Gheist: Stolen-Token GitHub Actions Secret Dump

// HUNT: Gheist self-hosted job helper files and log header in command lines
// MITRE: T1552.001, T1059.004
// CONF: high  FP: low  COST: low
// REQUIRES: sensor on self-hosted runner hosts (process creation with command line)
// FALSE POSITIVES: an analyst running find or grep for these strings during triage
// LOOKBACK: 30d (set the window with the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/\.gdmp_(pat|patg|sweep)\b|gdmp-pivot/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.cmdline

// HUNT: Gheist self-hosted job helper files and log header in command lines
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1552.001, T1059.004
// CONF: high | FP: low
// FALSE POSITIVES: an analyst running find or grep for these strings during triage
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the helper file names or the pivot marker in the new process's command line. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation events with command line on self-hosted runner hosts
// TUNING: None expected; exclude the triage workstation group by endpoint.name if analysts grep for these strings.
// LOOKBACK: 30d (set the window with the SentinelOne time picker)
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: A command line the agent did not capture, or a process it did not see start, is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.cmdline matches '\\.gdmp_(pat|patg|sweep)\\b|gdmp-pivot'
| columns event.time, agent.uuid, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: Gheist self-hosted job helper files and log header in command lines
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1552.001, T1059.004
// CONF: high | FP: low
// FALSE POSITIVES: an analyst running find or grep for these strings during triage
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on the created process's command line. The (?i) prefix reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) on self-hosted runner hosts
// TUNING: None expected; exclude the triage workstation group by DeviceName if analysts grep for these strings.
// LOOKBACK: 30d (Advanced Hunting retention is 30 days)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine matches regex @"(?i)\.gdmp_(pat|patg|sweep)\b|gdmp-pivot"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: Gheist helper file written on a host
// MITRE: T1552.001
// CONF: high  FP: low  COST: low
// REQUIRES: file-write telemetry for scripts and ELF files; coverage depends on sensor file classification (validate in tenant)
// FALSE POSITIVES: none expected; the names are specific to the Wiz-reported job
// LOOKBACK: 30d (set the window with the time picker)
#event_simpleName=/^(NewScriptWritten|ElfFileWritten)$/
| FileName=/^\.gdmp_(pat|patg|sweep)$/i
| table([@timestamp, aid, ComputerName, FileName, TargetFileName, ContextBaseFileName])

event.type = 'File Creation' tgt.file.path = *
| limit 5
| columns event.time, event.type, tgt.file.path

// HUNT: Gheist helper file written on a host
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1552.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected; the names are specific to the Wiz-reported job
// EQUIVALENCE: approximate-analytic - The CQL reads script and ELF write events that depend on sensor file classification; this matches any file creation whose path ends in a helper name. It can match more file types than the CQL and does not see a write to an existing file.
// REQUIRES: SentinelOne file-creation events on candidate runner hosts
// TUNING: None expected; the helper names are specific to the reported job.
// LOOKBACK: 30d (set the window with the SentinelOne time picker)
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: A path with backslash separators (Windows) is not matched. A helper written over an existing file is a modification event and is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'File Creation' tgt.file.path matches '[/][.]gdmp_(pat|patg|sweep)$'
| columns event.time, agent.uuid, endpoint.name, src.process.name, src.process.image.path, tgt.file.path
| sort -event.time
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, FileName
| take 5

// HUNT: Gheist helper file written on a host
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1552.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected; the names are specific to the Wiz-reported job
// EQUIVALENCE: approximate-analytic - The CQL reads script and ELF write events that depend on sensor file classification; this matches any FileCreated event whose file name is a helper name, so it can match more file types than the CQL.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents) on candidate runner hosts
// TUNING: None expected; the helper names are specific to the reported job.
// LOOKBACK: 30d (Advanced Hunting retention is 30 days)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A helper written over an existing file is recorded as a modification and is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where ActionType == "FileCreated"
| where FileName matches regex @"(?i)^\.gdmp_(pat|patg|sweep)$"
| project Timestamp, ReportId, DeviceId, DeviceName, FileName, FolderPath, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: base32 with 120-column wrap spawned by a shell
// MITRE: T1027, T1552.001
// CONF: high  FP: low  COST: low
// REQUIRES: Linux or macOS sensor on self-hosted runners or developer hosts (process creation with command line)
// FALSE POSITIVES: a developer or script that happens to wrap base32 output at 120 columns
// LOOKBACK: 30d (set the window with the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^base32$/i
| CommandLine=/-w\s*120|--wrap[= ]+120/
| ParentBaseFileName=/^(bash|sh|dash)$/
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName])

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, event.type, tgt.process.name, src.process.name, tgt.process.cmdline

// HUNT: base32 with 120-column wrap spawned by a shell
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1027, T1552.001
// CONF: high | FP: low
// FALSE POSITIVES: a developer or script that happens to wrap base32 output at 120 columns
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: base32 started by bash, sh or dash with a 120-column wrap flag. The new process is tgt.process.*; its creator is src.process.*. The command-line regex is case-sensitive, as in the CQL.
// REQUIRES: SentinelOne Linux or macOS process-creation events with command line
// TUNING: Exclude developer hosts that legitimately wrap base32 output at 120 columns, by endpoint.name.
// LOOKBACK: 30d (set the window with the SentinelOne time picker)
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: A base32 run whose creator is not bash, sh or dash is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('base32') src.process.name in ('bash', 'sh', 'dash') tgt.process.cmdline matches:matchcase '-w\\s*120|--wrap[= ]+120'
| columns event.time, agent.uuid, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, InitiatingProcessFileName, ProcessCommandLine
| take 5

// HUNT: base32 with 120-column wrap spawned by a shell
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1027, T1552.001
// CONF: high | FP: low
// FALSE POSITIVES: a developer or script that happens to wrap base32 output at 120 columns
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: base32 created by bash, sh or dash with a 120-column wrap flag. The creator is InitiatingProcessFileName. The command-line regex is case-sensitive, as in the CQL.
// REQUIRES: Defender for Endpoint Linux or macOS process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude developer hosts that legitimately wrap base32 output at 120 columns, by DeviceName.
// LOOKBACK: 30d (Advanced Hunting retention is 30 days)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A base32 run whose creator is not bash, sh or dash is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName =~ "base32"
| where InitiatingProcessFileName in ("bash", "sh", "dash")
| where ProcessCommandLine matches regex @"-w\s*120|--wrap[= ]+120"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: git or gh command lines naming a ci-sync branch or the planted commit message
// MITRE: T1078.004, T1213.003
// CONF: medium  FP: medium  COST: low
// REQUIRES: process creation with command line on developer endpoints and runner hosts
// FALSE POSITIVES: incident responders fetching ci-sync branches as evidence; a team that really uses the message "ci: sync config"
// TUNING: remove the "ci: sync config" alternative if it is noisy; exclude the IR workstation group by ComputerName after the first review
// LOOKBACK: 30d (set the window with the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(git|gh)(\.exe)?$/i
| CommandLine=/\bci-sync-[0-9a-z]{6}\b|ci: sync config/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName])

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.cmdline

// HUNT: git or gh command lines naming a ci-sync branch or the planted commit message
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1078.004, T1213.003
// CONF: medium | FP: medium
// FALSE POSITIVES: incident responders fetching ci-sync branches as evidence; a team that really uses the message "ci: sync config"
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: git or gh by name, with a ci-sync branch name or the planted commit message in the command line. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation events with command line on developer endpoints and runner hosts
// TUNING: Remove the commit-message alternative if it is noisy; exclude the incident-response workstation group by endpoint.name after the first review.
// LOOKBACK: 30d (set the window with the SentinelOne time picker)
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: A git operation run through a wrapper whose image name is not git or gh is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name matches '^(git|gh)([.]exe)?$' tgt.process.cmdline matches '\\bci-sync-[0-9a-z]{6}\\b|ci: sync config'
| columns event.time, agent.uuid, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: git or gh command lines naming a ci-sync branch or the planted commit message
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1078.004, T1213.003
// CONF: medium | FP: medium
// FALSE POSITIVES: incident responders fetching ci-sync branches as evidence; a team that really uses the message "ci: sync config"
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: git or gh by name, with a ci-sync branch name or the planted commit message in the command line. The (?i) prefix reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) on developer endpoints and runner hosts
// TUNING: Remove the commit-message alternative if it is noisy; exclude the incident-response workstation group by DeviceName after the first review.
// LOOKBACK: 30d (Advanced Hunting retention is 30 days)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A git operation run through a wrapper whose image name is not git or gh is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName matches regex @"(?i)^(git|gh)(\.exe)?$"
| where ProcessCommandLine matches regex @"(?i)\bci-sync-[0-9a-z]{6}\b|ci: sync config"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: multi-class credential sweep by shell children on Linux
// MITRE: T1003.007, T1552.001, T1552.005, T1552.007
// CONF: medium  FP: medium  COST: medium
// REQUIRES: Linux sensor with process creation and command line; best on self-hosted runner hosts (see Q9)
// FALSE POSITIVES: configuration management, backup agents, cloud-init style scripts, monitoring collectors
// TUNING: restrict to runner hosts from Q9 by ComputerName; exclude known automation accounts by UserName; raise classes to 3 on noisy hosts
// LOOKBACK: 7d (set the window with the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Lin
| ParentBaseFileName=/^(bash|sh|dash)$/
| CommandLine=/proc.[^ ]*.environ|169\.254\.169\.254|metadata\.google\.internal|serviceaccount.token|docker\.sock|credentials_rsaparams|runner_credentials|\.git-credentials|terraform\.tfstate|\.bash_history|id_rsa|id_ed25519/i
| case {
    CommandLine=/environ/i | sweep_class := "proc-environ";
    CommandLine=/169\.254\.169\.254|metadata\.google\.internal/i | sweep_class := "cloud-metadata";
    CommandLine=/serviceaccount/i | sweep_class := "k8s-sa-token";
    CommandLine=/docker\.sock/i | sweep_class := "docker-socket";
    CommandLine=/credentials_rsaparams|runner_credentials/i | sweep_class := "runner-creds";
    * | sweep_class := "files-and-keys";
  }
| groupBy([aid, ComputerName], function=[count(as=cmds), count(sweep_class, distinct=true, as=classes), collect(sweep_class)], limit=1000)
| classes >= 2
| sort(classes, order=desc)

event.type = 'Process Creation' endpoint.os = 'linux'
| limit 5
| columns event.time, event.type, endpoint.os, agent.uuid, src.process.name, tgt.process.cmdline

// HUNT: multi-class credential sweep by shell children on Linux
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1003.007, T1552.001, T1552.005, T1552.007
// CONF: medium | FP: medium
// FALSE POSITIVES: configuration management, backup agents, cloud-init style scripts, monitoring collectors
// EQUIVALENCE: approximate-analytic - Same behaviour, different analytic: PowerQuery has no case expression, so each of the six sweep classes is counted per host with the CQL's first-match order kept by excluding earlier classes, and a host qualifies when any two class counts are above zero. The CQL's collected class-name list is replaced by the per-class counts.
// REQUIRES: SentinelOne Linux process-creation events with command line; best on self-hosted runner hosts (see Q9)
// TUNING: Restrict to runner hosts from Q9 by endpoint.name; exclude known automation accounts; require three classes on noisy hosts by adding class pairs to the final filter.
// LOOKBACK: 7d (set the window with the SentinelOne time picker)
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: The result lists a count per class, not the CQL's collected class names. A command line that mentions a path without any of the listed markers is not counted.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os = 'linux' src.process.name in ('bash', 'sh', 'dash') tgt.process.cmdline matches 'proc.[^ ]*.environ|169[.]254[.]169[.]254|metadata\\.google\\.internal|serviceaccount.token|docker\\.sock|credentials_rsaparams|runner_credentials|[.]git-credentials|terraform\\.tfstate|[.]bash_history|id_rsa|id_ed25519'
| group cmds=count(), n_environ=count(tgt.process.cmdline matches 'environ'), n_metadata=count(tgt.process.cmdline matches '169[.]254[.]169[.]254|metadata\\.google\\.internal' and !(tgt.process.cmdline matches 'environ')), n_sa_token=count(tgt.process.cmdline matches 'serviceaccount' and !(tgt.process.cmdline matches 'environ|169[.]254[.]169[.]254|metadata\\.google\\.internal')), n_docker_sock=count(tgt.process.cmdline matches 'docker\\.sock' and !(tgt.process.cmdline matches 'environ|169[.]254[.]169[.]254|metadata\\.google\\.internal|serviceaccount')), n_runner_creds=count(tgt.process.cmdline matches 'credentials_rsaparams|runner_credentials' and !(tgt.process.cmdline matches 'environ|169[.]254[.]169[.]254|metadata\\.google\\.internal|serviceaccount|docker\\.sock')), n_files_keys=count(!(tgt.process.cmdline matches 'environ|169[.]254[.]169[.]254|metadata\\.google\\.internal|serviceaccount|docker\\.sock|credentials_rsaparams|runner_credentials')) by agent.uuid, endpoint.name
| filter (n_environ > 0 and n_metadata > 0) or (n_environ > 0 and n_sa_token > 0) or (n_environ > 0 and n_docker_sock > 0) or (n_environ > 0 and n_runner_creds > 0) or (n_environ > 0 and n_files_keys > 0) or (n_metadata > 0 and n_sa_token > 0) or (n_metadata > 0 and n_docker_sock > 0) or (n_metadata > 0 and n_runner_creds > 0) or (n_metadata > 0 and n_files_keys > 0) or (n_sa_token > 0 and n_docker_sock > 0) or (n_sa_token > 0 and n_runner_creds > 0) or (n_sa_token > 0 and n_files_keys > 0) or (n_docker_sock > 0 and n_runner_creds > 0) or (n_docker_sock > 0 and n_files_keys > 0) or (n_runner_creds > 0 and n_files_keys > 0)
| sort -cmds
| limit 1000

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceId, InitiatingProcessFileName, ProcessCommandLine
| take 5

// HUNT: multi-class credential sweep by shell children on Linux
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1003.007, T1552.001, T1552.005, T1552.007
// CONF: medium | FP: medium
// FALSE POSITIVES: configuration management, backup agents, cloud-init style scripts, monitoring collectors
// EQUIVALENCE: approximate-analytic - Same sweep-class analytic: shell children whose command line touches two or more of six credential-source classes, classified first-match as in the CQL. DeviceProcessEvents has no operating-system column, so the Linux restriction is carried only by the Linux-specific markers and the shell-parent filter.
// REQUIRES: Defender for Endpoint Linux process-creation telemetry (DeviceProcessEvents); best on self-hosted runner hosts (see Q9)
// TUNING: Restrict to runner hosts from Q9 by DeviceName; exclude known automation accounts; raise Classes to 3 on noisy hosts.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: No operating-system filter: a Windows or macOS shell child that mentions a listed marker is counted.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName in ("bash", "sh", "dash")
| where ProcessCommandLine matches regex @"(?i)proc.[^ ]*.environ|169\.254\.169\.254|metadata\.google\.internal|serviceaccount.token|docker\.sock|credentials_rsaparams|runner_credentials|\.git-credentials|terraform\.tfstate|\.bash_history|id_rsa|id_ed25519"
| extend SweepClass = case(ProcessCommandLine contains "environ", "proc-environ", ProcessCommandLine matches regex @"(?i)169\.254\.169\.254|metadata\.google\.internal", "cloud-metadata", ProcessCommandLine contains "serviceaccount", "k8s-sa-token", ProcessCommandLine matches regex @"(?i)docker\.sock", "docker-socket", ProcessCommandLine matches regex @"(?i)credentials_rsaparams|runner_credentials", "runner-creds", "files-and-keys")
| summarize Cmds = count(), Classes = dcount(SweepClass), SweepClasses = make_set(SweepClass), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName
| where Classes >= 2
| sort by Classes desc, Cmds desc
| take 200

// HUNT: docker run with host root mounted, parent is a shell
// MITRE: T1611
// CONF: medium  FP: medium  COST: low
// REQUIRES: Linux sensor, process creation with command line
// FALSE POSITIVES: node diagnostics, backup and forensic containers started by administrators
// TUNING: exclude the administrator accounts and jump hosts that run these tools by UserName or ComputerName
// LOOKBACK: 30d (set the window with the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^docker$/i
| ParentBaseFileName=/^(bash|sh|dash)$/
| CommandLine=/\brun\b/
| CommandLine=/(-v|--volume)[ =]\/:|--mount.*(source|src)=\/(,|\s|$)/
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName])

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, event.type, tgt.process.name, src.process.name, tgt.process.cmdline

// HUNT: docker run with host root mounted, parent is a shell
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1611
// CONF: medium | FP: medium
// FALSE POSITIVES: node diagnostics, backup and forensic containers started by administrators
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: docker run started by bash, sh or dash with the host root directory mounted by a volume flag or a mount source of /. The new process is tgt.process.*; its creator is src.process.*. The flag regexes are case-sensitive, as in the CQL.
// REQUIRES: SentinelOne Linux process-creation events with command line
// TUNING: Exclude the administrator accounts and jump hosts that run these tools, by src.process.user or endpoint.name.
// LOOKBACK: 30d (set the window with the SentinelOne time picker)
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: A container started through the Docker API, a compose file or a non-shell parent is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('docker') src.process.name in ('bash', 'sh', 'dash') tgt.process.cmdline matches:matchcase '\\brun\\b' tgt.process.cmdline matches:matchcase '(-v|--volume)[ =]/:|--mount.*(source|src)=/(,|\\s|$)'
| columns event.time, agent.uuid, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, InitiatingProcessFileName, ProcessCommandLine
| take 5

// HUNT: docker run with host root mounted, parent is a shell
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1611
// CONF: medium | FP: medium
// FALSE POSITIVES: node diagnostics, backup and forensic containers started by administrators
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: docker run created by bash, sh or dash with the host root directory mounted by a volume flag or a mount source of /. The creator is InitiatingProcessFileName. The flag regexes are case-sensitive, as in the CQL.
// REQUIRES: Defender for Endpoint Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude the administrator accounts and jump hosts that run these tools, by AccountName or DeviceName.
// LOOKBACK: 30d (Advanced Hunting retention is 30 days)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A container started through the Docker API, a compose file or a non-shell parent is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName =~ "docker"
| where InitiatingProcessFileName in ("bash", "sh", "dash")
| where ProcessCommandLine matches regex @"\brun\b"
| where ProcessCommandLine matches regex @"(-v|--volume)[ =]/:|--mount.*(source|src)=/(,|\s|$)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: GitHub token store paths in command lines of non-git tools
// MITRE: T1528, T1552.001
// CONF: low  FP: medium  COST: low
// REQUIRES: process creation with command line on developer endpoints
// FALSE POSITIVES: backup agents, dotfile managers, credential helpers, migration scripts
// TUNING: extend the FileName exclusion with your approved credential helpers and editors; alert only when the parent is a script host or an unsigned binary
// LOOKBACK: 30d (set the window with the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/\.git-credentials|gh.hosts\.yml|git:https:..github\.com/i
| FileName!=/^(git|gh|git-credential[-a-z]*|git-remote-https|code|cursor|ssh|ssh-agent)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName])

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.cmdline

// HUNT: GitHub token store paths in command lines of non-git tools
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1528, T1552.001
// CONF: low | FP: medium
// FALSE POSITIVES: backup agents, dotfile managers, credential helpers, migration scripts
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a GitHub token store path in the command line of a process that is not git, gh or an approved helper. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation events with command line on developer endpoints
// TUNING: Extend the process-name exclusion with your approved credential helpers and editors; alert only when the creator is a script host or an unsigned binary.
// LOOKBACK: 30d (set the window with the SentinelOne time picker)
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: A token store read through an API call that never appears in a command line is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.cmdline matches '[.]git-credentials|gh.hosts\\.yml|git:https:..github[.]com' !(tgt.process.name matches '^(git|gh|git-credential[-a-z]*|git-remote-https|code|cursor|ssh|ssh-agent)([.]exe)?$')
| columns event.time, agent.uuid, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: GitHub token store paths in command lines of non-git tools
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1528, T1552.001
// CONF: low | FP: medium
// FALSE POSITIVES: backup agents, dotfile managers, credential helpers, migration scripts
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a GitHub token store path in the command line of a process that is not git, gh or an approved helper. The (?i) prefix reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) on developer endpoints
// TUNING: Extend the process-name exclusion with your approved credential helpers and editors; alert only when the initiating process is a script host or an unsigned binary.
// LOOKBACK: 30d (Advanced Hunting retention is 30 days)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A token store read through an API call that never appears in a command line is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine matches regex @"(?i)\.git-credentials|gh.hosts\.yml|git:https:..github\.com"
| where not (FileName matches regex @"(?i)^(git|gh|git-credential[-a-z]*|git-remote-https|code|cursor|ssh|ssh-agent)(\.exe)?$")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: GitHub token literal in a process command line (redacted)
// MITRE: T1528, T1552.001
// CONF: medium  FP: low  COST: low
// REQUIRES: process creation with command line
// FALSE POSITIVES: placeholder strings in documentation commands that match the format; test fixtures
// LOOKBACK: 30d (set the window with the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/\bgh[pousr]_[A-Za-z0-9]{36}\b|github_pat_[A-Za-z0-9_]{22,}/
| replace("(gh[pousr]_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{22,})", with="[REDACTED_GITHUB_TOKEN]", field=CommandLine, as=cmd_redacted)
| table([@timestamp, aid, ComputerName, UserName, FileName, cmd_redacted, ParentBaseFileName])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.name

// HUNT: GitHub token literal in a process command line (redacted)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1528, T1552.001
// CONF: medium | FP: low
// FALSE POSITIVES: placeholder strings in documentation commands that match the format; test fixtures
// EQUIVALENCE: approximate-analytic - Same token-format predicate on the new process's command line. The CQL projects a redacted copy of the command line; PowerQuery has no offline-checked redaction here, so the command line is not projected at all and the token is never displayed in the result.
// REQUIRES: SentinelOne process-creation events with command line
// TUNING: Exclude documented placeholder strings and test fixtures by endpoint.name after review.
// LOOKBACK: 30d (set the window with the SentinelOne time picker)
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: The command line is not shown, so the triager must open the event to see the surrounding arguments; the raw event in the console still holds the token and needs the same handling as any exposed credential.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.cmdline matches:matchcase '\\bgh[pousr]_[A-Za-z0-9]{36}\\b|github_pat_[A-Za-z0-9_]{22,}'
| columns event.time, agent.uuid, endpoint.name, src.process.user, src.process.name, tgt.process.name
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: GitHub token literal in a process command line (redacted)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1528, T1552.001
// CONF: medium | FP: low
// FALSE POSITIVES: placeholder strings in documentation commands that match the format; test fixtures
// EQUIVALENCE: equivalent-with-schema-assumptions - Same token-format predicate on the created process's command line, with the token replaced by a marker in the projected copy as in the CQL. The regex is case-sensitive, as in the CQL.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude documented placeholder strings and test fixtures by DeviceName after review.
// LOOKBACK: 30d (Advanced Hunting retention is 30 days)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The raw command line, with the token, remains in the underlying event and in any query that projects ProcessCommandLine.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine matches regex @"\bgh[pousr]_[A-Za-z0-9]{36}\b|github_pat_[A-Za-z0-9_]{22,}"
| extend CmdRedacted = replace_regex(ProcessCommandLine, @"(gh[pousr]_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{22,})", "[REDACTED_GITHUB_TOKEN]")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, CmdRedacted, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: inventory of hosts running the Actions runner listener or worker
// MITRE: T1059.004
// CONF: high  FP: low  COST: low
// REQUIRES: process creation telemetry on candidate runner hosts
// FALSE POSITIVES: not a detection; every hit is an expected runner host
// LOOKBACK: 30d (set the window with the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^Runner\.(Listener|Worker)(\.exe)?$/i
| groupBy([aid, ComputerName], function=[count(as=starts), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)], limit=1000)
| sort(last_seen, order=desc)

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, event.type, agent.uuid, tgt.process.name

// HUNT: inventory of hosts running the Actions runner listener or worker
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.004
// CONF: high | FP: low
// FALSE POSITIVES: not a detection; every hit is an expected runner host
// EQUIVALENCE: equivalent-with-schema-assumptions - Same inventory: hosts that started the Actions runner listener or worker, with a start count and first and last seen. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation events on candidate runner hosts
// TUNING: Not a detection: every row is an expected runner host. Compare the list with the approved runner inventory.
// LOOKBACK: 30d (set the window with the SentinelOne time picker)
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: A runner started before the lookback window and never restarted is not listed.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name matches '^Runner[.](Listener|Worker)([.]exe)?$'
| group starts=count(), first_seen=min(event.time), last_seen=max(event.time) by agent.uuid, endpoint.name
| sort -last_seen
| limit 1000

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, DeviceId
| take 5

// HUNT: inventory of hosts running the Actions runner listener or worker
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.004
// CONF: high | FP: low
// FALSE POSITIVES: not a detection; every hit is an expected runner host
// EQUIVALENCE: equivalent-with-schema-assumptions - Same inventory: devices that started the Actions runner listener or worker, with a start count and first and last seen. The (?i) prefix reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) on candidate runner hosts
// TUNING: Not a detection: every row is an expected runner host. Compare the list with the approved runner inventory.
// LOOKBACK: 30d (Advanced Hunting retention is 30 days)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A runner started before the lookback window and never restarted is not listed.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName matches regex @"(?i)^Runner\.(Listener|Worker)(\.exe)?$"
| summarize Starts = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName
| sort by LastSeen desc
| take 1000