Custom GPT ClickFix RAT (Canon and Stardock DLL Sideload)

// HUNT: PowerShell web fetch addressed to a decimal- or hex-encoded IP host (Custom GPT ClickFix RAT stage 1)
// MITRE: T1059.001, T1105, T1027
// CONF: high | FP: low | COST: low | REQUIRES: process creation with command line
// FALSE POSITIVES: a script that passes a large integer as a timeout or size right after a fetch cmdlet and a space
// SOURCE: Huntress 2026-09-28 (host written as a decimal number; resolves to the delivery IP)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(powershell|pwsh)\.exe$/i
| CommandLine=/\b(irm|iwr|Invoke-RestMethod|Invoke-WebRequest|DownloadString|DownloadFile|DownloadData|curl|wget)\b[^|;&]{0,80}?(\s|['"(=]|:\W{1,3})(0x[0-9a-f]{8}|[0-9]{8,10})([^0-9.]|$)/i or CommandLine=/https?:\W{1,4}(0x[0-9a-f]{8}|[0-9]{8,10})([^0-9.]|$)/i
| table([@timestamp, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine, aid], limit=200)

event.type = 'Process Creation' endpoint.name = * tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.process.name, tgt.process.cmdline

// HUNT: PowerShell web fetch addressed to a decimal- or hex-encoded IP host (Custom GPT ClickFix RAT stage 1)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.001, T1105, T1027
// CONF: high | FP: low
// FALSE POSITIVES: a script that passes a large integer as a timeout or size right after a fetch cmdlet and a space
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: PowerShell whose command line pairs a fetch cmdlet with a decimal or hex 8 to 10 digit host, or an http(s) URL whose host is such a number. The lazy gap quantifier is made greedy because PowerQuery has no lazy quantifiers; with a bounded gap and a required following group the set of matching lines is the same.
// REQUIRES: SentinelOne Process Creation telemetry with command lines
// TUNING: A script that passes a large integer right after a fetch cmdlet and a space is the known false positive; exclude by full command line after review.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A fetch launched by a process the agent did not observe starting is not captured. Hosts written as an octal or mixed-radix number are not covered, as in the CQL.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name in:anycase ('powershell.exe','pwsh.exe')
(tgt.process.cmdline matches '\\b(irm|iwr|Invoke-RestMethod|Invoke-WebRequest|DownloadString|DownloadFile|DownloadData|curl|wget)\\b[^|;&]{0,80}(\\s|[\\x27\\x22(=]|:\\W{1,3})(0x[0-9a-f]{8}|[0-9]{8,10})([^0-9.]|$)' or tgt.process.cmdline matches 'https?:\\W{1,4}(0x[0-9a-f]{8}|[0-9]{8,10})([^0-9.]|$)')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, agent.uuid
| limit 200

// HUNT: user-launched PowerShell with a web fetch plus bypass or temp staging, or MSI Mark-of-the-Web removal (ClickFix launch)
// MITRE: T1204.004, T1059.001, T1553.005
// CONF: medium | FP: medium | COST: low | REQUIRES: process creation with command line and parent
// FALSE POSITIVES: administrators pasting install one-liners; developer tooling bootstraps
// TUNING: exclude the IT admin asset group and known package-manager bootstraps (parent cmd.exe with a vendor installer URL); keep hits where the parent is explorer.exe or a browser
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(powershell|pwsh)\.exe$/i
| ParentBaseFileName=/^(explorer|chrome|msedge|firefox|brave|opera|WindowsTerminal|OpenConsole|conhost|cmd)\.exe$/i
| CommandLine=/\b(irm|iwr|iex|Invoke-RestMethod|Invoke-WebRequest|Invoke-Expression|Unblock-File)\b/i
| CommandLine=/bypass|out-file|set-content|\$env:temp|%temp%|\.msi|zone\.identifier/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine, aid], limit=200)

event.type = 'Process Creation' endpoint.name = * tgt.process.name = * tgt.process.cmdline = * src.process.name = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.process.name, tgt.process.cmdline, src.process.name

// HUNT: user-launched PowerShell with a web fetch plus bypass or temp staging, or MSI Mark-of-the-Web removal (ClickFix launch)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.004, T1059.001, T1553.005
// CONF: medium | FP: medium
// FALSE POSITIVES: administrators pasting install one-liners; developer tooling bootstraps
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: PowerShell launched by an interactive or console parent, a web-fetch or unblock cmdlet, and a bypass or temp-staging or MSI marker. Lineage re-mapped for SentinelOne.
// REQUIRES: SentinelOne Process Creation telemetry with command lines and parent names
// TUNING: Exclude the IT admin asset group and known package-manager bootstraps (parent cmd.exe with a vendor installer URL); keep hits where the parent is explorer.exe or a browser.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A paste that reaches PowerShell through a parent not in the list is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name in:anycase ('powershell.exe','pwsh.exe')
src.process.name in:anycase ('explorer.exe','chrome.exe','msedge.exe','firefox.exe','brave.exe','opera.exe','WindowsTerminal.exe','OpenConsole.exe','conhost.exe','cmd.exe')
tgt.process.cmdline matches '\\b(irm|iwr|iex|Invoke-RestMethod|Invoke-WebRequest|Invoke-Expression|Unblock-File)\\b'
tgt.process.cmdline matches 'bypass|out-file|set-content|\\$env:temp|%temp%|\\.msi|zone\\.identifier'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, agent.uuid
| limit 200

// HUNT: Run-dialog entry that launches PowerShell with a web fetch (ClickFix paste, RunMRU)
// MITRE: T1204.004, T1059.001
// CONF: high | FP: low | COST: low | REQUIRES: registry value telemetry for RunMRU (validate in tenant)
// FALSE POSITIVES: an administrator typing a PowerShell download into Run
// TUNING: exclude the IT admin asset group if it uses Run for scripted downloads
#event_simpleName=/^(RegGenericValueUpdate|AsepValueUpdate|RegSystemConfigValueUpdate)$/
| RegObjectName=/RunMRU/i
| RegStringValue=/(powershell|pwsh)/i
| RegStringValue=/\b(irm|iwr|iex|Invoke-RestMethod|Invoke-WebRequest|Invoke-Expression)\b/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, aid], limit=200)

event.type = 'Registry Value Modified' endpoint.name = * registry.keyPath = * registry.value = *
| limit 5
| columns event.type, event.time, endpoint.name, registry.keyPath, registry.value

// HUNT: Run-dialog entry that launches PowerShell with a web fetch (ClickFix paste, RunMRU)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.004, T1059.001
// CONF: high | FP: low
// FALSE POSITIVES: an administrator typing a PowerShell download into Run
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on a RunMRU registry write whose data names PowerShell and a web-fetch cmdlet.
// REQUIRES: SentinelOne Registry Value Modified telemetry covering HKCU RunMRU
// TUNING: Exclude the IT admin asset group if it uses Run for scripted downloads.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: If the agent does not monitor RunMRU the query returns nothing, which reads as clean.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified'
registry.keyPath matches 'RunMRU'
registry.value matches '(powershell|pwsh)'
registry.value matches '\\b(irm|iwr|iex|Invoke-RestMethod|Invoke-WebRequest|Invoke-Expression)\\b'
| columns event.time, endpoint.name, src.process.user, src.process.name, registry.keyPath, registry.valueName, registry.value, agent.uuid
| limit 200

// HUNT: powershell spawning a silent msiexec install of an MSI from a user-writable path (Custom GPT ClickFix RAT stage 2)
// MITRE: T1218.007, T1059.001, T1105
// CONF: high | FP: low | COST: low | REQUIRES: process creation with command line and parent
// FALSE POSITIVES: PowerShell-driven software deployment that stages MSIs in Temp
// SOURCE: Huntress 2026-09-28 detection opportunities (powershell launching msiexec on a GUID-named MSI in Temp)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^msiexec\.exe$/i
| ParentBaseFileName=/^(powershell|pwsh)\.exe$/i
| CommandLine=/\.msi/i
| CommandLine=/\W(qn|quiet|qb)\b/i
| CommandLine=/(\\temp\\|%temp%|\\appdata\\|\\users\\public\\|\\programdata\\)/i
| case {
    CommandLine=/(ISOSimple|IconEdit2Turb|UltraFreeISOCreateWizardSolution)\.msi/i | Tier := "named-in-report";
    CommandLine=/[0-9a-f]{32}_\w+\.msi/i | Tier := "guid-prefixed";
    * | Tier := "generic";
  }
| table([@timestamp, ComputerName, UserName, Tier, ParentBaseFileName, CommandLine, aid], limit=200)

event.type = 'Process Creation' endpoint.name = * tgt.process.name = * tgt.process.cmdline = * src.process.name = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.process.name, tgt.process.cmdline, src.process.name

// HUNT: powershell spawning a silent msiexec install of an MSI from a user-writable path (Custom GPT ClickFix RAT stage 2)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1218.007, T1059.001, T1105
// CONF: high | FP: low
// FALSE POSITIVES: PowerShell-driven software deployment that stages MSIs in Temp
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: msiexec created by PowerShell on an MSI with a quiet switch and a user-writable path. The three-tier case becomes a computed tier column.
// REQUIRES: SentinelOne Process Creation telemetry with command lines and parent names
// TUNING: Exclude PowerShell-driven software deployment that stages MSIs in Temp, by full command line.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A parent that is not PowerShell, such as cmd.exe or a script host, is not captured, as in the CQL.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name in:anycase ('msiexec.exe')
src.process.name in:anycase ('powershell.exe','pwsh.exe')
tgt.process.cmdline contains '.msi'
tgt.process.cmdline matches '\\W(qn|quiet|qb)\\b'
tgt.process.cmdline matches '(\\\\temp\\\\|%temp%|\\\\appdata\\\\|\\\\users\\\\public\\\\|\\\\programdata\\\\)'
| let tier = tgt.process.cmdline matches '(ISOSimple|IconEdit2Turb|UltraFreeISOCreateWizardSolution)\\.msi' ? 'named-in-report' : (tgt.process.cmdline matches '[0-9a-f]{32}_\\w+\\.msi' ? 'guid-prefixed' : 'generic')
| columns event.time, endpoint.name, src.process.user, tier, src.process.name, tgt.process.cmdline, agent.uuid
| limit 200

// HUNT: powershell or msiexec outbound plain HTTP (port 80) to a public IP, no DNS needed (decimal-IP delivery)
// MITRE: T1105, T1071.001
// CONF: medium | FP: medium | COST: low | REQUIRES: NetworkConnectIP4 with process context
// FALSE POSITIVES: scripts pulling from HTTP-only vendor or internal repositories
// TUNING: exclude known HTTP-only destinations by RemoteAddressIP4 and the IT admin asset group; msiexec.exe hits need almost no tuning
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^(powershell|pwsh|msiexec)\.exe$/i
| RemotePort=80
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16"])
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort, aid], limit=200)

event.type = 'IP Connect' endpoint.name = * src.process.name = * dst.ip.address = * dst.port.number = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, dst.ip.address, dst.port.number

// HUNT: powershell or msiexec outbound plain HTTP (port 80) to a public IP, no DNS needed (decimal-IP delivery)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1105, T1071.001
// CONF: medium | FP: medium
// FALSE POSITIVES: scripts pulling from HTTP-only vendor or internal repositories
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: PowerShell or msiexec connecting out on port 80 to an address outside the private, loopback and link-local ranges.
// REQUIRES: SentinelOne IP Connect telemetry with process context
// TUNING: Exclude known HTTP-only destinations by dst.ip.address and the IT admin asset group; msiexec.exe hits need almost no tuning.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: Connections by a process that is not PowerShell or msiexec are not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect'
src.process.name in:anycase ('powershell.exe','pwsh.exe','msiexec.exe')
dst.port.number = 80
!(net_ipsubnet(dst.ip.address,'10.0.0.0/8'))
!(net_ipsubnet(dst.ip.address,'172.16.0.0/12'))
!(net_ipsubnet(dst.ip.address,'192.168.0.0/16'))
!(net_ipsubnet(dst.ip.address,'127.0.0.0/8'))
!(net_ipsubnet(dst.ip.address,'169.254.0.0/16'))
| columns event.time, endpoint.name, src.process.user, src.process.name, dst.ip.address, dst.port.number, agent.uuid
| limit 200

// HUNT: signed Canon or Stardock sideload host executing from the per-user LocalAppData Programs tree
// MITRE: T1574.002, T1036.005
// CONF: high | FP: low | COST: low | REQUIRES: process creation with image path
// FALSE POSITIVES: a user who genuinely installs the vendor software per-user (very rare for either product)
// NOTE: both binaries are legitimately signed vendor software. Detect only, never prevent.
// SOURCE: Huntress 2026-09-28 (host runs from %LOCALAPPDATA%\Programs\ instead of a real Canon or Stardock install)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(COTFileReadApp|DeElevate64)\.exe$/i
| ImageFileName=/\\AppData\\Local\\Programs\\/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, ParentBaseFileName, SHA256HashData, CommandLine, aid], limit=200)

event.type = 'Process Creation' endpoint.name = * tgt.process.name = * tgt.process.image.path = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.process.name, tgt.process.image.path

// HUNT: signed Canon or Stardock sideload host executing from the per-user LocalAppData Programs tree
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: a user who genuinely installs the vendor software per-user (very rare for either product)
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the signed Canon or Stardock host running from the per-user Programs tree. FileName maps to tgt.process.name and ImageFileName to tgt.process.image.path.
// REQUIRES: SentinelOne Process Creation telemetry with image paths
// TUNING: No exclusions expected. Both binaries are legitimately signed vendor software: detect only, never prevent.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A host copied to a path outside AppData\Local\Programs is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name in:anycase ('COTFileReadApp.exe','DeElevate64.exe')
tgt.process.image.path matches '\\\\AppData\\\\Local\\\\Programs\\\\'
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.path, src.process.name, tgt.process.image.sha256, tgt.process.cmdline, agent.uuid
| limit 200

// HUNT: executable started by msiexec from the per-user LocalAppData Programs tree (any signed-host swap)
// MITRE: T1218.007, T1574.002
// CONF: medium | FP: medium | COST: low | REQUIRES: process creation with image path and parent
// FALSE POSITIVES: per-user MSI installers that launch the product at the end of setup
// TUNING: build an exclusion list of vendor folders you deploy per-user (for example your collaboration and editor clients) and exclude them by ImageFileName; review the rest by publisher and prevalence
// SOURCE: Huntress 2026-09-28 (signed app started by msiexec from a fake product folder under LocalAppData Programs)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^msiexec\.exe$/i
| ImageFileName=/\\AppData\\Local\\Programs\\/i
| FileName!=/^(msiexec|conhost|cmd|powershell)\.exe$/i
| groupBy([FileName, ImageFileName], function=[count(aid, distinct=true, as=Hosts), count(as=Launches), min(@timestamp, as=FirstSeen)], limit=500)
| sort(Hosts, order=asc, limit=200)

event.type = 'Process Creation' src.process.name = * tgt.process.name = * tgt.process.image.path = * agent.uuid = *
| limit 5
| columns event.type, event.time, src.process.name, tgt.process.name, tgt.process.image.path, agent.uuid

// HUNT: executable started by msiexec from the per-user LocalAppData Programs tree (any signed-host swap)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1218.007, T1574.002
// CONF: medium | FP: medium
// FALSE POSITIVES: per-user MSI installers that launch the product at the end of setup
// EQUIVALENCE: equivalent-with-schema-assumptions - Same population: executables created by msiexec under the per-user Programs tree, grouped by name and path with host and launch counts, rarest first.
// REQUIRES: SentinelOne Process Creation telemetry with image paths
// TUNING: Build an exclusion list of vendor folders you deploy per-user (for example your collaboration and editor clients) and exclude them by tgt.process.image.path; review the rest by publisher and prevalence.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: hosts is approximate at high cardinality.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
src.process.name in:anycase ('msiexec.exe')
tgt.process.image.path matches '\\\\AppData\\\\Local\\\\Programs\\\\'
!(tgt.process.name in:anycase ('msiexec.exe','conhost.exe','cmd.exe','powershell.exe'))
| group hosts = estimate_distinct(agent.uuid), launches = count(), first_seen = min(event.time) by tgt.process.name, tgt.process.image.path
| sort +hosts
| limit 200

// HUNT: Custom GPT ClickFix sideload component DLLs written under the per-user Programs tree (V1 Canon and V2 Stardock sets)
// MITRE: T1574.002, T1036.005
// CONF: high | FP: medium | COST: low | REQUIRES: PeFileWritten or NewExecutableWritten (TargetFileName: validate in tenant)
// FALSE POSITIVES: per-user installs of genuine WPF applications that ship WPFLocalizeExtension.dll; res.dll is a generic name
// TUNING: for WPFLocalizeExtension.dll and res.dll require a second signal on the same aid (Q6, Q7 or Q4 within 24h) before alerting; ceiinfolog, rdCore, WMPCL, DeElevator64, I++u and senddmp.resources are distinctive on their own
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| TargetFileName=/\\AppData\\Local\\Programs\\/i
| TargetFileName=/\\(ceiinfolog|rdCore|WPFLocalizeExtension|WMPCL|DeElevator64|I\+\+u|senddmp\.resources|res)\.dll$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData, aid], limit=200)

event.type in ('File Creation','File Modification') endpoint.name = * tgt.file.path = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.file.path

// HUNT: Custom GPT ClickFix sideload component DLLs written under the per-user Programs tree (V1 Canon and V2 Stardock sets)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002, T1036.005
// CONF: high | FP: medium
// FALSE POSITIVES: per-user installs of genuine WPF applications that ship WPFLocalizeExtension.dll; res.dll is a generic name
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a sideload component DLL name written under the per-user Programs tree. Falcon PE-written events map to File Creation and File Modification, which also cover non-PE files, so the dll extension test carries the PE filter.
// REQUIRES: SentinelOne File Creation and File Modification telemetry
// TUNING: For WPFLocalizeExtension.dll and res.dll require a second signal on the same agent.uuid (Q6, Q7 or Q4 within 24h) before alerting; ceiinfolog, rdCore, WMPCL, DeElevator64, I++u and senddmp.resources are distinctive on their own.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A DLL written by a kernel path with no file event is not captured. Per-user installs of genuine WPF applications that ship WPFLocalizeExtension.dll will match.
// VALIDATION LEVEL: static-reviewed
event.type in ('File Creation','File Modification')
tgt.file.path matches '\\\\AppData\\\\Local\\\\Programs\\\\'
tgt.file.path matches '\\\\(ceiinfolog|rdCore|WPFLocalizeExtension|WMPCL|DeElevator64|I\\+\\+u|senddmp\\.resources|res)\\.dll$'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.file.path, tgt.file.sha256, agent.uuid
| limit 200

// HUNT: open of the Custom GPT ClickFix loader and storage carrier files (WAV, monitor.raw, Build.dat, execute_engine_disconnect.raw)
// MITRE: T1027, T1027.013, T1574.002
// CONF: medium | FP: low | COST: low | REQUIRES: FileOpenInfo (validate in tenant)
// FALSE POSITIVES: Build.dat is a generic name, so it only counts when opened by DeElevate64.exe
#event_simpleName=FileOpenInfo
| FileName=/^(Common\.Integrator\.Preview\.wav|monitor\.raw|execute_engine_disconnect\.raw)$/i or (FileName=/^Build\.dat$/i and ContextBaseFileName=/^DeElevate64\.exe$/i)
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, FileName, FilePath, aid], limit=200)

event.type in ('File Creation','File Modification') endpoint.name = * tgt.file.path = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.file.path

// HUNT: open of the Custom GPT ClickFix loader and storage carrier files (WAV, monitor.raw, Build.dat, execute_engine_disconnect.raw)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1027, T1027.013, T1574.002
// CONF: medium | FP: low
// FALSE POSITIVES: Build.dat is a generic name, so it only counts when opened by DeElevate64.exe
// EQUIVALENCE: telemetry-gap - The CQL reads Falcon file-open events. SentinelOne has no attested file-open event, so this partial pivot finds the carrier files being written instead, and Build.dat written by DeElevate64.exe instead of opened by it.
// REQUIRES: SentinelOne File Creation and File Modification telemetry
// TUNING: Treat a hit as the carrier file existing on disk, not as the loader reading it; pivot to Q6 for the host process.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: File opens are not visible: a carrier file that was staged before the agent was installed or only read is not captured. Build.dat is matched as a write by DeElevate64.exe, not an open by it; the other three names are matched on any writer, as in the CQL.
// VALIDATION LEVEL: static-reviewed
event.type in ('File Creation','File Modification')
(tgt.file.path matches '\\\\(Common\\.Integrator\\.Preview\\.wav|monitor\\.raw|execute_engine_disconnect\\.raw)$' or (tgt.file.path matches '\\\\Build\\.dat$' and src.process.name in:anycase ('DeElevate64.exe')))
| columns event.type, event.time, endpoint.name, src.process.user, src.process.name, tgt.file.path, agent.uuid
| limit 200

// HUNT: Run value or scheduled task named Canon Configuration Reader or Stardock DeElevation Tool (Custom GPT ClickFix RAT persistence)
// MITRE: T1547.001, T1053.005, T1036.005
// CONF: high | FP: low | COST: low | REQUIRES: ScheduledTaskRegistered (validate in tenant), AsepValueUpdate, ProcessRollup2
// FALSE POSITIVES: none expected. Genuine Canon and Stardock products do not use these names
// SOURCE: Huntress 2026-09-28 (both Run value and scheduled task carry the same name; later wave uses the Stardock name)
#event_simpleName=/^(ScheduledTaskRegistered|AsepValueUpdate|RegGenericValueUpdate|ProcessRollup2|SyntheticProcessRollup2)$/
| TaskName=/(Canon Configuration Reader|Stardock DeElevation Tool)/i or RegValueName=/^(Canon Configuration Reader|Stardock DeElevation Tool)$/i or (FileName=/^schtasks\.exe$/i and CommandLine=/(Canon Configuration Reader|Stardock DeElevation Tool)/i)
| table([@timestamp, ComputerName, UserName, #event_simpleName, TaskName, TaskExecutable, RegObjectName, RegValueName, RegStringValue, CommandLine, aid], limit=200)

event.type in ('Registry Value Modified','Process Creation') endpoint.name = *
| limit 5
| columns event.type, event.time, endpoint.name

// HUNT: Run value or scheduled task named Canon Configuration Reader or Stardock DeElevation Tool (Custom GPT ClickFix RAT persistence)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1547.001, T1053.005, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected. Genuine Canon and Stardock products do not use these names
// EQUIVALENCE: approximate-analytic - SentinelOne has no attested scheduled-task-registered event. The query matches the Run value name, the Task Scheduler TaskCache registry key for the same name, and schtasks.exe naming it on the command line.
// REQUIRES: SentinelOne Registry Value Modified and Process Creation telemetry
// TUNING: No exclusions expected: genuine Canon and Stardock products do not use these names.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A task registered through the Task Scheduler API without schtasks.exe and without a monitored TaskCache write is not captured.
// VALIDATION LEVEL: static-reviewed
(event.type = 'Registry Value Modified' (registry.valueName matches '^(Canon Configuration Reader|Stardock DeElevation Tool)$' or registry.keyPath matches 'Schedule\\\\TaskCache\\\\Tree\\\\(Canon Configuration Reader|Stardock DeElevation Tool)')) or (event.type = 'Process Creation' tgt.process.name in:anycase ('schtasks.exe') tgt.process.cmdline matches '(Canon Configuration Reader|Stardock DeElevation Tool)')
| columns event.type, event.time, endpoint.name, src.process.user, src.process.name, registry.keyPath, registry.valueName, registry.value, tgt.process.cmdline, agent.uuid
| limit 200

// HUNT: same scheduled task or autostart value written repeatedly on one host within hours (implant self-healing)
// MITRE: T1053.005, T1547.001
// CONF: medium | FP: medium | COST: medium | REQUIRES: ScheduledTaskRegistered (validate in tenant), AsepValueUpdate
// FALSE POSITIVES: browser, collaboration and cloud-sync updaters that rewrite their own autostart entry
// TUNING: exclude the vendor names that top the first 30-day run (updater tasks and Run values), and exclude names that appear on more than a handful of hosts; keep names that appear on one host only or whose executable sits under AppData\Local\Programs
// SOURCE: Huntress 2026-09-28 (Run key re-created every 150 s, task every 875 s)
#event_simpleName=/^(ScheduledTaskRegistered|AsepValueUpdate)$/
| persist_name := coalesce([TaskName, RegValueName])
| persist_name=*
| groupBy([aid, ComputerName, persist_name], function=[count(as=Writes), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen), collect([TaskExecutable, RegStringValue])], limit=2000)
| Writes > 1
| SpanMin := (LastSeen - FirstSeen) / 60000
| SpanMin > 0
| SpanMin < 120
| sort(Writes, order=desc, limit=200)

event.type = 'Registry Value Modified' endpoint.name = * registry.keyPath = * registry.valueName = * agent.uuid = *
| limit 5
| columns event.type, event.time, endpoint.name, registry.keyPath, registry.valueName, agent.uuid

// HUNT: same scheduled task or autostart value written repeatedly on one host within hours (implant self-healing)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1053.005, T1547.001
// CONF: medium | FP: medium
// FALSE POSITIVES: browser, collaboration and cloud-sync updaters that rewrite their own autostart entry
// EQUIVALENCE: telemetry-gap - Partial pivot: the Run and RunOnce half of the CQL, a value rewritten more than once per host. The scheduled-task half and the in-query span filter are not expressible, so the console time range carries the window.
// REQUIRES: SentinelOne Registry Value Modified telemetry for the Run keys
// TUNING: Exclude the vendor names that top the first 30-day run (updater Run values), and exclude names that appear on more than a handful of hosts; keep names on one host only or whose executable sits under AppData\Local\Programs.
// LOOKBACK: 2h in the console time range approximates the CQL span; widen only to review
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: Scheduled task re-registration is not visible, so the task half of the self-healing signal is missing. The span greater than zero and below 120 minutes filter is not applied; use a short console time range instead.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified'
registry.keyPath matches '\\\\CurrentVersion\\\\Run(Once)?(\\\\|$)'
registry.valueName = *
| group writes = count(), first_seen = min(event.time), last_seen = max(event.time), value_data = any(registry.value) by agent.uuid, host = endpoint.name, persist_name = registry.valueName
| filter writes > 1
| sort -writes
| limit 200

// HUNT: Canon or Stardock sideload host process making network connections or DNS lookups (DoH C2 channel)
// MITRE: T1071.001, T1572
// CONF: high | FP: medium | COST: low | REQUIRES: NetworkConnectIP4, DnsRequest with process context (validate in tenant)
// FALSE POSITIVES: a legitimate CaptureOnTouch or DeElevation install updating itself
// TUNING: pivot each hit on the process image path with Q6; a host process running from Program Files on a known scanner workstation is benign, one running from AppData\Local\Programs is not
// SOURCE: Huntress 2026-09-28 (DNS-over-HTTPS via Cloudflare, Google and Quad9; C2 address not recovered)
#event_simpleName=/^(NetworkConnectIP4|DnsRequest)$/
| ContextBaseFileName=/^(COTFileReadApp|DeElevate64)\.exe$/i
| table([@timestamp, ComputerName, UserName, #event_simpleName, ContextBaseFileName, RemoteAddressIP4, RemotePort, DomainName, aid], limit=200)

event.type in ('IP Connect','DNS Resolved') endpoint.name = * src.process.name = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name

// HUNT: Canon or Stardock sideload host process making network connections or DNS lookups (DoH C2 channel)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1572
// CONF: high | FP: medium
// FALSE POSITIVES: a legitimate CaptureOnTouch or DeElevation install updating itself
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: any network connection or DNS lookup by the Canon or Stardock host process. ContextBaseFileName maps to src.process.name.
// REQUIRES: SentinelOne IP Connect and DNS Resolved telemetry with process context
// TUNING: Pivot each hit on the process image path with Q6; a host running from Program Files on a known scanner workstation is benign, one running from AppData\Local\Programs is not.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: DNS-over-HTTPS appears as an IP Connect to the resolver, not a DNS Resolved event.
// VALIDATION LEVEL: static-reviewed
event.type in ('IP Connect','DNS Resolved')
src.process.name in:anycase ('COTFileReadApp.exe','DeElevate64.exe')
| columns event.type, event.time, endpoint.name, src.process.user, src.process.name, dst.ip.address, dst.port.number, event.dns.request, agent.uuid
| limit 200

// HUNT: outbound connections to the two published Custom GPT ClickFix delivery IPs (atomic IOC sweep)
// MITRE: T1105, T1071.001
// CONF: high | FP: low | COST: low | REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: none expected; both are published delivery addresses
// SOURCE: Huntress 2026-09-28 IOC table; 96.62.224.81 also in CyberSecurityNews and the CSA research note; 45.140.205.28 also in the CSA research note
#event_simpleName=NetworkConnectIP4
| RemoteAddressIP4=/^(96\.62\.224\.81|45\.140\.205\.28)$/
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort, aid], limit=200)

event.type = 'IP Connect' endpoint.name = * dst.ip.address = *
| limit 5
| columns event.type, event.time, endpoint.name, dst.ip.address

// HUNT: outbound connections to the two published Custom GPT ClickFix delivery IPs (atomic IOC sweep)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1105, T1071.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected; both are published delivery addresses
// EQUIVALENCE: equivalent-with-schema-assumptions - Same exact-address test on the two published delivery IPs.
// REQUIRES: SentinelOne IP Connect telemetry
// TUNING: No exclusions expected; both are published delivery addresses.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: Addresses are perishable, and an inbound-only contact is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect'
dst.ip.address in ('96.62.224.81','45.140.205.28')
| columns event.time, endpoint.name, src.process.user, src.process.name, dst.ip.address, dst.port.number, agent.uuid
| limit 200

// HUNT: SHA256 sweep for the Custom GPT ClickFix patched and malicious sideload DLLs (V1 Canon set and V2 Stardock set)
// MITRE: T1574.002
// CONF: high | FP: low | COST: medium | REQUIRES: SHA256HashData on file-write and process events
// FALSE POSITIVES: none expected for these hashes
// SOURCE: Huntress 2026-09-28 IOC table (single source)
#event_simpleName=/^(PeFileWritten|NewExecutableWritten|ProcessRollup2|SyntheticProcessRollup2)$/
| SHA256HashData=/^(e58831766e8d4313db9f8b85f90c3a840aa0d84cfeac285beefa40e39ad0d1fb|b77575413c0f97eaf31e4a44c884c1ecdc0049ec89916ceb0bf3aaaedc0442fe|eff5d63ddf1813962f0d8ad1250cea5486c8bb5dd27c3f432b43957a33e43764|9c615db040b88c18ce6b96f30d08797045b7d506f940bea452dc7a6992fdbb8d|0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f|3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621|b59a21a8d4c0c11a9ecbbdbe2a2938499c99c5ebb210c9c6db9683c7ad19f4c4|a27cafb84876a3374ef4aba1062345def6cd0b029eaf8e0dc44fa24fc943f3c6)$/i
| table([@timestamp, ComputerName, UserName, #event_simpleName, FileName, TargetFileName, ImageFileName, SHA256HashData, aid], limit=200)

event.type in ('File Creation','File Modification','Process Creation') endpoint.name = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.file.sha256, tgt.process.image.sha256

// HUNT: SHA256 sweep for the Custom GPT ClickFix patched and malicious sideload DLLs (V1 Canon set and V2 Stardock set)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002
// CONF: high | FP: low
// FALSE POSITIVES: none expected for these hashes
// EQUIVALENCE: equivalent-with-schema-assumptions - Same eight published SHA-256 values tested on file writes and on process creation.
// REQUIRES: SentinelOne File and Process Creation events with SHA-256 populated
// TUNING: Hashes change on rebuild; treat a miss as no evidence.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: The hashes are single-sourced; DLLs that are loaded but never written or started in the window are not captured.
// VALIDATION LEVEL: static-reviewed
(event.type in ('File Creation','File Modification') tgt.file.sha256 in:anycase ('e58831766e8d4313db9f8b85f90c3a840aa0d84cfeac285beefa40e39ad0d1fb','b77575413c0f97eaf31e4a44c884c1ecdc0049ec89916ceb0bf3aaaedc0442fe','eff5d63ddf1813962f0d8ad1250cea5486c8bb5dd27c3f432b43957a33e43764','9c615db040b88c18ce6b96f30d08797045b7d506f940bea452dc7a6992fdbb8d','0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f','3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621','b59a21a8d4c0c11a9ecbbdbe2a2938499c99c5ebb210c9c6db9683c7ad19f4c4','a27cafb84876a3374ef4aba1062345def6cd0b029eaf8e0dc44fa24fc943f3c6')) or (event.type = 'Process Creation' tgt.process.image.sha256 in:anycase ('e58831766e8d4313db9f8b85f90c3a840aa0d84cfeac285beefa40e39ad0d1fb','b77575413c0f97eaf31e4a44c884c1ecdc0049ec89916ceb0bf3aaaedc0442fe','eff5d63ddf1813962f0d8ad1250cea5486c8bb5dd27c3f432b43957a33e43764','9c615db040b88c18ce6b96f30d08797045b7d506f940bea452dc7a6992fdbb8d','0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f','3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621','b59a21a8d4c0c11a9ecbbdbe2a2938499c99c5ebb210c9c6db9683c7ad19f4c4','a27cafb84876a3374ef4aba1062345def6cd0b029eaf8e0dc44fa24fc943f3c6'))
| columns event.type, event.time, endpoint.name, src.process.user, tgt.process.name, tgt.file.path, tgt.file.sha256, tgt.process.image.path, tgt.process.image.sha256, agent.uuid
| limit 200

// HUNT: GOMCam2024.exe running from the AppstorageFile folder, or Chrome started with a temp-folder profile by it (RAT follow-on)
// MITRE: T1105, T1036.005
// CONF: medium | FP: low | COST: low | REQUIRES: process creation with image path and parent
// FALSE POSITIVES: a user who genuinely installed GOM Cam into this unusual folder (no known vendor path uses AppstorageFile)
// NOTE: GOMCam2024.exe is legitimately signed software. Detect only, never prevent.
// SOURCE: Huntress 2026-09-28 (GOMCam2024.exe in %LOCALAPPDATA%\AppstorageFile\ was the usual next step)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ImageFileName=/\\AppData\\Local\\AppstorageFile\\/i or (FileName=/^chrome\.exe$/i and ParentBaseFileName=/^GOMCam2024\.exe$/i)
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, ParentBaseFileName, CommandLine, SHA256HashData, aid], limit=200)

event.type = 'Process Creation' endpoint.name = * src.process.name = * tgt.process.name = * tgt.process.image.path = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.process.name, tgt.process.image.path, src.process.name

// HUNT: GOMCam2024.exe running from the AppstorageFile folder, or Chrome started with a temp-folder profile by it (RAT follow-on)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1105, T1036.005
// CONF: medium | FP: low
// FALSE POSITIVES: a user who genuinely installed GOM Cam into this unusual folder (no known vendor path uses AppstorageFile)
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: any process from the AppstorageFile folder, or chrome.exe created by GOMCam2024.exe. FileName and ImageFileName map to tgt.process.name and tgt.process.image.path; the parent maps to src.process.name.
// REQUIRES: SentinelOne Process Creation telemetry with image paths and parent names
// TUNING: No exclusions expected. GOMCam2024.exe is legitimately signed software: detect only, never prevent.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A payload renamed and run from a different folder is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
(tgt.process.image.path matches '\\\\AppData\\\\Local\\\\AppstorageFile\\\\' or (tgt.process.name in:anycase ('chrome.exe') and src.process.name in:anycase ('GOMCam2024.exe')))
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha256, agent.uuid
| limit 200