Convertr / Plausible Analytics Supply-Chain Skimmer

// HUNT: DNS lookups for the campaign's exfiltration domains (any process)
// MITRE: T1041, T1132.001 | CONF: high  FP: low  COST: low
// REQUIRES: DnsRequest telemetry from staff, kiosk, QA and test machines that load storefront checkouts
// FALSE POSITIVES: short, generic-looking names (fasthook.app, tray.is) could be reused by unrelated parties after the group stopped using them
// TUNING: 1x0.is is the current endpoint, treat any hit as high priority; for the older names compare the first-seen date with the 2026-10-24 window before escalating
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(1x0\.is|snf\.is|kk\.land|nmn\.is|kof\.one|anl\.is|xsox\.diy|eqp\.is|shy\.is|blz\.is|tray\.is|miorl\.net|xwv\.is|fasthook\.app|antiddos-protection\.net)$/i
| table([@timestamp, aid, ComputerName, DomainName, ContextProcessId_decimal, RequestType], limit=200)
| sort(@timestamp, order=desc)

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, event.type, event.dns.request

// HUNT: DNS lookups for the campaign's exfiltration domains (any process)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1041, T1132.001
// CONF: high | FP: low
// FALSE POSITIVES: short, generic-looking names (fasthook.app, tray.is) could be reused by unrelated parties after the group stopped using them
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a DNS lookup whose name equals, or is a subdomain of, one of the fifteen campaign domains. The end anchor and the label boundary reproduce the CQL regex, and matches is case-insensitive like its /i flag.
// REQUIRES: SentinelOne DNS Resolved events from staff, kiosk, QA and test machines that load storefront checkouts
// TUNING: 1x0.is is the current endpoint, treat any hit as high priority; for the older names compare the first-seen date with the 2026-10-24 window before escalating.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Lookups made by a resolver outside the endpoint, or on a device without the agent, are not seen.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' event.dns.request matches '(^|\\.)(1x0\\.is|snf\\.is|kk\\.land|nmn\\.is|kof\\.one|anl\\.is|xsox\\.diy|eqp\\.is|shy\\.is|blz\\.is|tray\\.is|miorl\\.net|xwv\\.is|fasthook\\.app|antiddos-protection\\.net)$'
| columns event.time, agent.uuid, endpoint.name, event.dns.request, src.process.name, src.process.cmdline
| sort -event.time
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: DNS lookups for the campaign's exfiltration domains (any process)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1041, T1132.001
// CONF: high | FP: low
// FALSE POSITIVES: short, generic-looking names (fasthook.app, tray.is) could be reused by unrelated parties after the group stopped using them
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on the lookup name, read from DeviceEvents DnsQueryResponse records where Defender stores it inside AdditionalFields. The regex keeps the label boundary and end anchor, and (?i) reproduces the CQL /i flag.
// REQUIRES: Defender for Endpoint DNS response telemetry (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: 1x0.is is the current endpoint, treat any hit as high priority; for the older names compare the first-seen date with the 2026-10-24 window before escalating.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Lookups made by a resolver outside the endpoint, or on a device without the sensor, are not seen.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "DnsQueryResponse"
| extend QueryName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where QueryName matches regex @"(?i)(^|\.)(1x0\.is|snf\.is|kk\.land|nmn\.is|kof\.one|anl\.is|xsox\.diy|eqp\.is|shy\.is|blz\.is|tray\.is|miorl\.net|xwv\.is|fasthook\.app|antiddos-protection\.net)$"
| project Timestamp, ReportId, DeviceId, DeviceName, QueryName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Which process resolved an exfiltration domain (browser vs script host vs server service)
// MITRE: T1041, T1132.001 | CONF: high  FP: low  COST: medium
// REQUIRES: DnsRequest and ProcessRollup2 from the same sensor (join on aid + process id)
// FALSE POSITIVES: security tooling that detonates or resolves threat-intel domains from a sandbox or scanner host
// TUNING: exclude sandbox and scanner hosts by ComputerName; a browser process on a staff machine is the expected shape, a service or script host is not
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(1x0\.is|snf\.is|kk\.land|nmn\.is|kof\.one|anl\.is|xsox\.diy|eqp\.is|shy\.is|blz\.is|tray\.is|miorl\.net|xwv\.is|fasthook\.app|antiddos-protection\.net)$/i
| rename(field=ContextProcessId_decimal, as=TargetProcessId_decimal)
| join(query={#event_simpleName=ProcessRollup2}, field=[aid, TargetProcessId_decimal], mode=left, include=[FileName, CommandLine, ParentBaseFileName, UserName])
| table([@timestamp, aid, ComputerName, DomainName, FileName, CommandLine, ParentBaseFileName, UserName], limit=200)
| sort(@timestamp, order=desc)

event.type = 'DNS Resolved' src.process.name = *
| limit 5
| columns event.time, event.type, event.dns.request, src.process.name

// HUNT: Which process resolved an exfiltration domain (browser vs script host vs server service)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1041, T1132.001
// CONF: high | FP: low
// FALSE POSITIVES: security tooling that detonates or resolves threat-intel domains from a sandbox or scanner host
// EQUIVALENCE: equivalent-with-schema-assumptions - Same lookup predicate as Q1. The CQL joins the lookup to the process-start record to name the process; a SentinelOne DNS Resolved event already carries the acting process as src.process.*, so no join is needed.
// REQUIRES: SentinelOne DNS Resolved events that carry the acting process (src.process.*)
// TUNING: Exclude sandbox and scanner hosts by endpoint.name; a browser process on a staff machine is the expected shape, a service or script host is not.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A lookup whose process the agent could not attribute shows empty process columns.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' event.dns.request matches '(^|\\.)(1x0\\.is|snf\\.is|kk\\.land|nmn\\.is|kof\\.one|anl\\.is|xsox\\.diy|eqp\\.is|shy\\.is|blz\\.is|tray\\.is|miorl\\.net|xwv\\.is|fasthook\\.app|antiddos-protection\\.net)$'
| columns event.time, agent.uuid, endpoint.name, event.dns.request, src.process.name, src.process.cmdline, src.process.parent.name, src.process.user
| sort -event.time
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields, InitiatingProcessFileName
| take 5

// HUNT: Which process resolved an exfiltration domain (browser vs script host vs server service)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1041, T1132.001
// CONF: high | FP: low
// FALSE POSITIVES: security tooling that detonates or resolves threat-intel domains from a sandbox or scanner host
// EQUIVALENCE: equivalent-with-schema-assumptions - Same lookup predicate as Q1. The CQL joins the lookup to the process-start record; DeviceEvents DnsQueryResponse rows already carry the initiating process, so the join is unnecessary.
// REQUIRES: Defender for Endpoint DNS response telemetry (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: Exclude sandbox and scanner hosts by DeviceName; a browser process on a staff machine is the expected shape, a service or script host is not.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A lookup whose process the sensor could not attribute shows empty process columns.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "DnsQueryResponse"
| extend QueryName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where QueryName matches regex @"(?i)(^|\.)(1x0\.is|snf\.is|kk\.land|nmn\.is|kof\.one|anl\.is|xsox\.diy|eqp\.is|shy\.is|blz\.is|tray\.is|miorl\.net|xwv\.is|fasthook\.app|antiddos-protection\.net)$"
| project Timestamp, ReportId, DeviceId, DeviceName, QueryName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessAccountName
| sort by Timestamp desc
| take 200

// HUNT: Machines that resolved the victim tracker host or a checkout host (exposure only, not compromise)
// MITRE: T1195.002 | CONF: medium  FP: high  COST: low
// REQUIRES: DnsRequest telemetry from staff and test machines; run over 2026-10-24 through 2026-10-28
// FALSE POSITIVES: ordinary legitimate shopping or merchant-staff use of the platform outside the poisoned window
// TUNING: set the search window to 2026-10-24 00:00 UTC through 2026-10-28 14:00 UTC (cleanup 2026-10-27 12:54 UTC plus up to 24 hours of browser caching); a hit means exposure, so ask the user whether they paid by card, then pivot to Q1 and Q2
#event_simpleName=DnsRequest
| DomainName=/(^analytics\.convertr\.app\.br$|(^|\.)checkout\.convertr)/i
| groupBy([aid, ComputerName], function=[count(as=lookups), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen), collect([DomainName])])
| sort(lastSeen, order=desc, limit=200)

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, event.type, event.dns.request, agent.uuid

// HUNT: Machines that resolved the victim tracker host or a checkout host (exposure only, not compromise)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1195.002
// CONF: medium | FP: high
// FALSE POSITIVES: ordinary legitimate shopping or merchant-staff use of the platform outside the poisoned window
// EQUIVALENCE: equivalent-with-schema-assumptions - Same exposure grouping: machines that resolved the tracker host or a checkout host, with count and first and last seen. The label-boundary on the checkout name is relaxed to a substring match, which can only add hosts.
// REQUIRES: SentinelOne DNS Resolved events from staff and test machines
// TUNING: Set the query window to 2026-10-24 00:00 UTC through 2026-10-28 14:00 UTC (cleanup 2026-10-27 12:54 UTC plus up to 24 hours of browser caching); a hit means exposure, so ask the user whether they paid by card, then pivot to Q1 and Q2.
// LOOKBACK: Set the console time range to 2026-10-24 00:00 UTC through 2026-10-28 14:00 UTC
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL lists every distinct domain per host; this query returns one sample and a distinct count because the collect aggregate is not available.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' (event.dns.request in:anycase ('analytics.convertr.app.br') or event.dns.request contains 'checkout.convertr')
| group lookups = count(), first_seen = min(event.time), last_seen = max(event.time), sample_domain = any(event.dns.request), distinct_domains = estimate_distinct(event.dns.request) by agent.uuid, endpoint.name
| sort -last_seen
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields, DeviceId
| take 5

// HUNT: Machines that resolved the victim tracker host or a checkout host (exposure only, not compromise)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1195.002
// CONF: medium | FP: high
// FALSE POSITIVES: ordinary legitimate shopping or merchant-staff use of the platform outside the poisoned window
// EQUIVALENCE: equivalent-with-schema-assumptions - Same exposure grouping over DnsQueryResponse records. The checkout name is matched as a substring, which can only add hosts. The lookback is 30 days so the 2026-10-24 start of the window is inside it.
// REQUIRES: Defender for Endpoint DNS response telemetry (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: Narrow the window to 2026-10-24 00:00 UTC through 2026-10-28 14:00 UTC (cleanup 2026-10-27 12:54 UTC plus up to 24 hours of browser caching); a hit means exposure, so ask the user whether they paid by card, then pivot to Q1 and Q2.
// LOOKBACK: 30d (Advanced Hunting retention; covers the 2026-10-24 start of the window while it is under 30 days old)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days, so after 2026-11-23 the start of the 2026-10-24 window is no longer queryable here; use the CQL tab.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| extend QueryName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where QueryName =~ "analytics.convertr.app.br" or QueryName contains "checkout.convertr"
| summarize lookups = count(), first_seen = min(Timestamp), last_seen = max(Timestamp), domains = make_set(QueryName) by DeviceId, DeviceName
| sort by last_seen desc
| take 200

// HUNT: Linux hosts running Plausible Community Edition (scope the exposure to the suspected entry point)
// MITRE: T1190 | CONF: medium  FP: low  COST: low
// REQUIRES: ProcessRollup2 from Linux servers; a lookback longer than the service uptime, because a process started before the window is not listed
// FALSE POSITIVES: any unrelated BEAM (Erlang or Elixir) application whose command line contains the word plausible
// TUNING: widen the search window to cover the last restart; confirm the version on each listed host (3.0.0 through 3.2.0 is the reported vulnerable range, 3.2.1 is the fix)
#event_simpleName=ProcessRollup2
| FileName=/^beam(\.smp)?$/i
| CommandLine=/plausible/i
| groupBy([aid, ComputerName], function=[count(as=starts), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen), collect([ParentBaseFileName])])
| sort(lastSeen, order=desc, limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, agent.uuid, tgt.process.name, tgt.process.cmdline

// HUNT: Linux hosts running Plausible Community Edition (scope the exposure to the suspected entry point)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190
// CONF: medium | FP: low
// FALSE POSITIVES: any unrelated BEAM (Erlang or Elixir) application whose command line contains the word plausible
// EQUIVALENCE: equivalent-with-schema-assumptions - Same inventory: BEAM VM process starts whose command line names plausible, grouped per host with count and first and last seen. On a Process Creation event the BEAM process is the new process, tgt.process.*, and its creator is src.process.*.
// REQUIRES: SentinelOne Process Creation events from Linux servers; a lookback longer than the service uptime, because a process started before the window is not listed
// TUNING: Widen the search window to cover the last restart; confirm the version on each listed host (3.0.0 through 3.2.0 is the reported vulnerable range, 3.2.1 is the fix).
// LOOKBACK: Widen to cover the last service restart
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL collects every parent name per host; this query returns one sample parent. A BEAM VM started before the window or before the agent was installed is not listed.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('beam', 'beam.smp') tgt.process.cmdline contains 'plausible'
| group starts = count(), first_seen = min(event.time), last_seen = max(event.time), parent_sample = any(src.process.name) by agent.uuid, endpoint.name
| sort -last_seen
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceId, FileName, ProcessCommandLine
| take 5

// HUNT: Linux hosts running Plausible Community Edition (scope the exposure to the suspected entry point)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1190
// CONF: medium | FP: low
// FALSE POSITIVES: any unrelated BEAM (Erlang or Elixir) application whose command line contains the word plausible
// EQUIVALENCE: equivalent-with-schema-assumptions - Same inventory over DeviceProcessEvents: the created process is the BEAM VM and its command line names plausible. The creator is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) from Linux servers
// TUNING: Widen the search window to cover the last restart; confirm the version on each listed host (3.0.0 through 3.2.0 is the reported vulnerable range, 3.2.1 is the fix).
// LOOKBACK: 30d (Advanced Hunting retention); a service older than that needs the CQL tab
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days; a BEAM VM started earlier is not listed here. A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("beam", "beam.smp")
| where ProcessCommandLine contains "plausible"
| summarize starts = count(), first_seen = min(Timestamp), last_seen = max(Timestamp), parents = make_set(InitiatingProcessFileName) by DeviceId, DeviceName
| sort by last_seen desc
| take 200

// HUNT: Shell, download tool or interpreter spawned by the BEAM VM that runs Plausible (post-exploitation on the analytics host)
// MITRE: T1190, T1059.004 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 with parent-process context from the Plausible host
// FALSE POSITIVES: operator maintenance tasks, release helper scripts and container health checks that the service launches itself
// TUNING: baseline for 14 days on the Plausible host, then allow-list the exact CommandLine of each known helper; keep curl, wget, nc, socat and interpreter hits unexcluded
#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^(beam\.smp|beam|erl_child_setup)$/i
| FileName=/^(sh|bash|dash|ash|busybox|curl|wget|nc|ncat|socat|python[0-9.]*|perl|ruby|base64|openssl)$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

event.type = 'Process Creation' src.process.name = *
| limit 5
| columns event.time, event.type, src.process.name, tgt.process.name

// HUNT: Shell, download tool or interpreter spawned by the BEAM VM that runs Plausible (post-exploitation on the analytics host)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1059.004
// CONF: medium | FP: medium
// FALSE POSITIVES: operator maintenance tasks, release helper scripts and container health checks that the service launches itself
// EQUIVALENCE: equivalent-with-schema-assumptions - Same spawn hunt with the lineage re-derived: on a Process Creation event the child shell, download tool or interpreter is tgt.process.* and the BEAM VM that created it is src.process.*. The CQL name list is kept, with python versions covered by an anchored regex.
// REQUIRES: SentinelOne Process Creation events from the Plausible host, with creator-process context
// TUNING: Baseline for 14 days on the Plausible host, then allow-list the exact command line of each known helper; keep curl, wget, nc, socat and interpreter hits unexcluded.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A shell started by a process other than the BEAM VM, for example after the attacker pivots, is not caught.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name in:anycase ('beam.smp', 'beam', 'erl_child_setup') (tgt.process.name in:anycase ('sh', 'bash', 'dash', 'ash', 'busybox', 'curl', 'wget', 'nc', 'ncat', 'socat', 'perl', 'ruby', 'base64', 'openssl') or tgt.process.name matches '^python[0-9.]*$')
| columns event.time, agent.uuid, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName
| take 5

// HUNT: Shell, download tool or interpreter spawned by the BEAM VM that runs Plausible (post-exploitation on the analytics host)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1190, T1059.004
// CONF: medium | FP: medium
// FALSE POSITIVES: operator maintenance tasks, release helper scripts and container health checks that the service launches itself
// EQUIVALENCE: equivalent-with-schema-assumptions - Same spawn hunt: the created process is FileName and its creator, the BEAM VM, is InitiatingProcessFileName. in~ reproduces the CQL /i flag.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) from the Plausible host
// TUNING: Baseline for 14 days on the Plausible host, then allow-list the exact command line of each known helper; keep curl, wget, nc, socat and interpreter hits unexcluded.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A shell started by a process other than the BEAM VM is not caught.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName in~ ("beam.smp", "beam", "erl_child_setup")
| where FileName in~ ("sh", "bash", "dash", "ash", "busybox", "curl", "wget", "nc", "ncat", "socat", "perl", "ruby", "base64", "openssl") or FileName matches regex @"(?i)^python[0-9.]*$"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Commands that reference the Plausible tracker script or its directory (tampering with the served file)
// MITRE: T1565.001, T1195.002 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 command-line telemetry from the Plausible host
// FALSE POSITIVES: administrators upgrading Plausible, restoring backups or comparing tracker files against a release
// TUNING: exclude read-only verification such as sha256sum, ls and diff from known admin accounts; any write-capable tool (sed, tee, cp, mv, dd, curl, wget) acting on the tracker file outside a change window is the signal
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(script\.pageview-props\.tagged-events\.js|priv[\/\\]tracker[\/\\]js)/i
| FileName=/^(sed|tee|cp|mv|dd|curl|wget|echo|printf|perl|python[0-9.]*|node|vi|vim|nano|sh|bash)$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.cmdline

// HUNT: Commands that reference the Plausible tracker script or its directory (tampering with the served file)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1565.001, T1195.002
// CONF: medium | FP: medium
// FALSE POSITIVES: administrators upgrading Plausible, restoring backups or comparing tracker files against a release
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a write-capable or editing tool whose command line names the tracker script or its directory, with either path separator. contains is case-insensitive like the CQL /i flag.
// REQUIRES: SentinelOne Process Creation command-line telemetry from the Plausible host
// TUNING: Exclude read-only verification such as sha256sum, ls and diff from known admin accounts; any write-capable tool (sed, tee, cp, mv, dd, curl, wget) acting on the tracker file outside a change window is the signal.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL also reads synthetic process-start events that the agent can raise for processes it did not see start; this query reads Process Creation only.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' (tgt.process.cmdline contains 'script.pageview-props.tagged-events.js' or tgt.process.cmdline contains 'priv/tracker/js' or tgt.process.cmdline contains 'priv\\tracker\\js') (tgt.process.name in:anycase ('sed', 'tee', 'cp', 'mv', 'dd', 'curl', 'wget', 'echo', 'printf', 'perl', 'node', 'vi', 'vim', 'nano', 'sh', 'bash') or tgt.process.name matches '^python[0-9.]*$')
| columns event.time, agent.uuid, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: Commands that reference the Plausible tracker script or its directory (tampering with the served file)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1565.001, T1195.002
// CONF: medium | FP: medium
// FALSE POSITIVES: administrators upgrading Plausible, restoring backups or comparing tracker files against a release
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on the created process: a write-capable or editing tool whose command line names the tracker script or its directory, with either path separator. contains and in~ are case-insensitive like the CQL /i flag.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) from the Plausible host
// TUNING: Exclude read-only verification such as sha256sum, ls and diff from known admin accounts; any write-capable tool (sed, tee, cp, mv, dd, curl, wget) acting on the tracker file outside a change window is the signal.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL also reads synthetic process-start events; this query reads real process creation only.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine contains "script.pageview-props.tagged-events.js" or ProcessCommandLine contains "priv/tracker/js" or ProcessCommandLine contains "priv\\tracker\\js"
| where FileName in~ ("sed", "tee", "cp", "mv", "dd", "curl", "wget", "echo", "printf", "perl", "node", "vi", "vim", "nano", "sh", "bash") or FileName matches regex @"(?i)^python[0-9.]*$"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: BEAM VM on the Plausible host connecting outbound to non-private addresses
// MITRE: T1190, T1071.001 | CONF: low  FP: medium  COST: medium
// REQUIRES: NetworkConnectIP4 with initiating-process context from the Plausible host
// FALSE POSITIVES: outbound SMTP relay, geolocation database or version-check downloads, and externally hosted databases
// TUNING: allow-list the remote addresses of your SMTP relay and managed database; rare destinations (low conns) on unusual ports are the interesting rows
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^(beam\.smp|beam)$/i
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16"])
| groupBy([aid, ComputerName, RemoteAddressIP4, RemotePort], function=[count(as=conns), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)])
| sort(conns, order=asc, limit=200)

event.type = 'IP Connect' src.process.name = *
| limit 5
| columns event.time, event.type, src.process.name, dst.ip.address, dst.port.number

// HUNT: BEAM VM on the Plausible host connecting outbound to non-private addresses
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1071.001
// CONF: low | FP: medium
// FALSE POSITIVES: outbound SMTP relay, geolocation database or version-check downloads, and externally hosted databases
// EQUIVALENCE: equivalent-with-schema-assumptions - Same rare-destination grouping: outbound connections from the BEAM VM to addresses outside the five listed private, loopback and link-local ranges, counted per destination. On an IP Connect event the acting process is src.process.*.
// REQUIRES: SentinelOne IP Connect events with the acting process from the Plausible host
// TUNING: Allow-list the remote addresses of your SMTP relay and managed database; rare destinations (low conns) on unusual ports are the interesting rows.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: IPv6 destinations are not excluded by the listed ranges, and the CQL reads IPv4 events only.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' src.process.name in:anycase ('beam.smp', 'beam') !(net_ipsubnet(dst.ip.address, '10.0.0.0/8') or net_ipsubnet(dst.ip.address, '172.16.0.0/12') or net_ipsubnet(dst.ip.address, '192.168.0.0/16') or net_ipsubnet(dst.ip.address, '127.0.0.0/8') or net_ipsubnet(dst.ip.address, '169.254.0.0/16'))
| group conns = count(), first_seen = min(event.time), last_seen = max(event.time) by agent.uuid, endpoint.name, dst.ip.address, dst.port.number
| sort +conns
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, RemoteIP, RemotePort
| take 5

// HUNT: BEAM VM on the Plausible host connecting outbound to non-private addresses
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1190, T1071.001
// CONF: low | FP: medium
// FALSE POSITIVES: outbound SMTP relay, geolocation database or version-check downloads, and externally hosted databases
// EQUIVALENCE: equivalent-with-schema-assumptions - Same rare-destination grouping over DeviceNetworkEvents: connections whose initiating process is the BEAM VM, to addresses outside the five listed ranges.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents) from the Plausible host
// TUNING: Allow-list the remote addresses of your SMTP relay and managed database; rare destinations (low conns) on unusual ports are the interesting rows.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Failed connection attempts are not counted, and IPv6 destinations are not excluded by the listed ranges.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where ActionType == "ConnectionSuccess"
| where InitiatingProcessFileName in~ ("beam.smp", "beam")
| where not(ipv4_is_in_any_range(RemoteIP, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16"))
| summarize conns = count(), first_seen = min(Timestamp), last_seen = max(Timestamp) by DeviceId, DeviceName, RemoteIP, RemotePort
| sort by conns asc
| take 200

// HUNT: Commands naming the group's Portuguese exfiltration script names (cartao.php, pagamento.php)
// MITRE: T1041 | CONF: low  FP: medium  COST: low
// REQUIRES: ProcessRollup2 command-line telemetry, typically from web servers or administrator workstations
// FALSE POSITIVES: both names are ordinary Portuguese words (card, payment) and legitimate Brazilian stores often ship pages with these exact names
// TUNING: treat a hit as a lead only; correlate with Q1 and Q2 on the same host, and require the command to POST to an external host before escalating
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(cartao|pagamento)\.php/i
| FileName=/^(curl|wget|php[0-9.]*|python[0-9.]*|perl|sh|bash|powershell|pwsh)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.cmdline

// HUNT: Commands naming the group's Portuguese exfiltration script names (cartao.php, pagamento.php)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1041
// CONF: low | FP: medium
// FALSE POSITIVES: both names are ordinary Portuguese words (card, payment) and legitimate Brazilian stores often ship pages with these exact names
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a curl, wget, php, python, perl or shell process whose command line names cartao.php or pagamento.php. The process-name regex is anchored and case-insensitive, matching the CQL /i flag, with an optional .exe.
// REQUIRES: SentinelOne Process Creation command-line telemetry, typically from web servers or administrator workstations
// TUNING: Treat a hit as a lead only; correlate with Q1 and Q2 on the same host, and require the command to POST to an external host before escalating.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL also reads synthetic process-start events; this query reads Process Creation only.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' (tgt.process.cmdline contains 'cartao.php' or tgt.process.cmdline contains 'pagamento.php') tgt.process.name matches '^(curl|wget|php[0-9.]*|python[0-9.]*|perl|sh|bash|powershell|pwsh)(\\.exe)?$'
| columns event.time, agent.uuid, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: Commands naming the group's Portuguese exfiltration script names (cartao.php, pagamento.php)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1041
// CONF: low | FP: medium
// FALSE POSITIVES: both names are ordinary Portuguese words (card, payment) and legitimate Brazilian stores often ship pages with these exact names
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on the created process. contains is case-insensitive like the CQL /i flag; the process-name regex is anchored with (?i).
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Treat a hit as a lead only; correlate with Q1 and Q2 on the same host, and require the command to POST to an external host before escalating.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL also reads synthetic process-start events; this query reads real process creation only.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine contains "cartao.php" or ProcessCommandLine contains "pagamento.php"
| where FileName matches regex @"(?i)^(curl|wget|php[0-9.]*|python[0-9.]*|perl|sh|bash|powershell|pwsh)(\.exe)?$"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Script host run with an inline character-code decode followed by eval (the skimmer's loader pattern)
// MITRE: T1059.007, T1027 | CONF: medium  FP: low  COST: low
// REQUIRES: ProcessRollup2 command line for node, deno, bun or Windows script hosts; browsers are NOT covered
// FALSE POSITIVES: developers testing obfuscation or running minified code with -e, and security researchers reproducing the sample
// TUNING: exclude developer build hosts by ComputerName; a production server or kiosk running this is unusual
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(node|nodejs|deno|bun|cscript|wscript)(\.exe)?$/i
| CommandLine=/fromCharCode/i
| CommandLine=/eval/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.cmdline

// HUNT: Script host run with an inline character-code decode followed by eval (the skimmer's loader pattern)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.007, T1027
// CONF: medium | FP: low
// FALSE POSITIVES: developers testing obfuscation or running minified code with -e, and security researchers reproducing the sample
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a script host whose command line contains both fromCharCode and eval. contains is case-insensitive like the CQL /i flag, and the process-name regex is anchored with an optional .exe.
// REQUIRES: SentinelOne Process Creation command-line telemetry for node, deno, bun or Windows script hosts; browsers are not covered
// TUNING: Exclude developer build hosts by endpoint.name; a production server or kiosk running this is unusual.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL also reads synthetic process-start events; this query reads Process Creation only. Code run inside a browser is not visible to a command-line hunt.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name matches '^(node|nodejs|deno|bun|cscript|wscript)(\\.exe)?$' tgt.process.cmdline contains 'fromCharCode' tgt.process.cmdline contains 'eval'
| columns event.time, agent.uuid, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: Script host run with an inline character-code decode followed by eval (the skimmer's loader pattern)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.007, T1027
// CONF: medium | FP: low
// FALSE POSITIVES: developers testing obfuscation or running minified code with -e, and security researchers reproducing the sample
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on the created process: a script host whose command line contains both fromCharCode and eval. contains and in~ are case-insensitive like the CQL /i flag.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) for node, deno, bun or Windows script hosts; browsers are not covered
// TUNING: Exclude developer build hosts by DeviceName; a production server or kiosk running this is unusual.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL also reads synthetic process-start events; this query reads real process creation only. Code run inside a browser is not visible to a command-line hunt.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ("node", "node.exe", "nodejs", "nodejs.exe", "deno", "deno.exe", "bun", "bun.exe", "cscript", "cscript.exe", "wscript", "wscript.exe")
| where ProcessCommandLine contains "fromCharCode" and ProcessCommandLine contains "eval"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200