Operation FlashHole: Lazarus CrossWeb EX Abuse, TechHub and TouchShift

// HUNT: fsquirt.exe spawned by CrossWeb EX (TechHub injection host)
// MITRE: T1189, T1055, T1620
// CONF: high
// FP: low
// COST: low
// REQUIRES: Process creation with command line and parent (Falcon ProcessRollup2)
// FALSE POSITIVES: none expected: fsquirt.exe is normally started by a user or explorer.exe, not by a financial security service
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^INISAFECrossWebEX/i
| FileName=/^fsquirt\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData])

event.type = 'Process Creation' src.process.name = * tgt.process.name = *
| limit 5
| columns event.time, event.type, src.process.name, tgt.process.name

// HUNT: fsquirt.exe spawned by CrossWeb EX (TechHub injection host)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1189, T1055, T1620
// CONF: high | FP: low
// FALSE POSITIVES: none expected: fsquirt.exe is normally started by a user or explorer.exe, not by a financial security service
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a created fsquirt.exe whose creator image name starts with INISAFECrossWebEX. On a Process Creation event the creator is src.process and the created process is tgt.process. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne Process Creation events with creator and created process names
// TUNING: None needed for the published TTP; fsquirt.exe is normally started by a user or explorer.exe.
// LOOKBACK: 30d; set the time picker or query window, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A launch by a process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name matches '^INISAFECrossWebEX' tgt.process.name in:anycase ('fsquirt.exe')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha256
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName
| take 5

// HUNT: fsquirt.exe spawned by CrossWeb EX (TechHub injection host)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1189, T1055, T1620
// CONF: high | FP: low
// FALSE POSITIVES: none expected: fsquirt.exe is normally started by a user or explorer.exe, not by a financial security service
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a created fsquirt.exe whose initiating process name starts with INISAFECrossWebEX. startswith and =~ are case-insensitive, which reproduces the CQL /i intent. The parent is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None needed for the published TTP; fsquirt.exe is normally started by a user or explorer.exe.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A launch by a process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName startswith "INISAFECrossWebEX"
| where FileName =~ "fsquirt.exe"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Stack of child processes under CrossWeb EX
// MITRE: T1189, T1055
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Process creation with parent (Falcon ProcessRollup2)
// FALSE POSITIVES: vendor updater and helper processes
// TUNING: baseline for 30 days and exclude FileName values that run on more than half of CrossWeb EX hosts; keep anything running from a user-writable or System32 subfolder path
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^INISAFECrossWebEX/i
| groupBy([FileName, ImageFileName], function=[count(as=runs), count(aid, distinct=true, as=hosts)])
| sort(hosts, order=asc)
| table([FileName, ImageFileName, hosts, runs])

event.type = 'Process Creation' src.process.name = * tgt.process.name = * tgt.process.image.path = * agent.uuid = *
| limit 5
| columns event.time, event.type, src.process.name, tgt.process.name, tgt.process.image.path, agent.uuid

// HUNT: Stack of child processes under CrossWeb EX
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1189, T1055
// CONF: medium | FP: medium
// FALSE POSITIVES: vendor updater and helper processes
// EQUIVALENCE: equivalent-with-schema-assumptions - Same stack count: children of a process whose name starts with INISAFECrossWebEX, grouped by created process name and path with run and distinct-host counts, rarest hosts first. The creator is src.process on a Process Creation event.
// REQUIRES: SentinelOne Process Creation events with creator and created process names and paths
// TUNING: Baseline for 30 days and exclude created process names that run on more than half of CrossWeb EX hosts; keep anything running from a user-writable or System32 subfolder path.
// LOOKBACK: 30d; set the time picker or query window, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Distinct hosts is an estimate; a small count on a large estate can differ by one or two.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name matches '^INISAFECrossWebEX'
| group runs = count(), hosts = estimate_distinct(agent.uuid) by tgt.process.name, tgt.process.image.path
| sort +hosts
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName, FolderPath, DeviceId
| take 5

// HUNT: Stack of child processes under CrossWeb EX
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1189, T1055
// CONF: medium | FP: medium
// FALSE POSITIVES: vendor updater and helper processes
// EQUIVALENCE: equivalent-with-schema-assumptions - Same stack count: children of a process whose name starts with INISAFECrossWebEX, grouped by created process name and path with run and distinct-device counts, rarest first. dcount is an estimate.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Baseline for 30 days and exclude created process names that run on more than half of CrossWeb EX hosts; keep anything running from a user-writable or System32 subfolder path.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Distinct devices is an estimate; a small count on a large estate can differ by one or two.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName startswith "INISAFECrossWebEX"
| summarize runs = count(), hosts = dcount(DeviceId) by FileName, FolderPath
| sort by hosts asc
| take 200

// HUNT: Process image in RasConv or DrvConh, or ImeBroker -TimeBroker
// MITRE: T1543.003, T1574.002, T1036.005
// CONF: high
// FP: low
// COST: low
// REQUIRES: Process creation with image path and command line (Falcon ProcessRollup2)
// FALSE POSITIVES: none expected: RasConv and DrvConh are not standard System32 subfolders
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ImageFileName=/\\(RasConv|DrvConh)\\/i or CommandLine=/ImeBroker\.exe\W+-TimeBroker/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData])

event.type = 'Process Creation' tgt.process.image.path = * tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.image.path, tgt.process.cmdline

// HUNT: Process image in RasConv or DrvConh, or ImeBroker -TimeBroker
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1543.003, T1574.002, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected: RasConv and DrvConh are not standard System32 subfolders
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the created image path contains a RasConv or DrvConh directory, or the command line is ImeBroker.exe followed by -TimeBroker. The created process is tgt.process on a Process Creation event. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne Process Creation events with created image path and command line
// TUNING: None needed for the published TTP; RasConv and DrvConh are not standard System32 subfolders.
// LOOKBACK: 30d; set the time picker or query window, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' (tgt.process.image.path matches '\\\\(RasConv|DrvConh)\\\\' or tgt.process.cmdline matches 'ImeBroker\\.exe\\W+-TimeBroker')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha256
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FolderPath, ProcessCommandLine
| take 5

// HUNT: Process image in RasConv or DrvConh, or ImeBroker -TimeBroker
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1543.003, T1574.002, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected: RasConv and DrvConh are not standard System32 subfolders
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the created image path contains a RasConv or DrvConh directory, or the command line is ImeBroker.exe followed by -TimeBroker. contains is case-insensitive and the regex carries (?i), which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None needed for the published TTP; RasConv and DrvConh are not standard System32 subfolders.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FolderPath contains "\\RasConv\\" or FolderPath contains "\\DrvConh\\" or ProcessCommandLine matches regex @"(?i)ImeBroker\.exe\W+-TimeBroker"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Service ImagePath set to RasConv or DrvConh binary
// MITRE: T1543.003
// CONF: high
// FP: low
// COST: low
// REQUIRES: Registry autostart value updates (Falcon AsepValueUpdate); validate Services key coverage in tenant
// FALSE POSITIVES: none expected
// LOOKBACK: 30d
#event_simpleName=AsepValueUpdate
| RegObjectName=/\\Services\\/i
| RegValueName=/^ImagePath$/i
| RegStringValue=/\\(RasConv|DrvConh)\\|-TimeBroker/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, ContextBaseFileName])

event.type = 'Registry Value Modified' registry.keyPath = * registry.valueName = * registry.value = *
| limit 5
| columns event.time, event.type, registry.keyPath, registry.valueName, registry.value

// HUNT: Service ImagePath set to RasConv or DrvConh binary
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1543.003
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same registry predicate: an ImagePath value under a Services key whose data names a RasConv or DrvConh directory or carries -TimeBroker. The CQL reads autostart value updates; this reads registry value modifications, a superset that the key and value predicates narrow.
// REQUIRES: SentinelOne Registry Value Modified events with key path, value name and value data
// TUNING: None needed for the published TTP.
// LOOKBACK: 30d; set the time picker or query window, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A service created through an API that does not raise a registry value event is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified' registry.keyPath contains '\\Services\\' registry.valueName in:anycase ('ImagePath') registry.value matches '\\\\(RasConv|DrvConh)\\\\|-TimeBroker'
| columns event.time, endpoint.name, src.process.user, registry.keyPath, registry.valueName, registry.value, src.process.name
| limit 200

DeviceRegistryEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, RegistryKey, RegistryValueName, RegistryValueData
| take 5

// HUNT: Service ImagePath set to RasConv or DrvConh binary
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1543.003
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same registry predicate: an ImagePath value set under a Services key whose data names a RasConv or DrvConh directory or carries -TimeBroker. The CQL reads autostart value updates; this reads RegistryValueSet on DeviceRegistryEvents.
// REQUIRES: Defender for Endpoint registry telemetry (DeviceRegistryEvents)
// TUNING: None needed for the published TTP.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A service created through an API that does not raise a registry value event is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceRegistryEvents
| where Timestamp >= ago(30d)
| where ActionType == "RegistryValueSet"
| where RegistryKey contains "\\Services\\"
| where RegistryValueName =~ "ImagePath"
| where RegistryValueData contains "\\RasConv\\" or RegistryValueData contains "\\DrvConh\\" or RegistryValueData contains "-TimeBroker"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData
| sort by Timestamp desc
| take 200

// HUNT: mscoree.dll created outside System32, SysWOW64 and WinSxS
// MITRE: T1574.002, T1036.005
// CONF: high
// FP: low
// COST: low
// REQUIRES: Executable file writes (Falcon PeFileWritten, NewExecutableWritten)
// FALSE POSITIVES: rare .NET SDK or servicing copies
// TUNING: exclude ContextBaseFileName=TrustedInstaller.exe and your software-deployment agent; keep the ProgramData and System32 subfolder paths from Section 4
// LOOKBACK: 30d
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| TargetFileName=/\\mscoree\.dll$/i
| TargetFileName!=/\\Windows\\(System32|SysWOW64)\\mscoree\.dll$|\\Windows\\WinSxS\\/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, MD5HashData, SHA256HashData])

event.type = 'File Creation' tgt.file.path = *
| limit 5
| columns event.time, event.type, tgt.file.path

// HUNT: mscoree.dll created outside System32, SysWOW64 and WinSxS
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: rare .NET SDK or servicing copies
// EQUIVALENCE: equivalent-with-schema-assumptions - Same file predicate: a file named mscoree.dll created anywhere except directly in the Windows System32 or SysWOW64 directory or under WinSxS. The CQL reads executable file writes; this reads File Creation events, which covers a newly created DLL.
// REQUIRES: SentinelOne File Creation events with target file path
// TUNING: Exclude TrustedInstaller.exe and your software-deployment agent by src.process.name; keep the ProgramData and System32 subfolder paths from Section 4.
// LOOKBACK: 30d; set the time picker or query window, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An overwrite of an existing mscoree.dll raises File Modification and is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'File Creation' tgt.file.path contains 'mscoree.dll' tgt.file.path matches '\\\\mscoree\\.dll$' !(tgt.file.path matches '\\\\Windows\\\\(System32|SysWOW64)\\\\mscoree\\.dll$|\\\\Windows\\\\WinSxS\\\\')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.file.path, tgt.file.md5, tgt.file.sha256
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, FileName, FolderPath
| take 5

// HUNT: mscoree.dll created outside System32, SysWOW64 and WinSxS
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.002, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: rare .NET SDK or servicing copies
// EQUIVALENCE: equivalent-with-schema-assumptions - Same file predicate: a file named mscoree.dll created anywhere except directly in the Windows System32 or SysWOW64 directory or under WinSxS. The CQL reads executable file writes; this reads FileCreated on DeviceFileEvents.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: Exclude TrustedInstaller.exe and your software-deployment agent by InitiatingProcessFileName; keep the ProgramData and System32 subfolder paths from Section 4.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An overwrite of an existing mscoree.dll raises FileModified and is not captured. The MD5 column the CQL tab projects has no counterpart here; SHA1 and SHA256 are shown instead.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where ActionType == "FileCreated"
| where FileName =~ "mscoree.dll"
| where not(FolderPath matches regex @"(?i)\\Windows\\(System32|SysWOW64)\\mscoree\.dll$|\\Windows\\WinSxS\\")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FolderPath, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Operation FlashHole published MD5 hashes
// MITRE: T1574.002, T1055
// CONF: high
// FP: low
// COST: low
// REQUIRES: File write and process telemetry carrying MD5HashData (Falcon PeFileWritten, NewExecutableWritten, ProcessRollup2)
// FALSE POSITIVES: none expected for these hashes
// LOOKBACK: 30d
#event_simpleName=/^(PeFileWritten|NewExecutableWritten|ProcessRollup2|SyntheticProcessRollup2)$/
| MD5HashData=/^(ec84d6cb2ae7974767aedac246b50a3e|a28cba214058fcae2883d8cffc883abd|c105d6b16f544582772de0159f24c00a|2f8475a90a25624ed02f1d18d4e6d65d|676fabe30a28b53925fba98e34b35986|b4a7eff35f048f06fb0a2d7631f23a7d|ff07641dc56914dd90ee0bd7404d7ad7)$/i
| table([@timestamp, ComputerName, UserName, FileName, TargetFileName, ImageFileName, MD5HashData, SHA256HashData])

event.type = 'Process Creation' tgt.process.image.md5 = *
| limit 5
| columns event.time, event.type, tgt.process.image.md5, tgt.file.md5

// HUNT: Operation FlashHole published MD5 hashes
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002, T1055
// CONF: high | FP: low
// FALSE POSITIVES: none expected for these hashes
// EQUIVALENCE: equivalent-with-schema-assumptions - Same MD5 set matched against the created process image on Process Creation events and against the created file on File Creation events, the two populations the CQL reads. in:anycase reproduces the CQL /i intent.
// REQUIRES: SentinelOne Process Creation and File Creation events carrying MD5 hashes
// TUNING: None needed for a published hash set.
// LOOKBACK: 30d; set the time picker or query window, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A hash match depends on MD5 being populated; a tenant that stores only SHA1 or SHA256 sees nothing.
// VALIDATION LEVEL: static-reviewed
(event.type = 'Process Creation' tgt.process.image.md5 in:anycase ('ec84d6cb2ae7974767aedac246b50a3e', 'a28cba214058fcae2883d8cffc883abd', 'c105d6b16f544582772de0159f24c00a', '2f8475a90a25624ed02f1d18d4e6d65d', '676fabe30a28b53925fba98e34b35986', 'b4a7eff35f048f06fb0a2d7631f23a7d', 'ff07641dc56914dd90ee0bd7404d7ad7')) or (event.type = 'File Creation' tgt.file.md5 in:anycase ('ec84d6cb2ae7974767aedac246b50a3e', 'a28cba214058fcae2883d8cffc883abd', 'c105d6b16f544582772de0159f24c00a', '2f8475a90a25624ed02f1d18d4e6d65d', '676fabe30a28b53925fba98e34b35986', 'b4a7eff35f048f06fb0a2d7631f23a7d', 'ff07641dc56914dd90ee0bd7404d7ad7'))
| columns event.time, endpoint.name, src.process.user, event.type, src.process.name, tgt.process.name, tgt.process.image.path, tgt.file.path, tgt.process.image.md5, tgt.file.md5
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp
| take 5

// HUNT: Operation FlashHole published MD5 hashes
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.002, T1055
// CONF: high | FP: low
// FALSE POSITIVES: none expected for these hashes
// EQUIVALENCE: unsupported-without-redesign - The CQL matches published MD5 hashes only, and the Advanced Hunting tables declared for this pack expose SHA1 and SHA256 but no MD5 column, so no faithful Defender query exists for this card.
// REQUIRES: A published SHA1 or SHA256 for the same samples, which the source intel does not provide
// TUNING: Use the CQL or PowerQuery tab for this card, or convert the hashes to SHA1 or SHA256 from the original samples.
// LOOKBACK: 30d on the CQL tab
// CONFIGURATION: Use the CQL tab for this card.
// KNOWN GAPS: Defender cannot match the published MD5 hashes: the declared tables expose SHA1 and SHA256 only.
// VALIDATION LEVEL: static-reviewed

// HUNT: DNS lookups for published lure and C2 hosts
// MITRE: T1071.001, T1102, T1189
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: DNS lookups with requesting process (Falcon DnsRequest)
// FALSE POSITIVES: users who legitimately visit the compromised Korean sites
// TUNING: exclude ContextBaseFileName for chrome.exe, msedge.exe, firefox.exe and whale.exe only after confirming no CrossWeb EX host resolved the name; rank by distinct host count ascending
// LOOKBACK: 30d
#event_simpleName=DnsRequest
| DomainName=/^(javadevhouse\.co\.kr|pythonapischool\.com|cubedesign\.co\.kr|fp-news\.co\.kr|k-wbc\.co\.kr|rcsh\.co\.kr|(www\.)?ksog\.org)$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, DomainName])

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, event.type, event.dns.request, src.process.name

// HUNT: DNS lookups for published lure and C2 hosts
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1102, T1189
// CONF: medium | FP: medium
// FALSE POSITIVES: users who legitimately visit the compromised Korean sites
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: a lookup whose requested name equals one of the published lure or C2 hosts, with the requesting process. The name is event.dns.request and the requester is src.process on a DNS Resolved event. in:anycase reproduces the CQL /i intent.
// REQUIRES: SentinelOne DNS Resolved events with the requested name and requesting process
// TUNING: Exclude chrome.exe, msedge.exe, firefox.exe and whale.exe by src.process.name only after confirming no CrossWeb EX host resolved the name; rank by distinct host count ascending.
// LOOKBACK: 30d; set the time picker or query window, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A lookup made through a resolver the agent does not observe is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' event.dns.request in:anycase ('javadevhouse.co.kr', 'pythonapischool.com', 'cubedesign.co.kr', 'fp-news.co.kr', 'k-wbc.co.kr', 'rcsh.co.kr', 'ksog.org', 'www.ksog.org')
| columns event.time, endpoint.name, src.process.user, src.process.name, event.dns.request
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: DNS lookups for published lure and C2 hosts
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1102, T1189
// CONF: medium | FP: medium
// FALSE POSITIVES: users who legitimately visit the compromised Korean sites
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: a lookup whose name equals one of the published lure or C2 hosts, with the requesting process. Defender has no endpoint DNS table, so the name is read from AdditionalFields of DnsQueryResponse events on DeviceEvents. in~ reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint DNS telemetry (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: Exclude chrome.exe, msedge.exe, firefox.exe and whale.exe by InitiatingProcessFileName only after confirming no CrossWeb EX host resolved the name; rank by distinct device count ascending.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The DnsQueryResponse action type is attested in Microsoft hunting repositories but not catalogued on Microsoft Learn.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where DnsName in~ ("javadevhouse.co.kr", "pythonapischool.com", "cubedesign.co.kr", "fp-news.co.kr", "k-wbc.co.kr", "rcsh.co.kr", "ksog.org", "www.ksog.org")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, DnsName
| sort by Timestamp desc
| take 200

// HUNT: fsquirt.exe or ImeBroker.exe resolving GitHub hosts
// MITRE: T1102.002, T1071.001
// CONF: high
// FP: low
// COST: low
// REQUIRES: DNS lookups with requesting process (Falcon DnsRequest)
// FALSE POSITIVES: none expected
// LOOKBACK: 30d
#event_simpleName=DnsRequest
| DomainName=/^(api\.github\.com|github\.com|raw\.githubusercontent\.com)$/i
| ContextBaseFileName=/^(fsquirt|ImeBroker)\.exe$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, DomainName])

event.type = 'DNS Resolved' event.dns.request = * src.process.name = *
| limit 5
| columns event.time, event.type, event.dns.request, src.process.name

// HUNT: fsquirt.exe or ImeBroker.exe resolving GitHub hosts
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1102.002, T1071.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: fsquirt.exe or ImeBroker.exe requesting a GitHub host. The name is event.dns.request and the requester is src.process on a DNS Resolved event. in:anycase reproduces the CQL /i intent.
// REQUIRES: SentinelOne DNS Resolved events with the requested name and requesting process
// TUNING: None needed for the published TTP.
// LOOKBACK: 30d; set the time picker or query window, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A lookup made through a resolver the agent does not observe is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' event.dns.request in:anycase ('api.github.com', 'github.com', 'raw.githubusercontent.com') src.process.name in:anycase ('fsquirt.exe', 'ImeBroker.exe')
| columns event.time, endpoint.name, src.process.user, src.process.name, event.dns.request
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, InitiatingProcessFileName, AdditionalFields
| take 5

// HUNT: fsquirt.exe or ImeBroker.exe resolving GitHub hosts
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1102.002, T1071.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: fsquirt.exe or ImeBroker.exe requesting a GitHub host. Defender has no endpoint DNS table, so the name is read from AdditionalFields of DnsQueryResponse events on DeviceEvents. in~ reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint DNS telemetry (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: None needed for the published TTP.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The DnsQueryResponse action type is attested in Microsoft hunting repositories but not catalogued on Microsoft Learn.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| where InitiatingProcessFileName in~ ("fsquirt.exe", "ImeBroker.exe")
| extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where DnsName in~ ("api.github.com", "github.com", "raw.githubusercontent.com")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, DnsName
| sort by Timestamp desc
| take 200

// HUNT: Rare non-browser processes resolving api.github.com
// MITRE: T1102.002, T1071.001
// CONF: medium
// FP: high
// COST: low
// REQUIRES: DNS lookups with requesting process (Falcon DnsRequest)
// FALSE POSITIVES: git, IDEs, CI runners, package managers, collaboration apps
// TUNING: extend the excluded names with your sanctioned developer tooling, restrict to non-developer host groups, and sort by host count ascending
// LOOKBACK: 30d
#event_simpleName=DnsRequest
| DomainName=/^(api\.github\.com|raw\.githubusercontent\.com)$/i
| ContextBaseFileName!=/^(chrome|msedge|firefox|brave|whale|iexplore|git|git-remote-https|gh|code|githubdesktop|devenv|node|python|pwsh|powershell|onedrive)\.exe$/i
| groupBy([ContextBaseFileName], function=[count(as=lookups), count(aid, distinct=true, as=hosts)])
| sort(hosts, order=asc)
| table([ContextBaseFileName, hosts, lookups])

event.type = 'DNS Resolved' event.dns.request = * src.process.name = * agent.uuid = *
| limit 5
| columns event.time, event.type, event.dns.request, src.process.name, agent.uuid

// HUNT: Rare non-browser processes resolving api.github.com
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1102.002, T1071.001
// CONF: medium | FP: high
// FALSE POSITIVES: git, IDEs, CI runners, package managers, collaboration apps
// EQUIVALENCE: equivalent-with-schema-assumptions - Same stack count: lookups of api.github.com or raw.githubusercontent.com by any process outside the excluded browser and developer-tool names, grouped by requesting process with lookup and distinct-host counts, rarest hosts first. in:anycase reproduces the CQL /i intent.
// REQUIRES: SentinelOne DNS Resolved events with the requested name and requesting process
// TUNING: Extend the excluded names with your sanctioned developer tooling, restrict to non-developer host groups, and keep the sort by host count ascending.
// LOOKBACK: 30d; set the time picker or query window, the published query carries no time predicate
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Distinct hosts is an estimate; a small count on a large estate can differ by one or two.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' event.dns.request in:anycase ('api.github.com', 'raw.githubusercontent.com') src.process.name = * !(src.process.name in:anycase ('chrome.exe', 'msedge.exe', 'firefox.exe', 'brave.exe', 'whale.exe', 'iexplore.exe', 'git.exe', 'git-remote-https.exe', 'gh.exe', 'code.exe', 'githubdesktop.exe', 'devenv.exe', 'node.exe', 'python.exe', 'pwsh.exe', 'powershell.exe', 'onedrive.exe'))
| group lookups = count(), hosts = estimate_distinct(agent.uuid) by src.process.name
| sort +hosts
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, InitiatingProcessFileName, AdditionalFields, DeviceId
| take 5

// HUNT: Rare non-browser processes resolving api.github.com
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1102.002, T1071.001
// CONF: medium | FP: high
// FALSE POSITIVES: git, IDEs, CI runners, package managers, collaboration apps
// EQUIVALENCE: equivalent-with-schema-assumptions - Same stack count: lookups of api.github.com or raw.githubusercontent.com by any process outside the excluded browser and developer-tool names, grouped by requesting process with lookup and distinct-device counts, rarest first. Defender has no endpoint DNS table, so the name is read from AdditionalFields of DnsQueryResponse events on DeviceEvents.
// REQUIRES: Defender for Endpoint DNS telemetry (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: Extend the excluded names with your sanctioned developer tooling, restrict to non-developer device groups, and keep the sort by device count ascending.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The DnsQueryResponse action type is attested in Microsoft hunting repositories but not catalogued on Microsoft Learn.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "whale.exe", "iexplore.exe", "git.exe", "git-remote-https.exe", "gh.exe", "code.exe", "githubdesktop.exe", "devenv.exe", "node.exe", "python.exe", "pwsh.exe", "powershell.exe", "onedrive.exe")
| extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where DnsName in~ ("api.github.com", "raw.githubusercontent.com")
| summarize lookups = count(), hosts = dcount(DeviceId) by InitiatingProcessFileName
| sort by hosts asc
| take 200