Flax Typhoon / Integrity Technology Group: Microscan and FishHub Seizure Hunt

// HUNT: Retrospective DNS lookups of the seized Integrity Tech domains
// MITRE: T1566.002 | T1568 | T1071.004
// CONF: high  FP: low  COST: low | REQUIRES: DNS request telemetry with the requesting process (Falcon: DnsRequest)
// LOOKBACK: 90d or longer, set in the Falcon time picker. Seized 2026-10-08, so hits are HISTORICAL.
// FALSE POSITIVES: researchers, sandboxes or threat-intel feeds resolving the seized names
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(c0cc\.cc|98aicai\.com|98aicode\.com|98aiblog\.com|outlook3650\.com|youtubecard\.com|linkedinns\.net)$/i
| groupBy([aid, ComputerName, DomainName, ContextBaseFileName], function=[count(as=lookups), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)], limit=max)
| sort(firstSeen, order=asc)

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, endpoint.name, event.type, event.dns.request, src.process.name

// HUNT: Retrospective DNS lookups of the seized Integrity Tech domains
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1566.002, T1568, T1071.004
// CONF: high | FP: low
// FALSE POSITIVES: researchers, sandboxes or threat-intel feeds resolving the seized names
// EQUIVALENCE: equivalent-with-schema-assumptions - Same anchored domain-suffix match on process-attributed DNS lookups, aggregated per host, domain and process.
// REQUIRES: SentinelOne EDR DNS Resolved telemetry with the requesting process
// TUNING: Review each hit by firstSeen. The names were seized on 2026-10-08, so a hit is historical; researchers, sandboxes and threat-intel feeds also resolve them.
// LOOKBACK: 90d or longer; set with the console time picker or the query window
// CONFIGURATION: No custom detection rule or lookup table is required to run the hunt.
// KNOWN GAPS: If the tenant populates dns.request instead of event.dns.request, this hunt returns nothing until the field name is swapped.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' event.dns.request matches '(^|[.])(c0cc[.]cc|98aicai[.]com|98aicode[.]com|98aiblog[.]com|outlook3650[.]com|youtubecard[.]com|linkedinns[.]net)$'
| group lookups = count(), first_seen = min(event.time), last_seen = max(event.time) by endpoint.name, event.dns.request, src.process.name
| sort +first_seen
| limit 200

// HUNT: Retrospective DNS lookups of AA26-281A C2 and SoftEther host domains
// MITRE: T1071.001 | T1133 | T1568
// CONF: medium  FP: medium  COST: low | REQUIRES: DNS request telemetry with the requesting process (Falcon: DnsRequest)
// LOOKBACK: 180d or longer, set in the Falcon time picker. Treat hits as HISTORICAL leads.
// FALSE POSITIVES: re-registered or reused domains; AA26-281A says some indicators date to 2016
// TUNING: review each hit by firstSeen and ContextBaseFileName; a browser lookup of a lapsed domain is weaker than conhost.exe, dllhost.exe or a scripting host resolving it
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(natcloudservice\.com|studiocloud\.xyz|96cee\.com|hmbcloud\.(com|net)|hmbiplc-01\.com|javacheck\.ooguy\.com|javaupdate\.giize\.com|sexytube0\.com|twimg\.co\.uk)$/i
| groupBy([aid, ComputerName, DomainName, ContextBaseFileName], function=[count(as=lookups), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)], limit=max)
| sort(firstSeen, order=asc)

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, endpoint.name, event.type, event.dns.request, src.process.name

// HUNT: Retrospective DNS lookups of AA26-281A C2 and SoftEther host domains
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1133, T1568
// CONF: medium | FP: medium
// FALSE POSITIVES: re-registered or reused domains; AA26-281A says some indicators date to 2016
// EQUIVALENCE: equivalent-with-schema-assumptions - Same anchored domain-suffix match on process-attributed DNS lookups, aggregated per host, domain and process.
// REQUIRES: SentinelOne EDR DNS Resolved telemetry with the requesting process
// TUNING: Review each hit by firstSeen and requesting process. A browser lookup of a lapsed domain is weaker than conhost.exe, dllhost.exe or a scripting host resolving it. Some AA26-281A indicators date to 2016, so treat hits as historical leads.
// LOOKBACK: 180d or longer; set with the console time picker or the query window
// CONFIGURATION: No custom detection rule or lookup table is required to run the hunt.
// KNOWN GAPS: If the tenant populates dns.request instead of event.dns.request, this hunt returns nothing until the field name is swapped.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' event.dns.request matches '(^|[.])(natcloudservice[.]com|studiocloud[.]xyz|96cee[.]com|hmbcloud[.](com|net)|hmbiplc-01[.]com|javacheck[.]ooguy[.]com|javaupdate[.]giize[.]com|sexytube0[.]com|twimg[.]co[.]uk)$'
| group lookups = count(), first_seen = min(event.time), last_seen = max(event.time) by endpoint.name, event.dns.request, src.process.name
| sort +first_seen
| limit 200

// HUNT: Retrospective connections to named Integrity Tech IPv4 addresses
// MITRE: T1071.001 | T1105 | T1595.002
// CONF: medium  FP: medium  COST: low | REQUIRES: outbound IPv4 connection telemetry (Falcon: NetworkConnectIP4)
// LOOKBACK: 180d or longer, set in the Falcon time picker. Single-source addresses; treat as leads.
// FALSE POSITIVES: reassigned server addresses
// TUNING: compare firstSeen against the sourced activity windows (Curlc4 host: AA26-281A; the other two: court documents as reported on 2026-10-08) and drop hits outside them
#event_simpleName=NetworkConnectIP4
| RemoteAddressIP4=/^(149\.28\.132\.137|202\.182\.109\.151|198\.13\.53\.226)$/
| groupBy([aid, ComputerName, RemoteAddressIP4, RemotePort, ContextBaseFileName], function=[count(as=connections), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)], limit=max)
| sort(firstSeen, order=asc)

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.time, endpoint.name, event.type, dst.ip.address, dst.port.number, src.process.name

// HUNT: Retrospective connections to named Integrity Tech IPv4 addresses
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1105, T1595.002
// CONF: medium | FP: medium
// FALSE POSITIVES: reassigned server addresses
// EQUIVALENCE: equivalent-with-schema-assumptions - Same exact-address match on outbound IPv4 connections, aggregated per host, destination and process.
// REQUIRES: SentinelOne EDR IP Connect telemetry
// TUNING: Compare firstSeen against the sourced activity windows (Curlc4 host: AA26-281A; the other two: court documents as reported on 2026-10-08) and drop hits outside them. Addresses are single-source, so treat hits as leads.
// LOOKBACK: 180d or longer; set with the console time picker or the query window
// CONFIGURATION: No custom detection rule or lookup table is required to run the hunt.
// KNOWN GAPS: Connections made through a proxy show the proxy address, not the named server.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' dst.ip.address in ('149.28.132.137', '202.182.109.151', '198.13.53.226')
| group connections = count(), first_seen = min(event.time), last_seen = max(event.time) by endpoint.name, dst.ip.address, dst.port.number, src.process.name
| sort +first_seen
| limit 200

// HUNT: Exchange IIS worker process spawning shells or recon tools
// MITRE: T1505.003 | T1190 | T1059
// CONF: high  FP: medium  COST: low | REQUIRES: process creation with parent name (Falcon: ProcessRollup2, Windows sensor on the Exchange server)
// PARENT: w3wp.exe (IIS worker process hosting OWA/ECP/EWS/Autodiscover). CHILD: the tools matched below.
// FALSE POSITIVES: non-Exchange IIS apps on the same host; monitoring agents and health probes
// TUNING: scope to Exchange hosts only (add a ComputerName filter for your Exchange servers), and exclude your monitoring service with UserName!=/^svc-monitor$/i
#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^w3wp\.exe$/i
| FileName=/^(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|curl|wget|whoami|net|net1|nltest|wmic|msiexec|tasklist|ipconfig|systeminfo)\.exe$/i
| groupBy([aid, ComputerName, UserName, FileName, CommandLine], function=[count(as=hits), min(@timestamp, as=firstSeen)], limit=max)
| sort(hits, order=desc)

event.type = 'Process Creation' src.process.name = * tgt.process.name = *
| limit 5
| columns event.time, endpoint.name, event.type, src.process.name, tgt.process.name

// HUNT: Exchange IIS worker process spawning shells or recon tools
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1505.003, T1190, T1059
// CONF: high | FP: medium
// FALSE POSITIVES: non-Exchange IIS apps on the same host; monitoring agents and health probes
// EQUIVALENCE: equivalent-with-schema-assumptions - Same parent and child process-name predicate on process creation, with the created process on tgt.process.* and its creator w3wp.exe on src.process.*.
// REQUIRES: SentinelOne EDR process-creation telemetry on the Exchange server
// TUNING: Scope to Exchange hosts only by filtering endpoint.name, and exclude your monitoring service account by src.process.user after baseline review.
// LOOKBACK: 30d; set with the console time picker or the query window
// CONFIGURATION: No custom detection rule or lookup table is required to run the hunt.
// KNOWN GAPS: Non-Exchange IIS applications on the same host also match until the hunt is scoped by host.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name in:anycase ('w3wp.exe') tgt.process.name in:anycase ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe', 'rundll32.exe', 'regsvr32.exe', 'certutil.exe', 'bitsadmin.exe', 'curl.exe', 'wget.exe', 'whoami.exe', 'net.exe', 'net1.exe', 'nltest.exe', 'wmic.exe', 'msiexec.exe', 'tasklist.exe', 'ipconfig.exe', 'systeminfo.exe')
| group hits = count(), first_seen = min(event.time) by endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline
| sort -hits
| limit 200

// HUNT: Struts-hosting Java or Tomcat process spawning shells or downloaders
// MITRE: T1190 | T1059.004 | T1059.003 | T1105
// CONF: medium  FP: medium  COST: low | REQUIRES: process creation with parent name (Falcon: ProcessRollup2, Windows or Linux sensor)
// PARENT: java / javaw / tomcat (the JVM hosting the Struts app). CHILD: the tools matched below.
// FALSE POSITIVES: Java apps and CI/build servers that legitimately run shell commands
// TUNING: limit to hosts that run Struts; exclude known wrapper scripts with CommandLine!=/startup\.sh|catalina\.sh/i
#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^(java|javaw|tomcat[0-9]*|tomcat[0-9]*w)(\.exe)?$/i
| FileName=/^(sh|bash|dash|cmd|powershell|pwsh|curl|wget|nc|ncat|python[0-9.]*|perl|php|whoami|id|uname|ifconfig|certutil|bitsadmin)(\.exe)?$/i
| groupBy([aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], function=[count(as=hits), min(@timestamp, as=firstSeen)], limit=max)
| sort(hits, order=desc)

event.type = 'Process Creation' src.process.name = * tgt.process.name = *
| limit 5
| columns event.time, endpoint.name, event.type, src.process.name, tgt.process.name

// HUNT: Struts-hosting Java or Tomcat process spawning shells or downloaders
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1059.004, T1059.003, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: Java apps and CI/build servers that legitimately run shell commands
// EQUIVALENCE: equivalent-with-schema-assumptions - Same JVM-parent and shell-or-downloader-child name predicate on process creation, with the child on tgt.process.* and the JVM on src.process.*.
// REQUIRES: SentinelOne EDR process-creation telemetry on Windows or Linux Struts hosts
// TUNING: Limit to hosts that run Struts, and exclude known wrapper scripts such as startup.sh and catalina.sh with a tgt.process.cmdline exclusion after baseline review.
// LOOKBACK: 30d; set with the console time picker or the query window
// CONFIGURATION: No custom detection rule or lookup table is required to run the hunt.
// KNOWN GAPS: Java applications and CI or build servers that legitimately run shell commands match until tuned.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name matches '^(java|javaw|tomcat[0-9]*|tomcat[0-9]*w)([.]exe)?$' tgt.process.name matches '^(sh|bash|dash|cmd|powershell|pwsh|curl|wget|nc|ncat|python[0-9.]*|perl|php|whoami|id|uname|ifconfig|certutil|bitsadmin)([.]exe)?$'
| group hits = count(), first_seen = min(event.time) by endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -hits
| limit 200

// HUNT: Linux web and app tier spawning shells (Apache, nginx, PHP, Node/Strapi, ONLYOFFICE)
// MITRE: T1505.003 | T1190 | T1059.004
// CONF: medium  FP: high  COST: low | REQUIRES: Linux process creation with parent name (Falcon: ProcessRollup2, Linux sensor)
// PARENT: httpd, apache2, nginx, php-fpm, php-cgi, php, node (Strapi), docservice, converter (ONLYOFFICE; validate in tenant)
// FALSE POSITIVES: npm scripts under node; PHP applications that call system utilities; deploy hooks
// TUNING: baseline for one release cycle; exclude known deploy users with UserName!=/^(deploy|ci)$/i; run on hosts that carry the exposed products only
#event_simpleName=ProcessRollup2
| event_platform=Lin
| ParentBaseFileName=/^(httpd|apache2|nginx|php-fpm[0-9.]*|php-cgi|php|node|docservice|converter)$/i
| FileName=/^(sh|bash|dash|curl|wget|nc|ncat|python[0-9.]*|perl|whoami|id|uname|crontab|base64)$/i
| groupBy([aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], function=[count(as=hits), min(@timestamp, as=firstSeen)], limit=max)
| sort(hits, order=desc)

event.type = 'Process Creation' endpoint.os = 'linux' src.process.name = * tgt.process.name = *
| limit 5
| columns event.time, endpoint.name, event.type, endpoint.os, src.process.name, tgt.process.name

// HUNT: Linux web and app tier spawning shells (Apache, nginx, PHP, Node/Strapi, ONLYOFFICE)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1505.003, T1190, T1059.004
// CONF: medium | FP: high
// FALSE POSITIVES: npm scripts under node; PHP applications that call system utilities; deploy hooks
// EQUIVALENCE: equivalent-with-schema-assumptions - Same web-tier parent and shell-or-downloader child name predicate on Linux process creation, with the child on tgt.process.* and the web process on src.process.*.
// REQUIRES: SentinelOne EDR Linux process-creation telemetry
// TUNING: Baseline for one release cycle, exclude known deploy accounts by src.process.user, and run on hosts that carry the exposed products only. The ONLYOFFICE parent names (docservice, converter) need validating in the tenant.
// LOOKBACK: 30d; set with the console time picker or the query window
// CONFIGURATION: No custom detection rule or lookup table is required to run the hunt.
// KNOWN GAPS: High false-positive risk: npm scripts under node, PHP applications that call system utilities and deploy hooks match until baselined.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os in:anycase ('linux') src.process.name matches '^(httpd|apache2|nginx|php-fpm[0-9.]*|php-cgi|php|node|docservice|converter)$' tgt.process.name matches '^(sh|bash|dash|curl|wget|nc|ncat|python[0-9.]*|perl|whoami|id|uname|crontab|base64)$'
| group hits = count(), first_seen = min(event.time) by endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -hits
| limit 200

// HUNT: ProFTPD daemon as parent of shells or downloaders
// MITRE: T1190 | T1059.004
// CONF: low  FP: low  COST: low | REQUIRES: Linux process creation with parent name (Falcon: ProcessRollup2, Linux sensor)
// PARENT: proftpd. NOTE: CVE-2015-3306 file copy happens inside the daemon and spawns no child; this is follow-on coverage only.
// FALSE POSITIVES: site-specific ProFTPD exec hooks (mod_exec) calling scripts
#event_simpleName=ProcessRollup2
| event_platform=Lin
| ParentBaseFileName=/^proftpd$/i
| FileName=/^(sh|bash|dash|curl|wget|nc|ncat|python[0-9.]*|perl|php|chmod)$/i
| groupBy([aid, ComputerName, UserName, FileName, CommandLine], function=[count(as=hits), min(@timestamp, as=firstSeen)], limit=max)
| sort(hits, order=desc)

event.type = 'Process Creation' endpoint.os = 'linux' src.process.name = * tgt.process.name = *
| limit 5
| columns event.time, endpoint.name, event.type, endpoint.os, src.process.name, tgt.process.name

// HUNT: ProFTPD daemon as parent of shells or downloaders
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1059.004
// CONF: low | FP: low
// FALSE POSITIVES: site-specific ProFTPD exec hooks (mod_exec) calling scripts
// EQUIVALENCE: equivalent-with-schema-assumptions - Same ProFTPD parent and shell-or-downloader child name predicate on Linux process creation, with the child on tgt.process.* and the daemon on src.process.*. Follow-on coverage only, as in the CQL.
// REQUIRES: SentinelOne EDR Linux process-creation telemetry
// TUNING: Exclude site-specific ProFTPD exec hooks (mod_exec) that call scripts by tgt.process.cmdline after baseline review. The CVE-2015-3306 file copy happens inside the daemon and spawns no child, so this is follow-on coverage only.
// LOOKBACK: 30d; set with the console time picker or the query window
// CONFIGURATION: No custom detection rule or lookup table is required to run the hunt.
// KNOWN GAPS: The CVE-2015-3306 copy primitive runs inside the daemon and creates no process, so it is invisible here.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os in:anycase ('linux') src.process.name in:anycase ('proftpd') tgt.process.name matches '^(sh|bash|dash|curl|wget|nc|ncat|python[0-9.]*|perl|php|chmod)$'
| group hits = count(), first_seen = min(event.time) by endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline
| sort -hits
| limit 200

// HUNT: Password spray fan-out against Exchange hosts (Windows failed logons)
// MITRE: T1110.003 | T1110.001
// CONF: medium  FP: medium  COST: medium | REQUIRES: failed logon telemetry (Falcon: UserLogonFailed2, Windows sensor on the Exchange server)
// VALIDATE IN TENANT: RemoteAddressIP4 on UserLogonFailed2
// FALSE POSITIVES: load balancers or proxies that mask the client address; scanners; misconfigured mobile clients
// TUNING: exclude your load balancer and scanner addresses with RemoteAddressIP4!=/^REPLACE_WITH_LB_IP$/; raise or lower the distinctAccounts threshold after one week of baseline
#event_simpleName=UserLogonFailed2
| LogonType=/^(3|8)$/
| UserName=*
| groupBy([RemoteAddressIP4], function=[count(as=failures), count(UserName, distinct=true, as=distinctAccounts), count(aid, distinct=true, as=targetHosts), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)], limit=max)
| test(distinctAccounts >= 10)
| sort(distinctAccounts, order=desc)

event.type = 'Login' endpoint.os = 'windows' event.login.loginIsSuccessful = false event.login.type = * event.login.userName = * src.endpoint.ip.address = *
| limit 5
| columns event.time, agent.uuid, event.type, endpoint.os, event.login.loginIsSuccessful, event.login.type, event.login.userName, src.endpoint.ip.address

// HUNT: Password spray fan-out against Exchange hosts (Windows failed logons)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1110.003, T1110.001
// CONF: medium | FP: medium
// FALSE POSITIVES: load balancers or proxies that mask the client address; scanners; misconfigured mobile clients
// EQUIVALENCE: approximate-analytic - Same fan-out analytic (one source address failing against ten or more distinct accounts) on SentinelOne Login events. Distinct counts use estimate_distinct, which is approximate, and the source address field is documented but not attested.
// REQUIRES: SentinelOne EDR Login events from the Windows Exchange servers
// TUNING: Scope to Exchange hosts by filtering endpoint.name before the group, exclude your load balancer and scanner addresses by src.endpoint.ip.address, and raise or lower the 10-account threshold after one week of baseline.
// LOOKBACK: 24h to 7d; set with the console time picker or the query window
// CONFIGURATION: No custom detection rule or lookup table is required to run the hunt.
// KNOWN GAPS: Load balancers or proxies that mask the client address collapse many clients into one source, and the agent must record failed network logons on the Exchange servers.
// VALIDATION LEVEL: static-reviewed
event.type = 'Login' endpoint.os in:anycase ('windows') event.login.loginIsSuccessful = false event.login.type in ('NETWORK', 'NETWORK_CLEAR_TEXT') event.login.userName = * src.endpoint.ip.address = *
| group failures = count(), distinct_accounts = estimate_distinct(event.login.userName), target_hosts = estimate_distinct(agent.uuid), first_seen = min(event.time), last_seen = max(event.time) by src.endpoint.ip.address
| filter distinct_accounts >= 10
| sort -distinct_accounts
| limit 200

// HUNT: Password spray fan-out against Active Directory (Falcon Identity)
// MITRE: T1110.003 | T1110.001
// CONF: medium  FP: medium  COST: medium | REQUIRES: Falcon Identity Protection (Falcon: ActiveDirectoryAuthenticationFailure)
// FALSE POSITIVES: shared NAT or VPN egress; service desk bulk resets; stale scheduled-job credentials
// TUNING: exclude known shared egress and the service desk workstation with SourceEndpointIp!=/^REPLACE_WITH_EGRESS_IP$/; baseline distinctAccounts for a week
#event_simpleName=ActiveDirectoryAuthenticationFailure
| groupBy([SourceEndpointIp], function=[count(as=failures), count(SamAccountName, distinct=true, as=distinctAccounts), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)], limit=max)
| test(distinctAccounts >= 10)
| sort(distinctAccounts, order=desc)

event.type = 'Login'
| limit 5
| columns event.type

// HUNT: Password spray fan-out against Active Directory (Falcon Identity)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1110.003, T1110.001
// CONF: medium | FP: medium
// FALSE POSITIVES: shared NAT or VPN egress; service desk bulk resets; stale scheduled-job credentials
// EQUIVALENCE: unsupported-without-redesign - The CQL reads Falcon Identity Protection domain-controller authentication failures, a Falcon-only identity sensor event. The SentinelOne endpoint schema has no attested equivalent; the Windows failed-logon fan-out on the previous card is the nearest endpoint view.
// REQUIRES: A SentinelOne identity or domain-controller authentication source with attested fields; none is documented in the endpoint field model.
// TUNING: Use the CQL tab for this card, or the failed-logon fan-out PowerQuery on Q8 run against the domain controllers.
// LOOKBACK: 7d on the CQL tab
// CONFIGURATION: Use the CQL tab for this card.
// KNOWN GAPS: SentinelOne cannot show Active Directory authentication failures as seen by an identity sensor from the endpoint schema alone.
// VALIDATION LEVEL: static-reviewed

// HUNT: FishHub payload and SoftEther masquerade, tool names running outside System32
// MITRE: T1036.003 | T1133 | T1204.002
// CONF: medium  FP: low  COST: low | REQUIRES: process creation with image path (Falcon: ProcessRollup2, Windows sensor)
// FALSE POSITIVES: servicing and side-by-side component copies; unusual but legitimate installer staging
#event_simpleName=ProcessRollup2
| event_platform=Win
| FileName=/^(live700_v1|DiagTrack|conhost|dllhost)\.exe$/i
| ImageFileName!=/\\Windows\\(System32|SysWOW64|WinSxS)\\/i
| groupBy([aid, ComputerName, UserName, FileName, ImageFileName, SHA256HashData], function=[count(as=hits), min(@timestamp, as=firstSeen)], limit=max)
| sort(firstSeen, order=asc)

event.type = 'Process Creation' endpoint.os = 'windows' tgt.process.name = * tgt.process.image.path = *
| limit 5
| columns event.time, endpoint.name, event.type, endpoint.os, tgt.process.name, tgt.process.image.path

// HUNT: FishHub payload and SoftEther masquerade, tool names running outside System32
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1036.003, T1133, T1204.002
// CONF: medium | FP: low
// FALSE POSITIVES: servicing and side-by-side component copies; unusual but legitimate installer staging
// EQUIVALENCE: equivalent-with-schema-assumptions - Same masquerade predicate: four tool names created as processes from an image path outside System32, SysWOW64 and WinSxS, aggregated with the image hash.
// REQUIRES: SentinelOne EDR Windows process-creation telemetry with the image path
// TUNING: Review servicing and side-by-side component copies and unusual installer staging before escalating; a signed Microsoft hash in an unexpected folder is weaker than an unsigned one.
// LOOKBACK: 30d; set with the console time picker or the query window
// CONFIGURATION: No custom detection rule or lookup table is required to run the hunt.
// KNOWN GAPS: A masquerading binary that lives under a path containing the System32 folder name as a subfolder of an attacker directory is excluded by the path pattern.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os in:anycase ('windows') tgt.process.name in:anycase ('live700_v1.exe', 'DiagTrack.exe', 'conhost.exe', 'dllhost.exe') tgt.process.image.path = * !(tgt.process.image.path matches '.Windows.(System32|SysWOW64|WinSxS).')
| group hits = count(), first_seen = min(event.time) by endpoint.name, src.process.user, tgt.process.name, tgt.process.image.path, tgt.process.image.sha256
| sort +first_seen
| limit 200

// HUNT: Known tool hashes from AA26-281A (process start and executable write)
// MITRE: T1105 | T1036.003 | T1003.006
// CONF: high  FP: low  COST: medium | REQUIRES: file hash on process start and executable write (Falcon: ProcessRollup2, PeFileWritten, NewExecutableWritten)
// LOOKBACK: 180d or longer, set in the Falcon time picker
// FALSE POSITIVES: fscan.exe and JuicyPotato.exe are public tools; SoftEther is legitimate VPN software. A hit on those is a lead, not a verdict.
#event_simpleName=/^(ProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| SHA256HashData=/^(c4503db6ece93eddf4511e787607cb14606a1df9f526f1e39992497119437cec|804a53be802378a8ec4c94602fd3d6584e0d472d83148e8a42c731950fec415d|add7dd142e4f7e2873bc8f7b7fb6308063608e0b49a773dea93abad4047f1489|9dc85f9569a15eaf51c7d34254767ea30dd67b2178cec4cc7125288b9544fe00|b1552703ff0035f197c22cdb3a514bb6aa45ec98de3ef5409faab0978f18c35e|8a592e22c51311d482272ec5aba0103c9cd0cfd78e5b5ba75dfa8f1c56926672|86f1cfa6a2e0a8cb6fc1fbee28472308e6467932f8658a6a4885e29ed8c34a67|7b9efc7ef8957411cdd22582ce4bfb3a5f76d9c91cdb7e36bf85c9785a2480e9|e7e727458f573dded05537baddac2867d2801db1c3c74410398d063dfd6f6575)$/i
| groupBy([aid, ComputerName, #event_simpleName, FileName, SHA256HashData], function=[count(as=hits), min(@timestamp, as=firstSeen)], limit=max)
| sort(firstSeen, order=asc)

tgt.process.image.sha256 = * OR tgt.file.sha256 = *
| limit 5
| columns event.time, endpoint.name, event.type, tgt.process.image.sha256, tgt.file.sha256

// HUNT: Known tool hashes from AA26-281A (process start and executable write)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1105, T1036.003, T1003.006
// CONF: high | FP: low
// FALSE POSITIVES: fscan.exe and JuicyPotato.exe are public tools; SoftEther is legitimate VPN software. A hit on those is a lead, not a verdict.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same nine SHA-256 values matched on the started process image and on written files. The file branch covers any file with these hashes, a superset of the CQL's executable-write events.
// REQUIRES: SentinelOne EDR process-creation and file-event telemetry with SHA-256 populated
// TUNING: fscan.exe and JuicyPotato.exe are public tools and SoftEther is legitimate VPN software, so a hit on those is a lead, not a verdict.
// LOOKBACK: 180d or longer; set with the console time picker or the query window
// CONFIGURATION: No custom detection rule or lookup table is required to run the hunt.
// KNOWN GAPS: A file written without a SHA-256 on the event is not matched, and the file branch is not limited to executables.
// VALIDATION LEVEL: static-reviewed
tgt.process.image.sha256 in:anycase ('c4503db6ece93eddf4511e787607cb14606a1df9f526f1e39992497119437cec', '804a53be802378a8ec4c94602fd3d6584e0d472d83148e8a42c731950fec415d', 'add7dd142e4f7e2873bc8f7b7fb6308063608e0b49a773dea93abad4047f1489', '9dc85f9569a15eaf51c7d34254767ea30dd67b2178cec4cc7125288b9544fe00', 'b1552703ff0035f197c22cdb3a514bb6aa45ec98de3ef5409faab0978f18c35e', '8a592e22c51311d482272ec5aba0103c9cd0cfd78e5b5ba75dfa8f1c56926672', '86f1cfa6a2e0a8cb6fc1fbee28472308e6467932f8658a6a4885e29ed8c34a67', '7b9efc7ef8957411cdd22582ce4bfb3a5f76d9c91cdb7e36bf85c9785a2480e9', 'e7e727458f573dded05537baddac2867d2801db1c3c74410398d063dfd6f6575') OR tgt.file.sha256 in:anycase ('c4503db6ece93eddf4511e787607cb14606a1df9f526f1e39992497119437cec', '804a53be802378a8ec4c94602fd3d6584e0d472d83148e8a42c731950fec415d', 'add7dd142e4f7e2873bc8f7b7fb6308063608e0b49a773dea93abad4047f1489', '9dc85f9569a15eaf51c7d34254767ea30dd67b2178cec4cc7125288b9544fe00', 'b1552703ff0035f197c22cdb3a514bb6aa45ec98de3ef5409faab0978f18c35e', '8a592e22c51311d482272ec5aba0103c9cd0cfd78e5b5ba75dfa8f1c56926672', '86f1cfa6a2e0a8cb6fc1fbee28472308e6467932f8658a6a4885e29ed8c34a67', '7b9efc7ef8957411cdd22582ce4bfb3a5f76d9c91cdb7e36bf85c9785a2480e9', 'e7e727458f573dded05537baddac2867d2801db1c3c74410398d063dfd6f6575')
| columns event.time, endpoint.name, event.type, tgt.process.name, tgt.process.image.sha256, tgt.file.path, tgt.file.sha256
| sort +event.time
| limit 200

// HUNT: conhost.exe or dllhost.exe making external network connections (SoftEther persistence)
// MITRE: T1133 | T1036.003 | T1572
// CONF: medium  FP: medium  COST: low | REQUIRES: outbound IPv4 connection telemetry (Falcon: NetworkConnectIP4, Windows sensor)
// FALSE POSITIVES: COM-based software where dllhost.exe holds an external connection
// TUNING: baseline dllhost.exe destinations for a week and exclude confirmed vendor ranges; conhost.exe should have no external destinations at all
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^(conhost|dllhost)\.exe$/i
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16"])
| groupBy([aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], function=[count(as=connections), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)], limit=max)
| sort(connections, order=desc)

event.type = 'IP Connect' src.process.name = * dst.ip.address = *
| limit 5
| columns event.time, endpoint.name, event.type, src.process.name, dst.ip.address, dst.port.number

// HUNT: conhost.exe or dllhost.exe making external network connections (SoftEther persistence)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1133, T1036.003, T1572
// CONF: medium | FP: medium
// FALSE POSITIVES: COM-based software where dllhost.exe holds an external connection
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-name and external-destination predicate on outbound connections, with private, loopback and link-local ranges excluded by subnet.
// REQUIRES: SentinelOne EDR IP Connect telemetry on Windows agents
// TUNING: Baseline dllhost.exe destinations for a week and exclude confirmed vendor ranges; conhost.exe should have no external destinations at all.
// LOOKBACK: 14d; set with the console time picker or the query window
// CONFIGURATION: No custom detection rule or lookup table is required to run the hunt.
// KNOWN GAPS: COM-based software where dllhost.exe holds an external connection matches until baselined, and the hunt does not filter by connection direction.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' src.process.name in:anycase ('conhost.exe', 'dllhost.exe') dst.ip.address = *
| filter !(net_ipsubnet(dst.ip.address, '10.0.0.0/8') OR net_ipsubnet(dst.ip.address, '172.16.0.0/12') OR net_ipsubnet(dst.ip.address, '192.168.0.0/16') OR net_ipsubnet(dst.ip.address, '127.0.0.0/8') OR net_ipsubnet(dst.ip.address, '169.254.0.0/16'))
| group connections = count(), first_seen = min(event.time), last_seen = max(event.time) by endpoint.name, src.process.name, dst.ip.address, dst.port.number
| sort -connections
| limit 200

// HUNT: Curlc4 mail-theft bot artifacts on Linux hosts
// MITRE: T1114.002 | T1074.001 | T1020
// CONF: medium  FP: low  COST: low | REQUIRES: Linux process creation with command line (Falcon: ProcessRollup2, Linux sensor)
// ARTIFACTS: curlc4 script name, /var/tmp/.sess.zip, storage/fm, child process renamed crypto under a php parent (all from AA26-281A)
// FALSE POSITIVES: an unrelated binary legitimately named crypto launched by a PHP app
#event_simpleName=ProcessRollup2
| event_platform=Lin
| (CommandLine="*curlc4*" OR CommandLine="*.sess.zip*" OR CommandLine="*storage/fm*" OR (FileName="crypto" ParentBaseFileName=/^php/i))
| groupBy([aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], function=[count(as=hits), min(@timestamp, as=firstSeen)], limit=max)
| sort(firstSeen, order=asc)

event.type = 'Process Creation' endpoint.os = 'linux' tgt.process.cmdline = * tgt.process.name = * src.process.name = *
| limit 5
| columns event.time, endpoint.name, event.type, endpoint.os, tgt.process.cmdline, tgt.process.name, src.process.name

// HUNT: Curlc4 mail-theft bot artifacts on Linux hosts
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1114.002, T1074.001, T1020
// CONF: medium | FP: low
// FALSE POSITIVES: an unrelated binary legitimately named crypto launched by a PHP app
// EQUIVALENCE: equivalent-with-schema-assumptions - Same artifact predicate on Linux process creation: three command-line substrings, or a process named crypto created by a php parent.
// REQUIRES: SentinelOne EDR Linux process-creation telemetry with the command line
// TUNING: An unrelated binary legitimately named crypto launched by a PHP application is the known benign match; confirm the hit by its command line and path.
// LOOKBACK: 30d; set with the console time picker or the query window
// CONFIGURATION: No custom detection rule or lookup table is required to run the hunt.
// KNOWN GAPS: Artifacts that never appear on a process command line, such as a file written by a process the agent did not observe, are not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os in:anycase ('linux') (tgt.process.cmdline contains ('curlc4', 'sess.zip', 'storage/fm') OR (tgt.process.name = 'crypto' src.process.name matches '^php'))
| group hits = count(), first_seen = min(event.time) by endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort +first_seen
| limit 200

// HUNT: Scanning and recon tool execution named in AA26-281A
// MITRE: T1595.002 | T1046 | T1068
// CONF: medium  FP: medium  COST: low | REQUIRES: process creation with command line (Falcon: ProcessRollup2, Windows and Linux sensors)
// FALSE POSITIVES: authorized penetration testing; vulnerability management scanners
// TUNING: exclude scanner hosts with ComputerName!=/^REPLACE_WITH_SCANNER_HOST$/i and red-team accounts with UserName!=/^REPLACE_WITH_REDTEAM_ACCOUNT$/i
#event_simpleName=ProcessRollup2
| FileName=/^(fscan|nbtscan|nbtscan_linux|ksubdomain|ksubdomain_linux|masscan|nmap|JuicyPotato|dirsearch|wpscan|sqlmap)(\.exe|\.py)?$/i OR CommandLine=/\b(dirsearch|BBScan|OneForAll|ShuiZe|PackerFuzzer|subDomainsBrute|dirmap)\.py\b/i
| groupBy([aid, ComputerName, UserName, FileName, CommandLine], function=[count(as=hits), min(@timestamp, as=firstSeen)], limit=max)
| sort(firstSeen, order=asc)

event.type = 'Process Creation' tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.time, endpoint.name, event.type, tgt.process.name, tgt.process.cmdline

// HUNT: Scanning and recon tool execution named in AA26-281A
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1595.002, T1046, T1068
// CONF: medium | FP: medium
// FALSE POSITIVES: authorized penetration testing; vulnerability management scanners
// EQUIVALENCE: equivalent-with-schema-assumptions - Same recon-tool predicate on process creation: a tool name match, or one of seven Python tool scripts on the command line.
// REQUIRES: SentinelOne EDR process-creation telemetry with the command line, on Windows and Linux agents
// TUNING: Exclude scanner hosts by endpoint.name and red-team accounts by src.process.user after confirming the authorized testing schedule.
// LOOKBACK: 30d; set with the console time picker or the query window
// CONFIGURATION: No custom detection rule or lookup table is required to run the hunt.
// KNOWN GAPS: Authorized penetration testing and vulnerability management scanners match by design.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' (tgt.process.name matches '^(fscan|nbtscan|nbtscan_linux|ksubdomain|ksubdomain_linux|masscan|nmap|JuicyPotato|dirsearch|wpscan|sqlmap)([.]exe|[.]py)?$' OR tgt.process.cmdline matches '(^|[^A-Za-z0-9_])(dirsearch|BBScan|OneForAll|ShuiZe|PackerFuzzer|subDomainsBrute|dirmap)[.]py([^A-Za-z0-9_]|$)')
| group hits = count(), first_seen = min(event.time) by endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline
| sort +first_seen
| limit 200