueryResponse events in DeviceEvents and tested against the seven ngrok service domains.
// REQUIRES: Defender for Endpoint network inspection DNS events (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: Exclude known developer subnets or host groups; weight hits from hosts that also fired Q9, Q10 or Q13. ngrok is a shared service, so never convert this into an IOC block.
// LOOKBACK: 14d; extend only within Advanced Hunting retention
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Hosts without the network inspection DNS events enabled return nothing.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(14d)
| where ActionType == "DnsQueryResponse"
| extend QueryName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where QueryName matches regex @"(?i)(^|\.)(ngrok\.com|ngrok\.io|ngrok\.app|ngrok\.dev|ngrok-free\.app|ngrok-free\.dev|ngrok-agent\.com)$"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, QueryName, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: ngrok Executable or Tunnel Command Line
// MITRE: T1567, T1041, T1560.001
// CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2
// FALSE POSITIVES: developer workstations and CI runners that use ngrok
// TUNING: exclude developer host groups; prioritise ngrok started by powershell.exe or cmd.exe, from a Temp or user-profile path, or shortly after a Compress-Archive or zip step on the same aid
// LOOKBACK: 14d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^ngrok(\.exe)?$/i or CommandLine=/ngrok(\.exe)?[^a-z0-9]+(http|tcp|tls|tunnel|authtoken)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: ngrok Executable or Tunnel Command Line
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1567, T1041, T1560.001
// CONF: medium | FP: medium
// FALSE POSITIVES: developer workstations and CI runners that use ngrok
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an ngrok image name, or ngrok followed by a tunnel verb on the command line.
// REQUIRES: SentinelOne Process Creation telemetry with command lines
// TUNING: Exclude developer host groups; prioritise ngrok started by a command interpreter, from a Temp or user-profile path, or shortly after an archive step on the same endpoint.
// LOOKBACK: 14d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A renamed tunnel client with no ngrok string on the command line is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
(tgt.process.name matches '^ngrok(\\.exe)?$' or tgt.process.cmdline matches 'ngrok(\\.exe)?[^a-z0-9]+(http|tcp|tls|tunnel|authtoken)')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, agent.uuid
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: ngrok Executable or Tunnel Command Line
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1567, T1041, T1560.001
// CONF: medium | FP: medium
// FALSE POSITIVES: developer workstations and CI runners that use ngrok
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an ngrok image name, or ngrok followed by a tunnel verb on the command line.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude developer host groups; prioritise ngrok started by a command interpreter, from a Temp or user-profile path, or shortly after an archive step on the same device.
// LOOKBACK: 14d; extend only within Advanced Hunting retention
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed tunnel client with no ngrok string on the command line is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where FileName matches regex @"(?i)^ngrok(\.exe)?$" or ProcessCommandLine matches regex @"(?i)ngrok(\.exe)?[^a-z0-9]+(http|tcp|tls|tunnel|authtoken)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200