CyberXero: AI-Augmented Initial Access Broker

// HUNT: Process command line references CyberXero infrastructure (CyberXero)
// MITRE: T1059.001, T1105, T1071.001
// CONF: high  FP: low  COST: low
// REQUIRES: Process creation with command line (ProcessRollup2)
// FALSE POSITIVES: None expected: published attacker-owned addresses.
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(42\.193\.227\.214|42\.193\.100\.94|49\.234\.12\.182|46\.21\.250\.135|45\.88\.106\.2\b|45\.88\.106\.78|212\.193\.31\.189|91\.208\.184\.148)/
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.type, tgt.process.cmdline

// HUNT: Process command line references CyberXero infrastructure (CyberXero)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.001, T1105, T1071.001
// CONF: high | FP: low
// FALSE POSITIVES: None expected: published attacker-owned addresses.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: any of the eight published addresses in the created process's command line. matches is case-insensitive, and 45.88.106.2 keeps its word boundary as in the CQL.
// REQUIRES: SentinelOne process-creation telemetry with the command line
// TUNING: None expected: the addresses are published attacker infrastructure. Review any hit before closing it.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An address written in hex, as a decimal integer or defanged is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.cmdline matches '(42\\.193\\.227\\.214|42\\.193\\.100\\.94|49\\.234\\.12\\.182|46\\.21\\.250\\.135|45\\.88\\.106\\.2\\b|45\\.88\\.106\\.78|212\\.193\\.31\\.189|91\\.208\\.184\\.148)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: Process command line references CyberXero infrastructure (CyberXero)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.001, T1105, T1071.001
// CONF: high | FP: low
// FALSE POSITIVES: None expected: published attacker-owned addresses.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: any of the eight published addresses in the created process's command line, with the word boundary kept on 45.88.106.2.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected: the addresses are published attacker infrastructure. Review any hit before closing it.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An address written in hex, as a decimal integer or defanged is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine matches regex @"(42\.193\.227\.214|42\.193\.100\.94|49\.234\.12\.182|46\.21\.250\.135|45\.88\.106\.2\b|45\.88\.106\.78|212\.193\.31\.189|91\.208\.184\.148)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: PowerShell or cmd IEX download from a bare-IP URL with a high port (CyberXero)
// MITRE: T1059.001, T1105
// CONF: medium  FP: medium  COST: low
// REQUIRES: Process creation with command line (ProcessRollup2)
// FALSE POSITIVES: Internal artifact servers addressed by IP and port. TUNING below.
// TUNING: drop internal destinations with the commented CommandLine!=/.../ line once your artifact-server list is known; do not exclude by FileName alone
// LOOKBACK: 14d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Win
| FileName=/^(powershell|pwsh|cmd)(\.exe)?$/i
| CommandLine=/(\biex\b|invoke-expression|downloadstring|net\.webclient|invoke-webrequest|\biwr\b)/i
| CommandLine=/https?:\/\/[0-9]{1,3}(\.[0-9]{1,3}){3}:[0-9]{2,5}\b/i
// | CommandLine!=/https?:\/\/(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName])

event.type = 'Process Creation' endpoint.os = * tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.type, endpoint.os, tgt.process.name, tgt.process.cmdline

// HUNT: PowerShell or cmd IEX download from a bare-IP URL with a high port (CyberXero)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.001, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: Internal artifact servers addressed by IP and port. TUNING below.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on Windows: PowerShell or cmd carrying a download-and-execute token and an http(s) URL whose host is a bare IPv4 address with an explicit port. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation telemetry with the command line
// TUNING: Drop internal artifact servers by destination address once your artifact-server list is known. Do not exclude by process name alone.
// LOOKBACK: 14d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A download whose URL is assembled at run time is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
endpoint.os in:anycase ('windows')
tgt.process.name in:anycase ('powershell.exe', 'pwsh.exe', 'cmd.exe', 'powershell', 'pwsh', 'cmd')
tgt.process.cmdline matches '(\\biex\\b|invoke-expression|downloadstring|net\\.webclient|invoke-webrequest|\\biwr\\b)'
tgt.process.cmdline matches 'https?:[/][/][0-9]{1,3}(\\.[0-9]{1,3}){3}:[0-9]{2,5}\\b'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: PowerShell or cmd IEX download from a bare-IP URL with a high port (CyberXero)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.001, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: Internal artifact servers addressed by IP and port. TUNING below.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: PowerShell or cmd carrying a download-and-execute token and an http(s) URL whose host is a bare IPv4 address with an explicit port. The (?i) prefix reproduces the CQL /i intent. The Windows platform predicate is carried by the .exe image names.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Drop internal artifact servers by destination address once your artifact-server list is known. Do not exclude by process name alone.
// LOOKBACK: 14d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A download whose URL is assembled at run time is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe")
| where ProcessCommandLine matches regex @"(?i)(\biex\b|invoke-expression|downloadstring|net\.webclient|invoke-webrequest|\biwr\b)"
| where ProcessCommandLine matches regex @"(?i)https?://[0-9]{1,3}(\.[0-9]{1,3}){3}:[0-9]{2,5}\b"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: UpdSvc service created (Cobalt Strike svc.cna persistence) (CyberXero)
// MITRE: T1543.003, T1059.001
// CONF: high  FP: low  COST: low
// REQUIRES: Service creation (CreateService)
// FALSE POSITIVES: A vendor updater legitimately named UpdSvc (check ServiceImagePath).
// LOOKBACK: 30d
#event_simpleName=CreateService
| ServiceName=/^UpdSvc$/i or ServiceDisplayName=/^UpdSvc$/i or ServiceImagePath=/42\.193\.227\.214/
| table([@timestamp, aid, ComputerName, UserName, ServiceName, ServiceDisplayName, ServiceImagePath])
| sort(@timestamp, order=desc)

event.type = 'Registry Value Modified' registry.keyPath = * registry.value = *
| limit 5
| columns event.type, registry.keyPath, registry.value

// HUNT: UpdSvc service created (Cobalt Strike svc.cna persistence) (CyberXero)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1543.003, T1059.001
// CONF: high | FP: low
// FALSE POSITIVES: A vendor updater legitimately named UpdSvc (check ServiceImagePath).
// EQUIVALENCE: approximate-analytic - SentinelOne has no service-creation event in the attested field model. The service exists as a value written under the Services registry key, so the hunt reads Registry Value Modified: a key named UpdSvc, a value equal to UpdSvc (display name), or a value naming 42.193.227.214 (image path). The CQL reads the CreateService event directly.
// REQUIRES: SentinelOne registry telemetry for HKLM Services keys (Registry Value Modified)
// TUNING: A vendor updater legitimately named UpdSvc is the known false positive: check the image path value before escalating.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A service created through an API path that writes no observed registry value is not seen. The CQL service-created event is not available in this schema.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified'
registry.keyPath matches '\\\\Services\\\\'
(registry.keyPath matches '\\\\Services\\\\UpdSvc(\\\\|$)' or registry.value matches '^UpdSvc$' or registry.value matches '42\\.193\\.227\\.214')
| columns event.time, endpoint.name, src.process.name, registry.keyPath, registry.value
| sort -event.time
| limit 200

DeviceRegistryEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, RegistryKey, RegistryValueData
| take 5

// HUNT: UpdSvc service created (Cobalt Strike svc.cna persistence) (CyberXero)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1543.003, T1059.001
// CONF: high | FP: low
// FALSE POSITIVES: A vendor updater legitimately named UpdSvc (check ServiceImagePath).
// EQUIVALENCE: approximate-analytic - ServiceInstalled is recorded only when the Audit Security System Extension policy is deployed, so the hunt reads the registry write that creates the service instead: a key named UpdSvc, a value equal to UpdSvc (display name), or a value naming 42.193.227.214 (image path).
// REQUIRES: Defender for Endpoint registry telemetry (DeviceRegistryEvents)
// TUNING: A vendor updater legitimately named UpdSvc is the known false positive: check the image path value before escalating.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A service created through an API path that writes no observed registry value is not seen. The CQL service-created event has no direct Defender equivalent.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceRegistryEvents
| where Timestamp >= ago(30d)
| where ActionType == "RegistryValueSet"
| where RegistryKey matches regex @"(?i)\\Services\\"
| where RegistryKey matches regex @"(?i)\\Services\\UpdSvc$" or RegistryValueData matches regex @"(?i)^UpdSvc$" or RegistryValueData contains "42.193.227.214"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData
| sort by Timestamp desc
| take 200

// HUNT: Service created with a scripting-host binPath that downloads or decodes (CyberXero)
// MITRE: T1543.003, T1059.001
// CONF: medium  FP: medium  COST: low
// REQUIRES: Service creation (CreateService)
// FALSE POSITIVES: Vendor tools that wrap a PowerShell command in a service.
// TUNING: allowlist the vendor ServiceName values you find in your first run with the commented ServiceName!=/.../ line
// LOOKBACK: 30d
#event_simpleName=CreateService
| ServiceImagePath=/(powershell|pwsh|mshta|rundll32|cmd(\.exe)?\s+.c\s)/i
| ServiceImagePath=/(\biex\b|invoke-expression|downloadstring|frombase64string|-e(nc|ncodedcommand)?\s|https?:)/i
// | ServiceName!=/^(ExampleVendorAgent|ExampleBackupSvc)$/i
| table([@timestamp, aid, ComputerName, UserName, ServiceName, ServiceDisplayName, ServiceImagePath])

event.type = 'Registry Value Modified' registry.keyPath = * registry.value = *
| limit 5
| columns event.type, registry.keyPath, registry.value

// HUNT: Service created with a scripting-host binPath that downloads or decodes (CyberXero)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1543.003, T1059.001
// CONF: medium | FP: medium
// FALSE POSITIVES: Vendor tools that wrap a PowerShell command in a service.
// EQUIVALENCE: approximate-analytic - SentinelOne has no service-creation event in the attested field model, so the hunt reads the Registry Value Modified write under the Services key and applies both CQL predicates to the value: a scripting-host binary path, and a download or decode token. The CQL reads the ImagePath of the CreateService event directly.
// REQUIRES: SentinelOne registry telemetry for HKLM Services keys (Registry Value Modified)
// TUNING: Allowlist the vendor service key names found in the first run. Keep the download-token requirement so only downloaders remain.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A service created through an API path that writes no observed registry value is not seen. The CQL service-created event is not available in this schema.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified'
registry.keyPath matches '\\\\Services\\\\'
registry.value matches '(powershell|pwsh|mshta|rundll32|cmd(\\.exe)?\\s+.c\\s)'
registry.value matches '(\\biex\\b|invoke-expression|downloadstring|frombase64string|-e(nc|ncodedcommand)?\\s|https?:)'
| columns event.time, endpoint.name, src.process.name, registry.keyPath, registry.value
| sort -event.time
| limit 200

DeviceRegistryEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, RegistryKey, RegistryValueData
| take 5

// HUNT: Service created with a scripting-host binPath that downloads or decodes (CyberXero)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1543.003, T1059.001
// CONF: medium | FP: medium
// FALSE POSITIVES: Vendor tools that wrap a PowerShell command in a service.
// EQUIVALENCE: approximate-analytic - ServiceInstalled is recorded only when the Audit Security System Extension policy is deployed, so the hunt reads the registry write that creates the service and applies both CQL predicates to the value: a scripting-host binary path and a download or decode token.
// REQUIRES: Defender for Endpoint registry telemetry (DeviceRegistryEvents)
// TUNING: Allowlist the vendor service key names found in the first run. Keep the download-token requirement so only downloaders remain.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A service created through an API path that writes no observed registry value is not seen. The CQL service-created event has no direct Defender equivalent.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceRegistryEvents
| where Timestamp >= ago(30d)
| where ActionType == "RegistryValueSet"
| where RegistryKey matches regex @"(?i)\\Services\\"
| where RegistryValueData matches regex @"(?i)(powershell|pwsh|mshta|rundll32|cmd(\.exe)?\s+.c\s)"
| where RegistryValueData matches regex @"(?i)(\biex\b|invoke-expression|downloadstring|frombase64string|-e(nc|ncodedcommand)?\s|https?:)"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData
| sort by Timestamp desc
| take 200

// HUNT: Script host spawned by services.exe with a download or decode token (CyberXero)
// MITRE: T1543.003, T1059.001
// CONF: medium  FP: medium  COST: low
// REQUIRES: Process creation with parent (ProcessRollup2)
// FALSE POSITIVES: Management-agent service wrappers.
// TUNING: exclude the exact CommandLine of approved agents; keep the URL token requirement so only downloaders remain
// LOOKBACK: 14d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Win
| ParentBaseFileName=/^services\.exe$/i
| FileName=/^(powershell|pwsh|cmd|mshta|rundll32)(\.exe)?$/i
| CommandLine=/(\biex\b|invoke-expression|downloadstring|frombase64string|https?:)/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName])

event.type = 'Process Creation' endpoint.os = * src.process.name = * tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.type, endpoint.os, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: Script host spawned by services.exe with a download or decode token (CyberXero)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1543.003, T1059.001
// CONF: medium | FP: medium
// FALSE POSITIVES: Management-agent service wrappers.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on Windows: a script host or LOLBin created by services.exe whose command line has a download or decode token. On a Process Creation event the created process is tgt.process.* and its creator, services.exe, is src.process.*.
// REQUIRES: SentinelOne process-creation telemetry with the creator process and command line
// TUNING: Exclude the exact command line of approved management agents. Keep the URL token requirement so only downloaders remain.
// LOOKBACK: 14d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A service wrapper that launches the script host through an intermediate process is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
endpoint.os in:anycase ('windows')
src.process.name in:anycase ('services.exe')
tgt.process.name in:anycase ('powershell.exe', 'pwsh.exe', 'cmd.exe', 'mshta.exe', 'rundll32.exe', 'powershell', 'pwsh', 'cmd', 'mshta', 'rundll32')
tgt.process.cmdline matches '(\\biex\\b|invoke-expression|downloadstring|frombase64string|https?:)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName, ProcessCommandLine
| take 5

// HUNT: Script host spawned by services.exe with a download or decode token (CyberXero)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1543.003, T1059.001
// CONF: medium | FP: medium
// FALSE POSITIVES: Management-agent service wrappers.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a script host or LOLBin created by services.exe whose command line has a download or decode token. The creator is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude the exact command line of approved management agents. Keep the URL token requirement so only downloaders remain.
// LOOKBACK: 14d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A service wrapper that launches the script host through an intermediate process is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where InitiatingProcessFileName =~ "services.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "mshta.exe", "rundll32.exe")
| where ProcessCommandLine matches regex @"(?i)(\biex\b|invoke-expression|downloadstring|frombase64string|https?:)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Outbound connection to a published CyberXero address (CyberXero)
// MITRE: T1071.001, T1105, T1090
// CONF: high  FP: low  COST: low
// REQUIRES: Outbound network connection with process (NetworkConnectIP4)
// FALSE POSITIVES: None expected: published attacker-owned addresses.
// LOOKBACK: 30d
#event_simpleName=NetworkConnectIP4
| in(field=RemoteAddressIP4, values=["46.21.250.135","45.88.106.2","45.88.106.78","42.193.227.214","42.193.100.94","49.234.12.182","212.193.31.189","91.208.184.148"])
| table([@timestamp, aid, ComputerName, event_platform, ContextBaseFileName, RemoteAddressIP4, RemotePort, LocalAddressIP4])
| sort(@timestamp, order=desc)

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.type, dst.ip.address, dst.port.number

// HUNT: Outbound connection to a published CyberXero address (CyberXero)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1105, T1090
// CONF: high | FP: low
// FALSE POSITIVES: None expected: published attacker-owned addresses.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate: an endpoint connection whose destination is one of the eight published addresses. The process that opened the connection is src.process.* on a non-process event.
// REQUIRES: SentinelOne network telemetry (IP Connect) with the owning process
// TUNING: None expected: the addresses are published attacker infrastructure. Review any hit before closing it.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Traffic that never reaches the endpoint sensor, such as a connection from a device with no agent, is not seen.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect'
dst.ip.address in ('46.21.250.135', '45.88.106.2', '45.88.106.78', '42.193.227.214', '42.193.100.94', '49.234.12.182', '212.193.31.189', '91.208.184.148')
| columns event.time, endpoint.name, src.process.name, src.ip.address, dst.ip.address, dst.port.number
| sort -event.time
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, RemoteIP, RemotePort
| take 5

// HUNT: Outbound connection to a published CyberXero address (CyberXero)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1105, T1090
// CONF: high | FP: low
// FALSE POSITIVES: None expected: published attacker-owned addresses.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate: an endpoint connection whose remote address is one of the eight published addresses, limited to outbound connection action types so inbound accepts stay with the next card.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: None expected: the addresses are published attacker infrastructure. Review any hit before closing it.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Traffic that never reaches the endpoint sensor, such as a connection from a device with no agent, is not seen.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where ActionType in ("ConnectionSuccess", "ConnectionFailed", "ConnectionRequest")
| where RemoteIP in ("46.21.250.135", "45.88.106.2", "45.88.106.78", "42.193.227.214", "42.193.100.94", "49.234.12.182", "212.193.31.189", "91.208.184.148")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, LocalIP
| sort by Timestamp desc
| take 200

// HUNT: Inbound connection accepted from a published CyberXero address (CyberXero)
// MITRE: T1595.002, T1190, T1021.004
// CONF: medium  FP: low  COST: low
// REQUIRES: Inbound accepted connection (NetworkReceiveAcceptIP4)
// FALSE POSITIVES: Scan hits against internet-facing hosts are context only.
// LOOKBACK: 30d
#event_simpleName=NetworkReceiveAcceptIP4
| in(field=RemoteAddressIP4, values=["46.21.250.135","45.88.106.2","45.88.106.78","42.193.227.214","42.193.100.94","49.234.12.182","212.193.31.189","91.208.184.148"])
| table([@timestamp, aid, ComputerName, event_platform, ContextBaseFileName, RemoteAddressIP4, LocalPort, LocalAddressIP4])
| sort(@timestamp, order=desc)

event.type = 'IP Connect' event.network.direction = * src.ip.address = *
| limit 5
| columns event.type, event.network.direction, src.ip.address, dst.port.number

// HUNT: Inbound connection accepted from a published CyberXero address (CyberXero)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1595.002, T1190, T1021.004
// CONF: medium | FP: low
// FALSE POSITIVES: Scan hits against internet-facing hosts are context only.
// EQUIVALENCE: approximate-analytic - The CQL reads an accepted-inbound-connection event. SentinelOne reports it as an IP Connect event whose direction is incoming, with the remote peer in the source address. The direction field and its value are documented but not seen in shipped queries, so the match is an approximation until confirmed on a tenant.
// REQUIRES: SentinelOne network telemetry (IP Connect) with the connection direction
// TUNING: Scan hits against internet-facing hosts are context only. Pair a hit with a successful logon or a process event on the same host before escalating.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: If the tenant does not populate the direction field the query returns nothing, which reads as a clean estate.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect'
event.network.direction in:anycase ('incoming')
src.ip.address in ('46.21.250.135', '45.88.106.2', '45.88.106.78', '42.193.227.214', '42.193.100.94', '49.234.12.182', '212.193.31.189', '91.208.184.148')
| columns event.time, endpoint.name, src.process.name, src.ip.address, dst.ip.address, dst.port.number
| sort -event.time
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| where ActionType == "InboundConnectionAccepted"
| project Timestamp, ActionType, RemoteIP, LocalPort
| take 5

// HUNT: Inbound connection accepted from a published CyberXero address (CyberXero)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1595.002, T1190, T1021.004
// CONF: medium | FP: low
// FALSE POSITIVES: Scan hits against internet-facing hosts are context only.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate: an accepted inbound connection whose remote address is one of the eight published addresses. InboundConnectionAccepted is the action type for an accepted inbound connection.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Scan hits against internet-facing hosts are context only. Pair a hit with a successful logon or a process event on the same host before escalating.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: If the tenant does not record InboundConnectionAccepted the query returns nothing, which reads as a clean estate.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where ActionType == "InboundConnectionAccepted"
| where RemoteIP in ("46.21.250.135", "45.88.106.2", "45.88.106.78", "42.193.227.214", "42.193.100.94", "49.234.12.182", "212.193.31.189", "91.208.184.148")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, RemoteIP, LocalPort, LocalIP
| sort by Timestamp desc
| take 200

// HUNT: External connection on the team server port set (CyberXero)
// MITRE: T1071.001, T1571
// CONF: medium  FP: medium  COST: medium
// REQUIRES: Outbound network connection with process (NetworkConnectIP4)
// FALSE POSITIVES: Legitimate software on 8044 or 9995.
// TUNING: exclude vendor destination IPs after your first run, and rank rows whose ContextBaseFileName is a scripting host or an unsigned binary first
// LOOKBACK: 7d
#event_simpleName=NetworkConnectIP4
| in(field=RemotePort, values=["1002","8033","8044","9995"])
| !cidr(RemoteAddressIP4, subnet="10.0.0.0/8")
| !cidr(RemoteAddressIP4, subnet="172.16.0.0/12")
| !cidr(RemoteAddressIP4, subnet="192.168.0.0/16")
| !cidr(RemoteAddressIP4, subnet="127.0.0.0/8")
| groupBy([aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], function=[count(as=conns), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)])
| sort(conns, order=desc)

event.type = 'IP Connect' dst.port.number = * dst.ip.address = *
| limit 5
| columns event.type, dst.port.number, dst.ip.address

// HUNT: External connection on the team server port set (CyberXero)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1571
// CONF: medium | FP: medium
// FALSE POSITIVES: Legitimate software on 8044 or 9995.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate: connections to destination ports 1002, 8033, 8044 or 9995 where the destination is not RFC 1918 or loopback, counted per host, process, destination and port with first and last seen.
// REQUIRES: SentinelOne network telemetry (IP Connect) with the owning process
// TUNING: Exclude vendor destination addresses after the first run, and rank rows whose process is a script host or an unsigned binary first.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The link-local and carrier-grade NAT ranges are treated as external here, as they are in the CQL.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect'
dst.port.number in (1002, 8033, 8044, 9995)
!(net_rfc1918(dst.ip.address))
!(net_ipsubnet(dst.ip.address, '127.0.0.0/8'))
| group connections = count(), first_seen = min(event.time), last_seen = max(event.time) by endpoint.name, src.process.name, dst.ip.address, dst.port.number
| sort -connections
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, RemotePort, RemoteIPType
| take 5

// HUNT: External connection on the team server port set (CyberXero)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1571
// CONF: medium | FP: medium
// FALSE POSITIVES: Legitimate software on 8044 or 9995.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate: outbound connections to remote ports 1002, 8033, 8044 or 9995 where the remote address is public, counted per host, process, address and port. RemoteIPType replaces the CQL subnet exclusions.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Exclude vendor destination addresses after the first run, and rank rows whose process is a script host or an unsigned binary first.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: RemoteIPType Public excludes link-local and carrier-grade NAT addresses, which the CQL treats as external.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where ActionType in ("ConnectionSuccess", "ConnectionFailed", "ConnectionRequest")
| where RemotePort in (1002, 8033, 8044, 9995)
| where RemoteIPType == "Public"
| summarize connections = count(), first_seen = min(Timestamp), last_seen = max(Timestamp) by DeviceId, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| sort by connections desc
| take 200

// HUNT: Command shell or script host spawned by WmiPrvSE.exe (CyberXero)
// MITRE: T1047
// CONF: medium  FP: medium  COST: low
// REQUIRES: Process creation with parent (ProcessRollup2)
// FALSE POSITIVES: Management and monitoring agents that run through WMI.
// TUNING: exclude your management-tool UserName values and exact CommandLine strings; treat any hit with an IEX, download or encoded token as high priority
// LOOKBACK: 14d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Win
| ParentBaseFileName=/^wmiprvse\.exe$/i
| FileName=/^(cmd|powershell|pwsh|rundll32|mshta|regsvr32|wscript|cscript|certutil|bitsadmin)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName])

event.type = 'Process Creation' endpoint.os = * src.process.name = * tgt.process.name = *
| limit 5
| columns event.type, endpoint.os, src.process.name, tgt.process.name

// HUNT: Command shell or script host spawned by WmiPrvSE.exe (CyberXero)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1047
// CONF: medium | FP: medium
// FALSE POSITIVES: Management and monitoring agents that run through WMI.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on Windows: a command shell, script host or LOLBin created by WmiPrvSE.exe. On a Process Creation event the created process is tgt.process.* and its creator, WmiPrvSE.exe, is src.process.*.
// REQUIRES: SentinelOne process-creation telemetry with the creator process
// TUNING: Exclude your management-tool accounts and exact command lines. Treat any hit with an IEX, download or encoded token as high priority.
// LOOKBACK: 14d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A payload that runs inside the WMI provider host without creating a child process is not seen.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
endpoint.os in:anycase ('windows')
src.process.name in:anycase ('wmiprvse.exe')
tgt.process.name in:anycase ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'rundll32.exe', 'mshta.exe', 'regsvr32.exe', 'wscript.exe', 'cscript.exe', 'certutil.exe', 'bitsadmin.exe')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName
| take 5

// HUNT: Command shell or script host spawned by WmiPrvSE.exe (CyberXero)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1047
// CONF: medium | FP: medium
// FALSE POSITIVES: Management and monitoring agents that run through WMI.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a command shell, script host or LOLBin created by WmiPrvSE.exe. The creator is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude your management-tool accounts and exact command lines. Treat any hit with an IEX, download or encoded token as high priority.
// LOOKBACK: 14d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A payload that runs inside the WMI provider host without creating a child process is not seen.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where InitiatingProcessFileName =~ "wmiprvse.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "mshta.exe", "regsvr32.exe", "wscript.exe", "cscript.exe", "certutil.exe", "bitsadmin.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: WMI remote-execution initiators on the source host (CyberXero)
// MITRE: T1047
// CONF: medium  FP: medium  COST: medium
// REQUIRES: Process creation with command line (ProcessRollup2)
// FALSE POSITIVES: Admin and inventory scripts.
// TUNING: exclude the jump hosts and service accounts in your estate that legitimately run remote WMI; keep wmic process call create unexcluded
// LOOKBACK: 14d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Win
| FileName=/^(wmic|powershell|pwsh)(\.exe)?$/i
| CommandLine=/(\s.node:|process\s+call\s+create|invoke-wmimethod|invoke-cimmethod|win32_process.*(computername|cimsession))/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName])

event.type = 'Process Creation' endpoint.os = * tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.type, endpoint.os, tgt.process.name, tgt.process.cmdline

// HUNT: WMI remote-execution initiators on the source host (CyberXero)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1047
// CONF: medium | FP: medium
// FALSE POSITIVES: Admin and inventory scripts.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on Windows: wmic or PowerShell with a remote-node switch, a process call create, or a WMI or CIM method call. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation telemetry with the command line
// TUNING: Exclude the jump hosts and service accounts that legitimately run remote WMI. Keep wmic process call create unexcluded.
// LOOKBACK: 14d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Remote WMI started from a tool other than wmic or PowerShell is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
endpoint.os in:anycase ('windows')
tgt.process.name in:anycase ('wmic.exe', 'powershell.exe', 'pwsh.exe', 'wmic', 'powershell', 'pwsh')
tgt.process.cmdline matches '(\\s.node:|process\\s+call\\s+create|invoke-wmimethod|invoke-cimmethod|win32_process.*(computername|cimsession))'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: WMI remote-execution initiators on the source host (CyberXero)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1047
// CONF: medium | FP: medium
// FALSE POSITIVES: Admin and inventory scripts.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: wmic or PowerShell with a remote-node switch, a process call create, or a WMI or CIM method call. The (?i) prefix reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude the jump hosts and service accounts that legitimately run remote WMI. Keep wmic process call create unexcluded.
// LOOKBACK: 14d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Remote WMI started from a tool other than wmic or PowerShell is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where FileName in~ ("wmic.exe", "powershell.exe", "pwsh.exe")
| where ProcessCommandLine matches regex @"(?i)(\s.node:|process\s+call\s+create|invoke-wmimethod|invoke-cimmethod|win32_process.*(computername|cimsession))"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: redis-cli replication or config abuse on a Linux host (CyberXero)
// MITRE: T1190, T1098.004, T1059.004
// CONF: medium  FP: medium  COST: low
// REQUIRES: Linux process creation with command line (ProcessRollup2)
// FALSE POSITIVES: Redis administrators building replicas.
// TUNING: exclude the admin UserName and the replication targets that are your own replicas; CONFIG SET dir pointing at a .ssh path is never legitimate
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Lin
| FileName=/^redis-cli$/
| CommandLine=/(slaveof|replicaof|config\s+set\s+(dir|dbfilename)|module\s+load)/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName])

event.type = 'Process Creation' endpoint.os = * tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.type, endpoint.os, tgt.process.name, tgt.process.cmdline

// HUNT: redis-cli replication or config abuse on a Linux host (CyberXero)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1098.004, T1059.004
// CONF: medium | FP: medium
// FALSE POSITIVES: Redis administrators building replicas.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on Linux: redis-cli started with a replication, configuration-write or module-load command. The name match is case-sensitive as in the CQL, and the command match is case-insensitive.
// REQUIRES: SentinelOne Linux process-creation telemetry with the command line
// TUNING: Exclude the administrator account and the replication targets that are your own replicas. CONFIG SET dir pointing at a .ssh path is never legitimate.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Commands piped to redis-cli on standard input, or sent by a client other than redis-cli, are not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
endpoint.os in:anycase ('linux')
tgt.process.name = 'redis-cli'
tgt.process.cmdline matches '(slaveof|replicaof|config\\s+set\\s+(dir|dbfilename)|module\\s+load)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: redis-cli replication or config abuse on a Linux host (CyberXero)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1190, T1098.004, T1059.004
// CONF: medium | FP: medium
// FALSE POSITIVES: Redis administrators building replicas.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: redis-cli started with a replication, configuration-write or module-load command. The name match is case-sensitive as in the CQL, and the (?i) prefix keeps the command match case-insensitive.
// REQUIRES: Defender for Endpoint for Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude the administrator account and the replication targets that are your own replicas. CONFIG SET dir pointing at a .ssh path is never legitimate.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Commands piped to redis-cli on standard input, or sent by a client other than redis-cli, are not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName == "redis-cli"
| where ProcessCommandLine matches regex @"(?i)(slaveof|replicaof|config\s+set\s+(dir|dbfilename)|module\s+load)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: redis-server spawning a shell or downloader (CyberXero)
// MITRE: T1190, T1059.004, T1105
// CONF: high  FP: low  COST: low
// REQUIRES: Linux process creation with parent (ProcessRollup2)
// FALSE POSITIVES: Rare custom Redis integrations.
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Lin
| ParentBaseFileName=/^redis-server$/
| FileName=/^(sh|bash|dash|zsh|curl|wget|nc|ncat|python3?|perl|busybox|chmod|crontab)$/
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName])

event.type = 'Process Creation' endpoint.os = * src.process.name = * tgt.process.name = *
| limit 5
| columns event.type, endpoint.os, src.process.name, tgt.process.name

// HUNT: redis-server spawning a shell or downloader (CyberXero)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1059.004, T1105
// CONF: high | FP: low
// FALSE POSITIVES: Rare custom Redis integrations.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on Linux: a shell, downloader or interpreter created by redis-server. On a Process Creation event the created process is tgt.process.* and its creator, redis-server, is src.process.*. Both name matches are case-sensitive as in the CQL.
// REQUIRES: SentinelOne Linux process-creation telemetry with the creator process
// TUNING: None expected beyond rare custom Redis integrations. Review the command line of any hit.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A child started through a double fork, so that redis-server is no longer its creator, is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
endpoint.os in:anycase ('linux')
src.process.name = 'redis-server'
tgt.process.name in ('sh', 'bash', 'dash', 'zsh', 'curl', 'wget', 'nc', 'ncat', 'python', 'python3', 'perl', 'busybox', 'chmod', 'crontab')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName
| take 5

// HUNT: redis-server spawning a shell or downloader (CyberXero)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1190, T1059.004, T1105
// CONF: high | FP: low
// FALSE POSITIVES: Rare custom Redis integrations.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a shell, downloader or interpreter created by redis-server. The creator is InitiatingProcessFileName. Both name matches are case-sensitive as in the CQL.
// REQUIRES: Defender for Endpoint for Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected beyond rare custom Redis integrations. Review the command line of any hit.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A child started through a double fork, so that redis-server is no longer its creator, is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName == "redis-server"
| where FileName in ("sh", "bash", "dash", "zsh", "curl", "wget", "nc", "ncat", "python", "python3", "perl", "busybox", "chmod", "crontab")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: authorized_keys written or edited by a shell or file tool (CyberXero)
// MITRE: T1098.004
// CONF: medium  FP: medium  COST: low
// REQUIRES: Linux process creation with command line (ProcessRollup2)
// FALSE POSITIVES: Configuration management and cloud-init.
// TUNING: exclude your configuration-management parents with the commented line; escalate when the writer's parent is a web server, redis-server or an interactive shell on a server that has no admin logon
// LOOKBACK: 14d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Lin
| CommandLine=/authorized_keys/
| FileName=/^(sh|bash|dash|zsh|tee|cp|mv|cat|echo|sed|printf|chattr|chmod|curl|wget|python3?|perl)$/
// | ParentBaseFileName!=/^(ansible.*|puppet|chef-client|salt-minion|cloud-init.*)$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName])

event.type = 'Process Creation' endpoint.os = * tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.type, endpoint.os, tgt.process.name, tgt.process.cmdline

// HUNT: authorized_keys written or edited by a shell or file tool (CyberXero)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1098.004
// CONF: medium | FP: medium
// FALSE POSITIVES: Configuration management and cloud-init.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on Linux: a shell or file tool whose command line names authorized_keys. Both the command-line match and the name match are case-sensitive as in the CQL.
// REQUIRES: SentinelOne Linux process-creation telemetry with the command line
// TUNING: Exclude your configuration-management parents by src.process.name. Escalate when the writer's creator is a web server, redis-server or an interactive shell on a server with no administrator logon.
// LOOKBACK: 14d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An editor such as vi or nano that writes the file is not in the tool list, as in the CQL, and a write by a process that does not name the file on its command line is not seen.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
endpoint.os in:anycase ('linux')
tgt.process.name in ('sh', 'bash', 'dash', 'zsh', 'tee', 'cp', 'mv', 'cat', 'echo', 'sed', 'printf', 'chattr', 'chmod', 'curl', 'wget', 'python', 'python3', 'perl')
tgt.process.cmdline matches:matchcase 'authorized_keys'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: authorized_keys written or edited by a shell or file tool (CyberXero)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1098.004
// CONF: medium | FP: medium
// FALSE POSITIVES: Configuration management and cloud-init.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a shell or file tool whose command line names authorized_keys. matches regex without the (?i) prefix is case-sensitive, as is the CQL, and in is case-sensitive for the tool names.
// REQUIRES: Defender for Endpoint for Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude your configuration-management parents by InitiatingProcessFileName. Escalate when the writer's creator is a web server, redis-server or an interactive shell on a server with no administrator logon.
// LOOKBACK: 14d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An editor such as vi or nano that writes the file is not in the tool list, as in the CQL, and a write by a process that does not name the file on its command line is not seen.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where FileName in ("sh", "bash", "dash", "zsh", "tee", "cp", "mv", "cat", "echo", "sed", "printf", "chattr", "chmod", "curl", "wget", "python", "python3", "perl")
| where ProcessCommandLine matches regex @"authorized_keys"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Inbound connection to Redis port 6379 from a public address (CyberXero)
// MITRE: T1190, T1595.002
// CONF: medium  FP: medium  COST: medium
// REQUIRES: Inbound accepted connection (NetworkReceiveAcceptIP4)
// FALSE POSITIVES: Intentionally exposed Redis and known peers.
// TUNING: exclude the public peer addresses you expect and treat every remaining source as an exposure finding
// LOOKBACK: 7d
#event_simpleName=NetworkReceiveAcceptIP4
| LocalPort=6379
| !cidr(RemoteAddressIP4, subnet="10.0.0.0/8")
| !cidr(RemoteAddressIP4, subnet="172.16.0.0/12")
| !cidr(RemoteAddressIP4, subnet="192.168.0.0/16")
| !cidr(RemoteAddressIP4, subnet="127.0.0.0/8")
| groupBy([aid, ComputerName, RemoteAddressIP4], function=[count(as=accepts), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)])
| sort(accepts, order=desc)

event.type = 'IP Connect' event.network.direction = * dst.port.number = * src.ip.address = *
| limit 5
| columns event.type, event.network.direction, dst.port.number, src.ip.address

// HUNT: Inbound connection to Redis port 6379 from a public address (CyberXero)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1595.002
// CONF: medium | FP: medium
// FALSE POSITIVES: Intentionally exposed Redis and known peers.
// EQUIVALENCE: approximate-analytic - The CQL reads an accepted-inbound-connection event on local port 6379. SentinelOne reports it as an IP Connect event whose direction is incoming, with the remote peer in the source address and the local listener in the destination. The direction field and the side of the local port are documented but not seen in shipped queries, so the match is an approximation until confirmed on a tenant.
// REQUIRES: SentinelOne network telemetry (IP Connect) with the connection direction
// TUNING: Exclude the public peer addresses you expect, and treat every remaining source as an exposure finding.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: If the tenant does not populate the direction field, or puts the local port on the source side, the query returns nothing, which reads as a clean estate.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect'
event.network.direction in:anycase ('incoming')
dst.port.number = 6379
!(net_rfc1918(src.ip.address))
!(net_ipsubnet(src.ip.address, '127.0.0.0/8'))
| group accepts = count(), first_seen = min(event.time), last_seen = max(event.time) by endpoint.name, src.ip.address
| sort -accepts
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| where ActionType == "InboundConnectionAccepted"
| project Timestamp, ActionType, LocalPort, RemoteIPType
| take 5

// HUNT: Inbound connection to Redis port 6379 from a public address (CyberXero)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1190, T1595.002
// CONF: medium | FP: medium
// FALSE POSITIVES: Intentionally exposed Redis and known peers.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate: accepted inbound connections to local port 6379 from a public remote address, counted per host and source. RemoteIPType replaces the CQL subnet exclusions.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Exclude the public peer addresses you expect, and treat every remaining source as an exposure finding.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: If the tenant does not record InboundConnectionAccepted the query returns nothing, which reads as a clean estate. RemoteIPType Public excludes link-local and carrier-grade NAT addresses, which the CQL treats as external.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where ActionType == "InboundConnectionAccepted"
| where LocalPort == 6379
| where RemoteIPType == "Public"
| summarize accepts = count(), first_seen = min(Timestamp), last_seen = max(Timestamp) by DeviceId, DeviceName, RemoteIP
| sort by accepts desc
| take 200

// HUNT: Web server worker spawning a shell or recon utility (CyberXero)
// MITRE: T1505.003, T1059.004, T1059.003
// CONF: medium  FP: medium  COST: low
// REQUIRES: Process creation with parent (ProcessRollup2)
// FALSE POSITIVES: PHP or IIS applications that legitimately shell out.
// TUNING: allowlist the exact CommandLine of known application helpers; keep whoami, id, uname, hostname and net/nltest recon unexcluded
// LOOKBACK: 14d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(apache2|httpd|nginx|php-fpm[0-9.]*|php-cgi|lsphp[0-9]*|w3wp)(\.exe)?$/i
| FileName=/^(sh|bash|dash|zsh|cmd|powershell|pwsh|whoami|id|uname|hostname|curl|wget|nc|ncat|certutil|net|net1|nltest)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, event_platform, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' src.process.name = * tgt.process.name = *
| limit 5
| columns event.type, src.process.name, tgt.process.name

// HUNT: Web server worker spawning a shell or recon utility (CyberXero)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1505.003, T1059.004, T1059.003
// CONF: medium | FP: medium
// FALSE POSITIVES: PHP or IIS applications that legitimately shell out.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on Windows and Linux: a shell, downloader or recon utility created by a web server worker. On a Process Creation event the created process is tgt.process.* and its creator, the worker, is src.process.*. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation telemetry with the creator process
// TUNING: Allowlist the exact command line of known application helpers. Keep whoami, id, uname, hostname and net or nltest recon unexcluded.
// LOOKBACK: 14d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A worker with a name outside the list, such as a Tomcat or Node.js server, is not covered, as in the CQL.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
src.process.name matches '^(apache2|httpd|nginx|php-fpm[0-9.]*|php-cgi|lsphp[0-9]*|w3wp)(\\.exe)?$'
tgt.process.name matches '^(sh|bash|dash|zsh|cmd|powershell|pwsh|whoami|id|uname|hostname|curl|wget|nc|ncat|certutil|net|net1|nltest)(\\.exe)?$'
| columns event.time, endpoint.name, endpoint.os, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName
| take 5

// HUNT: Web server worker spawning a shell or recon utility (CyberXero)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1505.003, T1059.004, T1059.003
// CONF: medium | FP: medium
// FALSE POSITIVES: PHP or IIS applications that legitimately shell out.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a shell, downloader or recon utility created by a web server worker. The creator is InitiatingProcessFileName. The (?i) prefix reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Allowlist the exact command line of known application helpers. Keep whoami, id, uname, hostname and net or nltest recon unexcluded.
// LOOKBACK: 14d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A worker with a name outside the list, such as a Tomcat or Node.js server, is not covered, as in the CQL.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where InitiatingProcessFileName matches regex @"(?i)^(apache2|httpd|nginx|php-fpm[0-9.]*|php-cgi|lsphp[0-9]*|w3wp)(\.exe)?$"
| where FileName matches regex @"(?i)^(sh|bash|dash|zsh|cmd|powershell|pwsh|whoami|id|uname|hostname|curl|wget|nc|ncat|certutil|net|net1|nltest)(\.exe)?$"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Web worker child-process burst (machine-speed tempo) (CyberXero)
// MITRE: T1505.003, T1059
// CONF: medium  FP: medium  COST: medium
// REQUIRES: Process creation with parent (ProcessRollup2)
// FALSE POSITIVES: Deployment hooks and chatty PHP applications.
// TUNING: raise the distinct_tools threshold on busy application hosts or exclude the nightly deploy window; investigate any host that also fired Q15
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(apache2|httpd|nginx|php-fpm[0-9.]*|php-cgi|lsphp[0-9]*|w3wp)(\.exe)?$/i
| FileName=/^(sh|bash|dash|zsh|cmd|powershell|pwsh|whoami|id|uname|hostname|curl|wget|nc|ncat|certutil|net|net1|nltest|ls|cat|find|ps|ifconfig|ip)(\.exe)?$/i
| bucket(span=2m, field=[aid, ComputerName], function=[count(FileName, distinct=true, as=distinct_tools), count(as=children)])
| test(distinct_tools >= 4)
| sort(distinct_tools, order=desc)

event.type = 'Process Creation' src.process.name = * tgt.process.name = *
| limit 5
| columns event.type, src.process.name, tgt.process.name

// HUNT: Web worker child-process burst (machine-speed tempo) (CyberXero)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1505.003, T1059
// CONF: medium | FP: medium
// FALSE POSITIVES: Deployment hooks and chatty PHP applications.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same behaviour: children of a web server worker in the shell and recon list, bucketed into two-minute windows per host, kept when four or more distinct tools appear. timebucket gives fixed windows as the CQL bucket does, but the window edges are chosen by the platform and may differ from the CQL's. estimate_distinct stands in for the exact distinct count.
// REQUIRES: SentinelOne process-creation telemetry with the creator process
// TUNING: Raise the distinct_tools threshold on busy application hosts or exclude the nightly deploy window. Investigate any host that also fired the web-worker child-process card.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A burst split across two windows can fall under the threshold in both.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
src.process.name matches '^(apache2|httpd|nginx|php-fpm[0-9.]*|php-cgi|lsphp[0-9]*|w3wp)(\\.exe)?$'
tgt.process.name matches '^(sh|bash|dash|zsh|cmd|powershell|pwsh|whoami|id|uname|hostname|curl|wget|nc|ncat|certutil|net|net1|nltest|ls|cat|find|ps|ifconfig|ip)(\\.exe)?$'
| group distinct_tools = estimate_distinct(tgt.process.name), children = count() by endpoint.name, window = timebucket('2m')
| filter distinct_tools >= 4
| sort -distinct_tools
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName
| take 5

// HUNT: Web worker child-process burst (machine-speed tempo) (CyberXero)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1505.003, T1059
// CONF: medium | FP: medium
// FALSE POSITIVES: Deployment hooks and chatty PHP applications.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same behaviour: children of a web server worker in the shell and recon list, bucketed into two-minute windows per device, kept when four or more distinct tools appear. dcount is an estimate that is exact at these small counts.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Raise the distinct_tools threshold on busy application hosts or exclude the nightly deploy window. Investigate any host that also fired the web-worker child-process card.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A burst split across two windows can fall under the threshold in both.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName matches regex @"(?i)^(apache2|httpd|nginx|php-fpm[0-9.]*|php-cgi|lsphp[0-9]*|w3wp)(\.exe)?$"
| where FileName matches regex @"(?i)^(sh|bash|dash|zsh|cmd|powershell|pwsh|whoami|id|uname|hostname|curl|wget|nc|ncat|certutil|net|net1|nltest|ls|cat|find|ps|ifconfig|ip)(\.exe)?$"
| summarize distinct_tools = dcount(FileName), children = count() by DeviceId, DeviceName, Window = bin(Timestamp, 2m)
| where distinct_tools >= 4
| sort by distinct_tools desc
| take 200

// HUNT: CyberXero artifact names in a command line (CyberXero)
// MITRE: T1505.003, T1136.001
// CONF: high  FP: low  COST: low
// REQUIRES: Process creation with command line (ProcessRollup2)
// FALSE POSITIVES: Responder cleanup commands.
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(wp2shell_[0-9a-f]{8}|WSO-Shell\.php|\bwp2_[0-9a-f]{8}\b)/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.type, tgt.process.cmdline

// HUNT: CyberXero artifact names in a command line (CyberXero)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1505.003, T1136.001
// CONF: high | FP: low
// FALSE POSITIVES: Responder cleanup commands.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a command line naming one of the three artifact patterns, wp2shell_ plus eight hex digits, WSO-Shell.php, or wp2_ plus eight hex digits on word boundaries. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation telemetry with the command line
// TUNING: Responder cleanup commands that name the artifacts are the known false positive: confirm the account and the ticket before closing.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An artifact touched without appearing on any command line, for example by a web shell request, is not seen.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.cmdline matches '(wp2shell_[0-9a-f]{8}|WSO-Shell\\.php|\\bwp2_[0-9a-f]{8}\\b)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: CyberXero artifact names in a command line (CyberXero)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1505.003, T1136.001
// CONF: high | FP: low
// FALSE POSITIVES: Responder cleanup commands.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a command line naming one of the three artifact patterns. The (?i) prefix reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Responder cleanup commands that name the artifacts are the known false positive: confirm the account and the ticket before closing.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An artifact touched without appearing on any command line, for example by a web shell request, is not seen.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine matches regex @"(?i)(wp2shell_[0-9a-f]{8}|WSO-Shell\.php|\bwp2_[0-9a-f]{8}\b)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Hash sweep of the four published CyberXero files (CyberXero)
// MITRE: T1105, T1505.003, T1027
// CONF: medium  FP: low  COST: low
// REQUIRES: Process, PE and ELF file telemetry with SHA-256
// FALSE POSITIVES: None expected: published attacker file hashes.
// LOOKBACK: 90d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten|ELFFileWritten)$/
| in(field=SHA256HashData, values=["92a789444708fa1cb4cc5a89e0aa6cc7a279b62a7b8a4d2857255a18197d0090","a5ae0aab352871bc0b038b3aa43b03eb223425628c884af7b9fc592cd34eb86c","71e21094c1ac1cf0275c91ed377965e248bca1c12711f6dd20e2682681fc1192","59c535f47ab4d35f6d9fc8b8aec4a72438ea0b89e5a4dcea74b05d2d32cfa483"])
| table([@timestamp, aid, ComputerName, event_platform, FileName, SHA256HashData])

event.type = 'File Creation' tgt.file.sha256 = *
| limit 5
| columns event.type, tgt.process.image.sha256, tgt.file.sha256

// HUNT: Hash sweep of the four published CyberXero files (CyberXero)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1105, T1505.003, T1027
// CONF: medium | FP: low
// FALSE POSITIVES: None expected: published attacker file hashes.
// EQUIVALENCE: approximate-analytic - The CQL sweeps SHA-256 across process starts and PE, native executable and ELF file writes. SentinelOne has no per-format write events, so the hunt reads the hash of a started process and the hash of a created or modified file. Hash population on file events is tenant-dependent.
// REQUIRES: SentinelOne process-creation and file telemetry with SHA-256 populated
// TUNING: None expected: the hashes are published attacker file hashes. Review any hit before closing it.
// LOOKBACK: 90d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A file that the agent hashes with SHA-1 only, or does not hash at all, is not matched. There is no per-format write event, so a native executable written without a create or modify event is not seen.
// VALIDATION LEVEL: static-reviewed
(event.type = 'Process Creation' tgt.process.image.sha256 in:anycase ('92a789444708fa1cb4cc5a89e0aa6cc7a279b62a7b8a4d2857255a18197d0090', 'a5ae0aab352871bc0b038b3aa43b03eb223425628c884af7b9fc592cd34eb86c', '71e21094c1ac1cf0275c91ed377965e248bca1c12711f6dd20e2682681fc1192', '59c535f47ab4d35f6d9fc8b8aec4a72438ea0b89e5a4dcea74b05d2d32cfa483')) or (event.type in ('File Creation', 'File Modification') tgt.file.sha256 in:anycase ('92a789444708fa1cb4cc5a89e0aa6cc7a279b62a7b8a4d2857255a18197d0090', 'a5ae0aab352871bc0b038b3aa43b03eb223425628c884af7b9fc592cd34eb86c', '71e21094c1ac1cf0275c91ed377965e248bca1c12711f6dd20e2682681fc1192', '59c535f47ab4d35f6d9fc8b8aec4a72438ea0b89e5a4dcea74b05d2d32cfa483'))
| columns event.time, endpoint.name, event.type, src.process.name, tgt.process.name, tgt.process.image.sha256, tgt.file.path, tgt.file.sha256
| sort -event.time
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, SHA256
| take 5

// HUNT: Hash sweep of the four published CyberXero files (CyberXero)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1105, T1505.003, T1027
// CONF: medium | FP: low
// FALSE POSITIVES: None expected: published attacker file hashes.
// EQUIVALENCE: approximate-analytic - The CQL sweeps SHA-256 across process starts and PE, native executable and ELF file writes. Defender keeps SHA256 reliably populated on file events but not on DeviceProcessEvents, so the hunt reads file events only.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: None expected: the hashes are published attacker file hashes. Review any hit before closing it.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The process-start half of the CQL is not covered: SHA256 is often unpopulated on DeviceProcessEvents, so a file that was already on disk and then ran is missed. Advanced Hunting keeps 30 days; the CQL tab covers 90 days.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where SHA256 in~ ("92a789444708fa1cb4cc5a89e0aa6cc7a279b62a7b8a4d2857255a18197d0090", "a5ae0aab352871bc0b038b3aa43b03eb223425628c884af7b9fc592cd34eb86c", "71e21094c1ac1cf0275c91ed377965e248bca1c12711f6dd20e2682681fc1192", "59c535f47ab4d35f6d9fc8b8aec4a72438ea0b89e5a4dcea74b05d2d32cfa483")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, ActionType, FileName, FolderPath, SHA256
| sort by Timestamp desc
| take 200