Doina Loader via Amazon-Themed ClickFix (finger.exe .plan)

// HUNT: finger.exe process execution
// MITRE: T1218, T1059.003
// CONF: high | FP: low | COST: low | REQUIRES: process creation with command line (ProcessRollup2)
// FALSE POSITIVES: a legacy admin or lab user running finger against an internal Unix host; very rare on modern Windows
// TUNING: exclude a named jump-host asset group if finger is still used there; otherwise treat every hit as suspect
#event_simpleName=ProcessRollup2
| FileName=/^finger\.exe$/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, aid], limit=200)

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.type, tgt.process.name

// HUNT: finger.exe process execution
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1218, T1059.003
// CONF: high | FP: low
// FALSE POSITIVES: a legacy admin or lab user running finger against an internal Unix host; very rare on modern Windows
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the created process is finger.exe. in:anycase reproduces the CQL case-insensitive match. The user shown is the creating process's user.
// REQUIRES: SentinelOne process-creation telemetry (Process Creation events)
// TUNING: Exclude a named jump-host asset group if finger is still used there; otherwise treat every hit as suspect.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('finger.exe')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName
| take 5

// HUNT: finger.exe process execution
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1218, T1059.003
// CONF: high | FP: low
// FALSE POSITIVES: a legacy admin or lab user running finger against an internal Unix host; very rare on modern Windows
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the created process is finger.exe, matched case-insensitively with =~. The creator is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude a named jump-host asset group if finger is still used there; otherwise treat every hit as suspect.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName =~ "finger.exe"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: Obfuscated finger command line inside cmd.exe (comma, caret, hyphen, underscore padding)
// MITRE: T1204.004, T1027, T1059.003
// CONF: high | FP: low | COST: low | REQUIRES: process creation with command line (ProcessRollup2)
// FALSE POSITIVES: none expected; the pattern needs finger-shaped letters plus a user@host argument
// TUNING: none expected; if a legitimate script matches, anchor the regex to the parent process instead
#event_simpleName=ProcessRollup2
| FileName=/^cmd\.exe$/i
| CommandLine=/f[,^_-]*i[,^_-]*n[,^_-]*g[,^_-]*e[,^_-]*r[,^_-]*\s*\S+@[a-z0-9.-]+\.[a-z]{2,}/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, aid], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.type, tgt.process.name, tgt.process.cmdline

// HUNT: Obfuscated finger command line inside cmd.exe (comma, caret, hyphen, underscore padding)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.004, T1027, T1059.003
// CONF: high | FP: low
// FALSE POSITIVES: none expected; the pattern needs finger-shaped letters plus a user@host argument
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: cmd.exe whose command line holds finger-shaped letters padded with comma, caret, hyphen or underscore, followed by a user@host argument. matches is case-insensitive by default, which reproduces the CQL i flag.
// REQUIRES: SentinelOne process-creation telemetry with command lines
// TUNING: None expected; if a legitimate script matches, anchor the regex to the creating process instead.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A command line passed through an environment variable and expanded after launch is not visible.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('cmd.exe') tgt.process.cmdline matches 'f[,^_-]*i[,^_-]*n[,^_-]*g[,^_-]*e[,^_-]*r[,^_-]*\\s*\\S+@[a-z0-9.-]+\\.[a-z]{2,}'
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: Obfuscated finger command line inside cmd.exe (comma, caret, hyphen, underscore padding)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.004, T1027, T1059.003
// CONF: high | FP: low
// FALSE POSITIVES: none expected; the pattern needs finger-shaped letters plus a user@host argument
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: cmd.exe whose command line holds finger-shaped letters padded with comma, caret, hyphen or underscore, followed by a user@host argument. The (?i) prefix reproduces the CQL i flag.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected; if a legitimate script matches, anchor the regex to the initiating process instead.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A command line passed through an environment variable and expanded after launch is not visible.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName =~ "cmd.exe"
| where ProcessCommandLine matches regex @"(?i)f[,^_-]*i[,^_-]*n[,^_-]*g[,^_-]*e[,^_-]*r[,^_-]*\s*\S+@[a-z0-9.-]+\.[a-z]{2,}"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: Outbound TCP/79 (finger protocol) from any process
// MITRE: T1105, T1071
// CONF: high | FP: low | COST: low | REQUIRES: network connections with remote port (NetworkConnectIP4)
// FALSE POSITIVES: legacy finger usage against internal Unix hosts; vulnerability scanners on a scanner host
// TUNING: exclude internal RFC1918 destinations and your scanner asset group
#event_simpleName=NetworkConnectIP4
| RemotePort=79
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort, aid], limit=200)

event.type = 'IP Connect' dst.port.number = *
| limit 5
| columns event.type, dst.port.number, dst.ip.address

// HUNT: Outbound TCP/79 (finger protocol) from any process
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1105, T1071
// CONF: high | FP: low
// FALSE POSITIVES: legacy finger usage against internal Unix hosts; vulnerability scanners on a scanner host
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate: a connection event whose destination port is 79. On a non-process-creation event the acting process is src.process.*.
// REQUIRES: SentinelOne network telemetry (IP Connect events)
// TUNING: Exclude internal RFC1918 destinations and your scanner asset group.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A connection the sensor did not observe is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' dst.port.number = 79
| columns event.time, endpoint.name, src.process.user, src.process.name, dst.ip.address, dst.port.number
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, RemotePort, RemoteIP
| take 5

// HUNT: Outbound TCP/79 (finger protocol) from any process
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1105, T1071
// CONF: high | FP: low
// FALSE POSITIVES: legacy finger usage against internal Unix hosts; vulnerability scanners on a scanner host
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate: a connection event whose remote port is 79. The acting process is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Exclude internal RFC1918 destinations and your scanner asset group.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A connection the sensor did not observe is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where RemotePort == 79
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteIP, RemotePort, ActionType
| sort by Timestamp desc
| take 200

// HUNT: DNS lookup initiated by finger.exe
// MITRE: T1071, T1105
// CONF: high | FP: low | COST: low | REQUIRES: DNS requests with process context (DnsRequest)
// FALSE POSITIVES: none expected on modern endpoints
// TUNING: none expected; treat every hit as an incident until proven otherwise
#event_simpleName=DnsRequest
| ContextBaseFileName=/^finger\.exe$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, DomainName, aid], limit=200)

event.type = 'DNS Resolved' src.process.name = *
| limit 5
| columns event.type, src.process.name, event.dns.request

// HUNT: DNS lookup initiated by finger.exe
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071, T1105
// CONF: high | FP: low
// FALSE POSITIVES: none expected on modern endpoints
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a DNS resolution event whose acting process is finger.exe. On a non-process-creation event the acting process is src.process.*.
// REQUIRES: SentinelOne DNS telemetry with process context (DNS Resolved events)
// TUNING: None expected; treat every hit as an incident until proven otherwise.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A lookup answered from the host cache without a DNS event is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' src.process.name in:anycase ('finger.exe')
| columns event.time, endpoint.name, src.process.user, src.process.name, event.dns.request
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, InitiatingProcessFileName, AdditionalFields
| take 5

// HUNT: DNS lookup initiated by finger.exe
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071, T1105
// CONF: high | FP: low
// FALSE POSITIVES: none expected on modern endpoints
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a DNS response event whose initiating process is finger.exe. Defender has no endpoint DNS table, so the DnsQueryResponse action on DeviceEvents is used and the name is read from AdditionalFields.
// REQUIRES: Defender for Endpoint DNS events (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: None expected; treat every hit as an incident until proven otherwise.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A lookup answered from the host cache without a DNS event is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "DnsQueryResponse"
| where InitiatingProcessFileName =~ "finger.exe"
| extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, DnsName
| sort by Timestamp desc
| take 200

// HUNT: curl downloading IronPython and tar unpacking a .pdf archive
// MITRE: T1105, T1036.008, T1218
// CONF: medium | FP: medium | COST: low | REQUIRES: process creation with command line (ProcessRollup2)
// FALSE POSITIVES: developers fetching IronPython releases; tar extracting legitimately named .pdf archives is rare
// TUNING: exclude developer asset groups for the IronPython branch; the tar-on-.pdf branch needs no exclusion
#event_simpleName=ProcessRollup2
| (FileName=/^curl\.exe$/i CommandLine=/IronPython/i) or (FileName=/^tar\.exe$/i CommandLine=/\.pdf/i)
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, aid], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.type, tgt.process.name, tgt.process.cmdline

// HUNT: curl downloading IronPython and tar unpacking a .pdf archive
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1105, T1036.008, T1218
// CONF: medium | FP: medium
// FALSE POSITIVES: developers fetching IronPython releases; tar extracting legitimately named .pdf archives is rare
// EQUIVALENCE: equivalent-with-schema-assumptions - Same two-branch predicate: curl.exe with IronPython in the command line, or tar.exe with .pdf in the command line. contains is case-insensitive, which reproduces the CQL i flag.
// REQUIRES: SentinelOne process-creation telemetry with command lines
// TUNING: Exclude developer asset groups for the IronPython branch; the tar-on-.pdf branch needs no exclusion.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A download performed by a different tool than curl.exe is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' ((tgt.process.name in:anycase ('curl.exe') and tgt.process.cmdline contains 'IronPython') or (tgt.process.name in:anycase ('tar.exe') and tgt.process.cmdline contains '.pdf'))
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: curl downloading IronPython and tar unpacking a .pdf archive
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1105, T1036.008, T1218
// CONF: medium | FP: medium
// FALSE POSITIVES: developers fetching IronPython releases; tar extracting legitimately named .pdf archives is rare
// EQUIVALENCE: equivalent-with-schema-assumptions - Same two-branch predicate: curl.exe with IronPython in the command line, or tar.exe with .pdf in the command line. contains is case-insensitive, which reproduces the CQL i flag.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude developer asset groups for the IronPython branch; the tar-on-.pdf branch needs no exclusion.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A download performed by a different tool than curl.exe is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where (FileName =~ "curl.exe" and ProcessCommandLine contains "IronPython") or (FileName =~ "tar.exe" and ProcessCommandLine contains ".pdf")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: IronPython ipyw32.exe execution (stock interpreter, behavioral detect)
// MITRE: T1059.006, T1204.004
// CONF: high | FP: medium | COST: low | REQUIRES: process creation with command line (ProcessRollup2)
// FALSE POSITIVES: developers and build agents that use IronPython; the chain runs it from a net462 folder under a user profile, which is unusual
// TUNING: exclude developer and build asset groups; keep alerting on ipyw32.exe launched from a user-writable path with a cmd.exe parent
#event_simpleName=ProcessRollup2
| FileName=/^ipyw(32)?\.exe$/i or ImageFileName=/\\IronPython[^\\]*\\.*net462\\/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, aid], limit=200)

event.type = 'Process Creation' tgt.process.image.path = *
| limit 5
| columns event.type, tgt.process.name, tgt.process.image.path

// HUNT: IronPython ipyw32.exe execution (stock interpreter, behavioral detect)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.006, T1204.004
// CONF: high | FP: medium
// FALSE POSITIVES: developers and build agents that use IronPython; the chain runs it from a net462 folder under a user profile, which is unusual
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the created process is ipyw.exe or ipyw32.exe, or its image path has an IronPython folder followed later by a net462 folder. The path regex is case-insensitive by default, which reproduces the CQL i flag.
// REQUIRES: SentinelOne process-creation telemetry with image paths and command lines
// TUNING: Exclude developer and build asset groups; keep alerting on ipyw32.exe launched from a user-writable path with a cmd.exe creator.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed interpreter outside an IronPython folder is not captured by the path branch.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' (tgt.process.name in:anycase ('ipyw.exe', 'ipyw32.exe') or tgt.process.image.path matches '\\\\IronPython[^\\\\]*\\\\.*net462\\\\')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, src.process.name
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath
| take 5

// HUNT: IronPython ipyw32.exe execution (stock interpreter, behavioral detect)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.006, T1204.004
// CONF: high | FP: medium
// FALSE POSITIVES: developers and build agents that use IronPython; the chain runs it from a net462 folder under a user profile, which is unusual
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the created process is ipyw.exe or ipyw32.exe, or its folder path has an IronPython folder followed later by a net462 folder. The (?i) prefix reproduces the CQL i flag.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude developer and build asset groups; keep alerting on ipyw32.exe launched from a user-writable path with a cmd.exe parent.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed interpreter outside an IronPython folder is not captured by the path branch.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ("ipyw.exe", "ipyw32.exe") or FolderPath matches regex @"(?i)\\\\IronPython[^\\\\]*\\\\.*net462\\\\"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: IronPython launched with an inline encoded script
// MITRE: T1059.006, T1027
// CONF: high | FP: low | COST: low | REQUIRES: process creation with command line (ProcessRollup2)
// FALSE POSITIVES: a developer passing an inline base64 or zlib snippet to IronPython; uncommon
// TUNING: none expected; review any hit manually
#event_simpleName=ProcessRollup2
| FileName=/^ipyw(32)?\.exe$/i
| CommandLine=/(base64|b64decode|zlib|decompress)/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, aid], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.type, tgt.process.name, tgt.process.cmdline

// HUNT: IronPython launched with an inline encoded script
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.006, T1027
// CONF: high | FP: low
// FALSE POSITIVES: a developer passing an inline base64 or zlib snippet to IronPython; uncommon
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the created process is ipyw.exe or ipyw32.exe and its command line carries base64, b64decode, zlib or decompress. matches is case-insensitive by default, which reproduces the CQL i flag.
// REQUIRES: SentinelOne process-creation telemetry with command lines
// TUNING: None expected; review any hit manually.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A script read from a file instead of the command line is not visible here.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('ipyw.exe', 'ipyw32.exe') tgt.process.cmdline matches '(base64|b64decode|zlib|decompress)'
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: IronPython launched with an inline encoded script
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.006, T1027
// CONF: high | FP: low
// FALSE POSITIVES: a developer passing an inline base64 or zlib snippet to IronPython; uncommon
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the created process is ipyw.exe or ipyw32.exe and its command line carries base64, b64decode, zlib or decompress. contains is case-insensitive, which reproduces the CQL i flag.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected; review any hit manually.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A script read from a file instead of the command line is not visible here.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ("ipyw.exe", "ipyw32.exe")
| where ProcessCommandLine contains "base64" or ProcessCommandLine contains "b64decode" or ProcessCommandLine contains "zlib" or ProcessCommandLine contains "decompress"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: IronPython interpreter making network connections or DNS lookups
// MITRE: T1105, T1071.001
// CONF: high | FP: low | COST: low | REQUIRES: network connections and DNS with process context (NetworkConnectIP4, DnsRequest)
// FALSE POSITIVES: IronPython scripts that call web services; rare outside developer hosts
// TUNING: exclude developer asset groups
#event_simpleName=/^(NetworkConnectIP4|DnsRequest)$/
| ContextBaseFileName=/^ipyw(32)?\.exe$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, DomainName, RemoteAddressIP4, RemotePort, aid], limit=200)

event.type in ('IP Connect', 'DNS Resolved') src.process.name = *
| limit 5
| columns event.type, src.process.name

// HUNT: IronPython interpreter making network connections or DNS lookups
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1105, T1071.001
// CONF: high | FP: low
// FALSE POSITIVES: IronPython scripts that call web services; rare outside developer hosts
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a connection or DNS event whose acting process is ipyw.exe or ipyw32.exe. On a non-process-creation event the acting process is src.process.*.
// REQUIRES: SentinelOne network and DNS telemetry with process context (IP Connect and DNS Resolved events)
// TUNING: Exclude developer asset groups.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A connection the sensor did not observe is not captured.
// VALIDATION LEVEL: static-reviewed
event.type in ('IP Connect', 'DNS Resolved') src.process.name in:anycase ('ipyw.exe', 'ipyw32.exe')
| columns event.time, endpoint.name, src.process.user, src.process.name, event.type, event.dns.request, dst.ip.address, dst.port.number
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, InitiatingProcessFileName, AdditionalFields
| take 5

// HUNT: IronPython interpreter making network connections or DNS lookups
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1105, T1071.001
// CONF: high | FP: low
// FALSE POSITIVES: IronPython scripts that call web services; rare outside developer hosts
// EQUIVALENCE: telemetry-gap - The CQL spans two event populations, connections and DNS. Defender keeps them in different tables and a query reads one table, so this partial pivot covers the DNS half through DeviceEvents DnsQueryResponse.
// REQUIRES: Defender for Endpoint DNS events (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: Exclude developer asset groups. Pair with the PowerQuery or CQL tab for the connection half.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The connection half of the CQL (outbound connections by the interpreter) is not covered; run a DeviceNetworkEvents query on InitiatingProcessFileName for ipyw.exe and ipyw32.exe separately.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "DnsQueryResponse"
| where InitiatingProcessFileName in~ ("ipyw.exe", "ipyw32.exe")
| extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, DnsName
| sort by Timestamp desc
| take 200

// HUNT: node.exe running index.js from ProgramData (NodeView package)
// MITRE: T1059.007, T1105
// CONF: high | FP: medium | COST: low | REQUIRES: process creation with command line (ProcessRollup2)
// FALSE POSITIVES: software that bundles its own Node.js runtime under ProgramData; check the folder name before dismissing
// TUNING: exclude known software that ships node.exe under ProgramData in your baseline; the NodeView folder name is the discriminator
#event_simpleName=ProcessRollup2
| FileName=/^node\.exe$/i
| ImageFileName=/\\ProgramData\\/i
| CommandLine=/index\.js/i
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, aid], limit=200)

event.type = 'Process Creation' tgt.process.image.path = *
| limit 5
| columns event.type, tgt.process.name, tgt.process.image.path, tgt.process.cmdline

// HUNT: node.exe running index.js from ProgramData (NodeView package)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.007, T1105
// CONF: high | FP: medium
// FALSE POSITIVES: software that bundles its own Node.js runtime under ProgramData; check the folder name before dismissing
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the created process is node.exe, its image path sits under a ProgramData folder, and its command line names index.js. contains is case-insensitive, which reproduces the CQL i flag.
// REQUIRES: SentinelOne process-creation telemetry with image paths and command lines
// TUNING: Exclude known software that ships node.exe under ProgramData in your baseline; the NodeView folder name is the discriminator.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A node.exe renamed to another file name is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('node.exe') tgt.process.image.path contains '\\ProgramData\\' tgt.process.cmdline contains 'index.js'
| columns event.time, endpoint.name, src.process.user, tgt.process.image.path, tgt.process.cmdline, src.process.name
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath, ProcessCommandLine
| take 5

// HUNT: node.exe running index.js from ProgramData (NodeView package)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.007, T1105
// CONF: high | FP: medium
// FALSE POSITIVES: software that bundles its own Node.js runtime under ProgramData; check the folder name before dismissing
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the created process is node.exe, its path sits under a ProgramData folder, and its command line names index.js. contains is case-insensitive, which reproduces the CQL i flag.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude known software that ships node.exe under ProgramData in your baseline; the NodeView folder name is the discriminator.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A node.exe renamed to another file name is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName =~ "node.exe"
| where FolderPath contains "\\ProgramData\\"
| where ProcessCommandLine contains "index.js"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: Client32.exe (NetSupport Client) running from ProgramData
// MITRE: T1219
// CONF: high | FP: medium | COST: low | REQUIRES: process creation with command line (ProcessRollup2)
// FALSE POSITIVES: a sanctioned NetSupport Manager deployment that installs the client under ProgramData
// TUNING: exclude hosts and paths of your approved NetSupport deployment; the Prodclear folder name was the observed rogue location
#event_simpleName=ProcessRollup2
| FileName=/^client32\.exe$/i
| ImageFileName=/\\ProgramData\\/i
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, aid], limit=200)

event.type = 'Process Creation' tgt.process.image.path = *
| limit 5
| columns event.type, tgt.process.name, tgt.process.image.path

// HUNT: Client32.exe (NetSupport Client) running from ProgramData
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1219
// CONF: high | FP: medium
// FALSE POSITIVES: a sanctioned NetSupport Manager deployment that installs the client under ProgramData
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the created process is client32.exe and its image path sits under a ProgramData folder. contains is case-insensitive, which reproduces the CQL i flag.
// REQUIRES: SentinelOne process-creation telemetry with image paths
// TUNING: Exclude hosts and paths of your approved NetSupport deployment; the Prodclear folder name was the observed rogue location.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A client renamed to another file name is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('client32.exe') tgt.process.image.path contains '\\ProgramData\\'
| columns event.time, endpoint.name, src.process.user, tgt.process.image.path, tgt.process.cmdline, src.process.name
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath
| take 5

// HUNT: Client32.exe (NetSupport Client) running from ProgramData
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1219
// CONF: high | FP: medium
// FALSE POSITIVES: a sanctioned NetSupport Manager deployment that installs the client under ProgramData
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the created process is client32.exe and its path sits under a ProgramData folder. contains is case-insensitive, which reproduces the CQL i flag.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude hosts and paths of your approved NetSupport deployment; the Prodclear folder name was the observed rogue location.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A client renamed to another file name is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName =~ "client32.exe"
| where FolderPath contains "\\ProgramData\\"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: NetSupport C2: connection to 167.148.201.106 or Client32.exe on port 725
// MITRE: T1219, T1071.001
// CONF: high | FP: low | COST: low | REQUIRES: network connections with process context (NetworkConnectIP4)
// FALSE POSITIVES: none expected for the IP; port 725 alone is not used here without the process filter
// TUNING: none expected; the IP is single-source so keep it detect and re-verify before any block
#event_simpleName=NetworkConnectIP4
| (RemoteAddressIP4="167.148.201.106") or (RemotePort=725 ContextBaseFileName=/^client32\.exe$/i)
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort, aid], limit=200)

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.type, dst.ip.address, dst.port.number, src.process.name

// HUNT: NetSupport C2: connection to 167.148.201.106 or Client32.exe on port 725
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1219, T1071.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected for the IP; port 725 alone is not used here without the process filter
// EQUIVALENCE: equivalent-with-schema-assumptions - Same two-branch predicate: a connection to 167.148.201.106, or a connection to port 725 by client32.exe. On a non-process-creation event the acting process is src.process.*.
// REQUIRES: SentinelOne network telemetry with process context (IP Connect events)
// TUNING: None expected; the IP is single-source so keep it detect and re-verify before any block.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A connection the sensor did not observe is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' (dst.ip.address = '167.148.201.106' or (dst.port.number = 725 and src.process.name in:anycase ('client32.exe')))
| columns event.time, endpoint.name, src.process.user, src.process.name, dst.ip.address, dst.port.number
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, RemoteIP, RemotePort, InitiatingProcessFileName
| take 5

// HUNT: NetSupport C2: connection to 167.148.201.106 or Client32.exe on port 725
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1219, T1071.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected for the IP; port 725 alone is not used here without the process filter
// EQUIVALENCE: equivalent-with-schema-assumptions - Same two-branch predicate: a connection to 167.148.201.106, or a connection to port 725 by client32.exe. The acting process is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: None expected; the IP is single-source so keep it detect and re-verify before any block.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A connection the sensor did not observe is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where RemoteIP == "167.148.201.106" or (RemotePort == 725 and InitiatingProcessFileName =~ "client32.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteIP, RemotePort, ActionType
| sort by Timestamp desc
| take 200

// HUNT: DNS resolution of the campaign domains (atomic IOC sweep)
// MITRE: T1071.001, T1105
// CONF: high | FP: low | COST: medium | REQUIRES: DNS requests (DnsRequest)
// FALSE POSITIVES: none expected; any hit warrants host triage
// TUNING: none expected; absence of hits is not evidence of absence because the operators rotate barbecue-themed names
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(grillrecipespro|grillmasterchef|thegrilljournal|homelygrill|perfectgrillrecipes|embersandbites|kiriosyka|liokida)\.com$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, DomainName, aid], limit=500)

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.type, event.dns.request

// HUNT: DNS resolution of the campaign domains (atomic IOC sweep)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1105
// CONF: high | FP: low
// FALSE POSITIVES: none expected; any hit warrants host triage
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a DNS resolution whose name is one of the eight campaign labels under .com, with an optional leading subdomain. matches is case-insensitive by default, which reproduces the CQL i flag.
// REQUIRES: SentinelOne DNS telemetry (DNS Resolved events)
// TUNING: None expected; absence of hits is not evidence of absence because the operators rotate barbecue-themed names.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Rotated domains outside the eight listed labels are not covered.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' event.dns.request matches '(^|\\.)(grillrecipespro|grillmasterchef|thegrilljournal|homelygrill|perfectgrillrecipes|embersandbites|kiriosyka|liokida)\\.com$'
| columns event.time, endpoint.name, src.process.user, src.process.name, event.dns.request
| limit 500

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: DNS resolution of the campaign domains (atomic IOC sweep)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1105
// CONF: high | FP: low
// FALSE POSITIVES: none expected; any hit warrants host triage
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a DNS response whose name is one of the eight campaign labels under .com, with an optional leading subdomain. Defender has no endpoint DNS table, so DeviceEvents DnsQueryResponse is used and the name is read from AdditionalFields. The (?i) prefix reproduces the CQL i flag.
// REQUIRES: Defender for Endpoint DNS events (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: None expected; absence of hits is not evidence of absence because the operators rotate barbecue-themed names.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Rotated domains outside the eight listed labels are not covered.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "DnsQueryResponse"
| extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where DnsName matches regex @"(?i)(^|\.)(grillrecipespro|grillmasterchef|thegrilljournal|homelygrill|perfectgrillrecipes|embersandbites|kiriosyka|liokida)\.com$"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, DnsName
| sort by Timestamp desc
| take 500

// HUNT: Run-dialog (RunMRU) entry shaped like the obfuscated finger command
// MITRE: T1204.004
// CONF: medium | FP: low | COST: low | REQUIRES: registry value writes (RegGenericValueUpdate); RunMRU capture depends on sensor policy, validate in tenant
// FALSE POSITIVES: none expected
// TUNING: none expected; if RunMRU writes are not captured in your tenant this returns nothing, which is a telemetry gap and not a clean result
#event_simpleName=/^(RegGenericValueUpdate|AsepValueUpdate)$/
| RegObjectName=/RunMRU/i
| RegStringValue=/f[,^_-]*i[,^_-]*n[,^_-]*g[,^_-]*e[,^_-]*r[,^_-]*\s*\S+@[a-z0-9.-]+\.[a-z]{2,}/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, aid], limit=200)

event.type = 'Registry Value Modified' registry.keyPath contains 'RunMRU'
| limit 5
| columns event.type, registry.keyPath, registry.value

// HUNT: Run-dialog (RunMRU) entry shaped like the obfuscated finger command
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.004
// CONF: medium | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a registry value write under a RunMRU key whose data holds finger-shaped letters padded with comma, caret, hyphen or underscore, followed by a user@host argument. The CQL also reads a second registry event name; Registry Value Modified is the single SentinelOne event for both.
// REQUIRES: SentinelOne registry telemetry (Registry Value Modified events); RunMRU capture depends on agent policy, so validate in tenant
// TUNING: None expected; if RunMRU writes are not captured in your tenant this returns nothing, which is a telemetry gap and not a clean result.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: If the agent policy does not capture RunMRU writes the query returns nothing, which is a telemetry gap and not a clean result.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified' registry.keyPath contains 'RunMRU' registry.value matches 'f[,^_-]*i[,^_-]*n[,^_-]*g[,^_-]*e[,^_-]*r[,^_-]*\\s*\\S+@[a-z0-9.-]+\\.[a-z]{2,}'
| columns event.time, endpoint.name, src.process.user, registry.keyPath, registry.valueName, registry.value
| limit 200

DeviceRegistryEvents
| where Timestamp > ago(1d)
| where RegistryKey contains "RunMRU"
| project Timestamp, ActionType, RegistryKey, RegistryValueData
| take 5

// HUNT: Run-dialog (RunMRU) entry shaped like the obfuscated finger command
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.004
// CONF: medium | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a registry value write under a RunMRU key whose data holds finger-shaped letters padded with comma, caret, hyphen or underscore, followed by a user@host argument. The (?i) prefix reproduces the CQL i flag.
// REQUIRES: Defender for Endpoint registry telemetry (DeviceRegistryEvents); RunMRU capture depends on sensor policy, so validate in tenant
// TUNING: None expected; if RunMRU writes are not captured in your tenant this returns nothing, which is a telemetry gap and not a clean result.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: If the sensor does not record RunMRU writes the query returns nothing, which is a telemetry gap and not a clean result.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceRegistryEvents
| where Timestamp >= ago(7d)
| where ActionType == "RegistryValueSet"
| where RegistryKey contains "RunMRU"
| where RegistryValueData matches regex @"(?i)f[,^_-]*i[,^_-]*n[,^_-]*g[,^_-]*e[,^_-]*r[,^_-]*\s*\S+@[a-z0-9.-]+\.[a-z]{2,}"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData
| sort by Timestamp desc
| take 200

// HUNT: Multi-stage correlation: two or more chain tools on one host
// MITRE: T1204.004, T1059.006, T1219
// CONF: high | FP: low | COST: medium | REQUIRES: process creation (ProcessRollup2)
// FALSE POSITIVES: a developer host that legitimately runs IronPython and a sanctioned NetSupport client
// TUNING: exclude developer and approved remote-support asset groups
#event_simpleName=ProcessRollup2
| FileName=/^(finger|ipyw32|ipyw|client32)\.exe$/i
| groupBy([aid, ComputerName], function=[count(FileName, distinct=true, as=distinct_tools), collect([FileName])])
| distinct_tools >= 2

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.type, tgt.process.name, endpoint.name

// HUNT: Multi-stage correlation: two or more chain tools on one host
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.004, T1059.006, T1219
// CONF: high | FP: low
// FALSE POSITIVES: a developer host that legitimately runs IronPython and a sanctioned NetSupport client
// EQUIVALENCE: equivalent-with-schema-assumptions - Same correlation: process creations of finger.exe, ipyw32.exe, ipyw.exe or client32.exe grouped per host, kept when two or more distinct tool names appear. estimate_distinct is an estimate, which is exact at this tiny cardinality.
// REQUIRES: SentinelOne process-creation telemetry
// TUNING: Exclude developer and approved remote-support asset groups.
// LOOKBACK: 7d; set the console time picker or LRQ window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL also lists which tools were seen; this tab returns the counts and first and last seen times only. Run the process-creation card for the tool names.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('finger.exe', 'ipyw32.exe', 'ipyw.exe', 'client32.exe')
| group distinct_tools = estimate_distinct(tgt.process.name), process_events = count(), first_seen = min(event.time), last_seen = max(event.time) by endpoint.name
| filter distinct_tools >= 2
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, DeviceId
| take 5

// HUNT: Multi-stage correlation: two or more chain tools on one host
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.004, T1059.006, T1219
// CONF: high | FP: low
// FALSE POSITIVES: a developer host that legitimately runs IronPython and a sanctioned NetSupport client
// EQUIVALENCE: equivalent-with-schema-assumptions - Same correlation: process creations of finger.exe, ipyw32.exe, ipyw.exe or client32.exe grouped per host, kept when two or more distinct tool names appear. dcount is an estimate, which is exact at this tiny cardinality.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude developer and approved remote-support asset groups.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL counts file names without lower-casing; the case-folding here can only merge, never split, hits.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ("finger.exe", "ipyw32.exe", "ipyw.exe", "client32.exe")
| summarize DistinctTools = dcount(tolower(FileName)), Tools = make_set(tolower(FileName)), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName
| where DistinctTools >= 2
| sort by LastSeen desc
| take 200