Gorbag / BeautyStealer Hunt Pack

// HUNT: Startup LNK launching hidden PowerShell loader from ProgramData
// MITRE: T1547.001, T1059.001
// CONF: medium  FP: medium  COST: low
// REQUIRES: process creation with command line and parent (ProcessRollup2)
// FALSE POSITIVES: admin logon scripts shipped as Startup shortcuts that call PowerShell
// TUNING: exclude your sanctioned logon-script folder, e.g. add | CommandLine!=/\\ProgramData\\CorpLogon\\/i
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(powershell|pwsh)(\.exe)?$/i
| ParentBaseFileName=/^explorer(\.exe)?$/i
| CommandLine=/\\ProgramData\\/i
| CommandLine=/(-w(indowstyle)?\s+hidden|-enc|-e\s|-ep\s+bypass|-executionpolicy\s+bypass|-nop|-file)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, endpoint.name, event.type, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: Startup LNK launching hidden PowerShell loader from ProgramData
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1547.001, T1059.001
// CONF: medium | FP: medium
// FALSE POSITIVES: admin logon scripts shipped as Startup shortcuts that call PowerShell
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: PowerShell by name, created by explorer, a ProgramData path in the command line, and one of the hidden or bypass flags. On a Process Creation event the new process is tgt.process.* and its creator is src.process.*. The flag pattern uses literal spaces where the CQL used a whitespace class.
// REQUIRES: SentinelOne process-creation telemetry (event.type 'Process Creation') with command lines
// TUNING: Exclude your sanctioned logon-script folder by adding a negated contains test on tgt.process.cmdline.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Flags separated by tabs rather than spaces are not matched. The Startup shortcut file itself is not tied to the process.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('powershell.exe','powershell','pwsh.exe','pwsh') src.process.name in:anycase ('explorer.exe','explorer') tgt.process.cmdline contains '\\ProgramData\\' tgt.process.cmdline matches '(-w(indowstyle)? +hidden|-enc|-e |-ep +bypass|-executionpolicy +bypass|-nop|-file)'
| sort -event.time
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, InitiatingProcessFileName, ProcessCommandLine
| take 5

// HUNT: Startup LNK launching hidden PowerShell loader from ProgramData
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1547.001, T1059.001
// CONF: medium | FP: medium
// FALSE POSITIVES: admin logon scripts shipped as Startup shortcuts that call PowerShell
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: PowerShell by name, created by explorer, a ProgramData path in the command line, and one of the hidden or bypass flags. The creator is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude your sanctioned logon-script folder with a negated contains test on ProcessCommandLine.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The Startup shortcut file itself is not tied to the process.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ('powershell.exe', 'powershell', 'pwsh.exe', 'pwsh')
| where InitiatingProcessFileName in~ ('explorer.exe', 'explorer')
| where ProcessCommandLine contains '\\ProgramData\\'
| where ProcessCommandLine matches regex @"(?i)(-w(indowstyle)?\s+hidden|-enc|-e\s|-ep\s+bypass|-executionpolicy\s+bypass|-nop|-file)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Office app spawning script host or ProgramData executable
// MITRE: T1204.002, T1059.001, T1566.001
// CONF: high  FP: low  COST: low
// REQUIRES: process creation with command line and parent (ProcessRollup2)
// FALSE POSITIVES: rare; Office add-ins that shell out to cmd during install
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(EXCEL|WINWORD|POWERPNT)(\.EXE)?$/i
| (FileName=/^(powershell|pwsh|cmd|wscript|cscript|mshta|rundll32|regsvr32)(\.exe)?$/i or ImageFileName=/\\ProgramData\\[^\\]+\.exe$/i)
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData])

event.type = 'Process Creation' tgt.process.image.path = *
| limit 5
| columns event.time, event.type, src.process.name, tgt.process.name, tgt.process.image.path

// HUNT: Office app spawning script host or ProgramData executable
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.002, T1059.001, T1566.001
// CONF: high | FP: low
// FALSE POSITIVES: rare; Office add-ins that shell out to cmd during install
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an Office application as the creator, and either a script host or shell as the new process, or a new process whose image is an executable directly in ProgramData. On a Process Creation event the new process is tgt.process.* and the creator is src.process.*.
// REQUIRES: SentinelOne process-creation telemetry (event.type 'Process Creation') with image path and command line
// TUNING: Exclude Office add-ins that shell out during install by adding a negated test on tgt.process.cmdline.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Office applications other than Excel, Word and PowerPoint are not covered.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name in:anycase ('excel.exe','excel','winword.exe','winword','powerpnt.exe','powerpnt') (tgt.process.name in:anycase ('powershell.exe','powershell','pwsh.exe','pwsh','cmd.exe','cmd','wscript.exe','wscript','cscript.exe','cscript','mshta.exe','mshta','rundll32.exe','rundll32','regsvr32.exe','regsvr32') or tgt.process.image.path matches '\\\\ProgramData\\\\[^\\\\]+\\.exe$')
| sort -event.time
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha256
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName, FolderPath
| take 5

// HUNT: Office app spawning script host or ProgramData executable
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.002, T1059.001, T1566.001
// CONF: high | FP: low
// FALSE POSITIVES: rare; Office add-ins that shell out to cmd during install
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an Office application as the creator, and either a script host or shell as the new process, or an executable directly in ProgramData. The creator is InitiatingProcessFileName and the new process image is FolderPath.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude Office add-ins that shell out during install with a negated test on ProcessCommandLine.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName in~ ('excel.exe', 'excel', 'winword.exe', 'winword', 'powerpnt.exe', 'powerpnt')
| where FileName in~ ('powershell.exe', 'powershell', 'pwsh.exe', 'pwsh', 'cmd.exe', 'cmd', 'wscript.exe', 'wscript', 'cscript.exe', 'cscript', 'mshta.exe', 'mshta', 'rundll32.exe', 'rundll32', 'regsvr32.exe', 'regsvr32') or FolderPath matches regex @"(?i)\\ProgramData\\[^\\]+\.exe$"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, SHA1
| sort by Timestamp desc
| take 200

// HUNT: Office/PowerShell/WinRAR writing a PE directly into ProgramData
// MITRE: T1204.002, T1027.009, T1105
// CONF: medium  FP: medium  COST: low
// REQUIRES: PE and executable-written file events (PeFileWritten, NewExecutableWritten)
// FALSE POSITIVES: PowerShell-based deployment tools staging installers under ProgramData
// TUNING: exclude your deployment tool by adding | ContextBaseFileName!=/^(YourDeployAgent)(\.exe)?$/i
// LOOKBACK: 7d
#event_simpleName=/^(NewExecutableWritten|PeFileWritten)$/
| TargetFileName=/\\ProgramData\\[^\\]+\.(exe|dll)$/i
| ContextBaseFileName=/^(EXCEL|WINWORD|POWERSHELL|PWSH|WINRAR|RAR|UNRAR)(\.EXE)?$/i
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData])

event.type = 'File Creation' tgt.file.path = *
| limit 5
| columns event.time, event.type, src.process.name, tgt.file.path

// HUNT: Office/PowerShell/WinRAR writing a PE directly into ProgramData
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.002, T1027.009, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: PowerShell-based deployment tools staging installers under ProgramData
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on file creation: an executable or library written directly into ProgramData by Office, PowerShell or WinRAR. SentinelOne has no separate PE-written event, so the extension test stands in for the PE test. On non-process events the acting process is src.process.*.
// REQUIRES: SentinelOne file-creation telemetry (event.type 'File Creation')
// TUNING: Exclude your deployment tool by adding a negated in:anycase test on src.process.name.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A PE written under a non-executable extension is not matched. A file modified in place rather than created is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'File Creation' src.process.name in:anycase ('excel.exe','excel','winword.exe','winword','powershell.exe','powershell','pwsh.exe','pwsh','winrar.exe','winrar','rar.exe','rar','unrar.exe','unrar') tgt.file.path matches '\\\\ProgramData\\\\[^\\\\]+\\.(exe|dll)$'
| sort -event.time
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.file.path, tgt.file.sha256
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, InitiatingProcessFileName, FileName, FolderPath
| take 5

// HUNT: Office/PowerShell/WinRAR writing a PE directly into ProgramData
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.002, T1027.009, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: PowerShell-based deployment tools staging installers under ProgramData
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on file creation: an executable or library written directly into ProgramData by Office, PowerShell or WinRAR. The writer is InitiatingProcessFileName. The path test accepts both a folder-only and a full-path FolderPath.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: Exclude your deployment tool with a negated in~ test on InitiatingProcessFileName.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A PE written under a non-executable extension is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(7d)
| where ActionType == 'FileCreated'
| where InitiatingProcessFileName in~ ('excel.exe', 'excel', 'winword.exe', 'winword', 'powershell.exe', 'powershell', 'pwsh.exe', 'pwsh', 'winrar.exe', 'winrar', 'rar.exe', 'rar', 'unrar.exe', 'unrar')
| where FileName matches regex @"(?i)\.(exe|dll)$"
| where FolderPath matches regex @"(?i)\\ProgramData(\\[^\\]+\.(exe|dll))?$"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FolderPath, FileName, SHA1
| sort by Timestamp desc
| take 200

// HUNT: Rare executables running from the ProgramData root
// MITRE: T1204.002, T1036
// CONF: medium  FP: medium  COST: medium
// REQUIRES: process creation (ProcessRollup2)
// FALSE POSITIVES: vendor updaters and installers that unpack to the ProgramData root
// TUNING: raise the HostCount threshold, or exclude baselined names with | FileName!=/^(knownupdater)(\.exe)?$/i
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ImageFileName=/\\ProgramData\\[^\\]+\.exe$/i
| groupBy([FileName], function=[count(aid, distinct=true, as=HostCount), count(as=Runs), collect([ParentBaseFileName]), max(@timestamp, as=LastSeen)], limit=2000)
| HostCount <= 3
| sort(Runs, order=asc, limit=200)
| table([FileName, HostCount, Runs, ParentBaseFileName, LastSeen])

event.type = 'Process Creation' tgt.process.image.path = *
| limit 5
| columns event.time, event.type, agent.uuid, src.process.name, tgt.process.name, tgt.process.image.path

// HUNT: Rare executables running from the ProgramData root
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.002, T1036
// CONF: medium | FP: medium
// FALSE POSITIVES: vendor updaters and installers that unpack to the ProgramData root
// EQUIVALENCE: approximate-analytic - Same rarity analytic: executables running from the root of ProgramData, grouped by name, kept when seen on three hosts or fewer. PowerQuery has no collect, so one sample creator is shown in place of the full list.
// REQUIRES: SentinelOne process-creation telemetry (event.type 'Process Creation') with image path
// TUNING: Raise the host_count threshold, or exclude baselined names with a negated in:anycase test on tgt.process.name before the group.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The full list of creators per name is not collected; parent_sample shows one.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.image.path matches '\\\\ProgramData\\\\[^\\\\]+\\.exe$'
| group host_count = estimate_distinct(agent.uuid), runs = count(), last_seen = max(event.time), parent_sample = any(src.process.name) by tgt.process.name
| filter host_count <= 3
| sort +runs
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceId, FileName, FolderPath, InitiatingProcessFileName
| take 5

// HUNT: Rare executables running from the ProgramData root
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.002, T1036
// CONF: medium | FP: medium
// FALSE POSITIVES: vendor updaters and installers that unpack to the ProgramData root
// EQUIVALENCE: approximate-analytic - Same rarity analytic: executables running from the root of ProgramData, grouped by name, kept when seen on three devices or fewer. The creators are collected with make_set.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Raise the HostCount threshold, or exclude baselined names with a negated in~ test on FileName before the summarize.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The creator set is capped at ten names.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FolderPath matches regex @"(?i)\\ProgramData\\[^\\]+\.exe$"
| summarize HostCount = dcount(DeviceId), Runs = count(), Parents = make_set(InitiatingProcessFileName, 10), LastSeen = max(Timestamp) by FileName
| where HostCount <= 3
| sort by Runs asc
| take 200

// HUNT: WinRAR family spawning a shell or script host
// MITRE: T1203, T1059.001
// CONF: low  FP: low  COST: low
// REQUIRES: process creation with parent (ProcessRollup2)
// FALSE POSITIVES: SFX archives that run cmd as part of a legitimate install
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(WinRAR|UnRAR|Rar)(\.exe)?$/i
| FileName=/^(powershell|pwsh|cmd|wscript|cscript|mshta|rundll32|regsvr32)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' src.process.name = *
| limit 5
| columns event.time, event.type, src.process.name, tgt.process.name

// HUNT: WinRAR family spawning a shell or script host
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1203, T1059.001
// CONF: low | FP: low
// FALSE POSITIVES: SFX archives that run cmd as part of a legitimate install
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a WinRAR family process as the creator and a script host or shell as the new process. On a Process Creation event the new process is tgt.process.* and the creator is src.process.*.
// REQUIRES: SentinelOne process-creation telemetry (event.type 'Process Creation')
// TUNING: Exclude self-extracting archives that run cmd during a sanctioned install by adding a negated test on tgt.process.cmdline.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Other archivers such as 7-Zip are not covered, matching the CQL.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name in:anycase ('winrar.exe','winrar','unrar.exe','unrar','rar.exe','rar') tgt.process.name in:anycase ('powershell.exe','powershell','pwsh.exe','pwsh','cmd.exe','cmd','wscript.exe','wscript','cscript.exe','cscript','mshta.exe','mshta','rundll32.exe','rundll32','regsvr32.exe','regsvr32')
| sort -event.time
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName
| take 5

// HUNT: WinRAR family spawning a shell or script host
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1203, T1059.001
// CONF: low | FP: low
// FALSE POSITIVES: SFX archives that run cmd as part of a legitimate install
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a WinRAR family process as the creator and a script host or shell as the new process. The creator is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude self-extracting archives that run cmd during a sanctioned install with a negated test on ProcessCommandLine.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Other archivers such as 7-Zip are not covered, matching the CQL.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName in~ ('winrar.exe', 'winrar', 'unrar.exe', 'unrar', 'rar.exe', 'rar')
| where FileName in~ ('powershell.exe', 'powershell', 'pwsh.exe', 'pwsh', 'cmd.exe', 'cmd', 'wscript.exe', 'wscript', 'cscript.exe', 'cscript', 'mshta.exe', 'mshta', 'rundll32.exe', 'rundll32', 'regsvr32.exe', 'regsvr32')
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Non-browser process naming browser credential stores
// MITRE: T1555.003, T1539, T1217
// CONF: medium  FP: medium  COST: low
// REQUIRES: process creation with command line (ProcessRollup2)
// FALSE POSITIVES: profile backup and migration utilities, forensic collectors
// TUNING: exclude sanctioned backup/IR tools with | FileName!=/^(YourBackupTool)(\.exe)?$/i
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(\\Login Data|\\Local State|\\Network\\Cookies|\\Web Data|key4\.db|logins\.json)/i
| FileName!=/^(chrome|msedge|firefox|opera|brave|vivaldi|msedgewebview2|googleupdate|microsoftedgeupdate|setup|updater)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.cmdline

// HUNT: Non-browser process naming browser credential stores
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1555.003, T1539, T1217
// CONF: medium | FP: medium
// FALSE POSITIVES: profile backup and migration utilities, forensic collectors
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a command line naming a browser credential store, excluding browsers and their updaters by new-process name. contains is case-insensitive, which reproduces the CQL /i intent. The negation is written as a negated in:anycase group.
// REQUIRES: SentinelOne process-creation telemetry (event.type 'Process Creation') with command lines
// TUNING: Exclude sanctioned backup and incident-response tools by adding their names to the negated tgt.process.name list.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Direct file reads of the stores without the path on a command line are not visible; this is a command-line hunt.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' (tgt.process.cmdline contains '\\Login Data' or tgt.process.cmdline contains '\\Local State' or tgt.process.cmdline contains '\\Network\\Cookies' or tgt.process.cmdline contains '\\Web Data' or tgt.process.cmdline contains 'key4.db' or tgt.process.cmdline contains 'logins.json') !(tgt.process.name in:anycase ('chrome.exe','chrome','msedge.exe','msedge','firefox.exe','firefox','opera.exe','opera','brave.exe','brave','vivaldi.exe','vivaldi','msedgewebview2.exe','msedgewebview2','googleupdate.exe','googleupdate','microsoftedgeupdate.exe','microsoftedgeupdate','setup.exe','setup','updater.exe','updater'))
| sort -event.time
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: Non-browser process naming browser credential stores
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1555.003, T1539, T1217
// CONF: medium | FP: medium
// FALSE POSITIVES: profile backup and migration utilities, forensic collectors
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a command line naming a browser credential store, excluding browsers and their updaters by created-process name. contains is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude sanctioned backup and incident-response tools by adding their names to the negated FileName list.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Direct file reads of the stores without the path on a command line are not visible; this is a command-line hunt.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine contains '\\Login Data' or ProcessCommandLine contains '\\Local State' or ProcessCommandLine contains '\\Network\\Cookies' or ProcessCommandLine contains '\\Web Data' or ProcessCommandLine contains 'key4.db' or ProcessCommandLine contains 'logins.json'
| where FileName !in~ ('chrome.exe', 'chrome', 'msedge.exe', 'msedge', 'firefox.exe', 'firefox', 'opera.exe', 'opera', 'brave.exe', 'brave', 'vivaldi.exe', 'vivaldi', 'msedgewebview2.exe', 'msedgewebview2', 'googleupdate.exe', 'googleupdate', 'microsoftedgeupdate.exe', 'microsoftedgeupdate', 'setup.exe', 'setup', 'updater.exe', 'updater')
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: PowerShell archiving or enumerating credential/key file extensions
// MITRE: T1560, T1005, T1059.001
// CONF: medium  FP: low  COST: low
// REQUIRES: process creation with command line (ProcessRollup2)
// FALSE POSITIVES: admin scripts that archive VPN profiles for distribution
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(powershell|pwsh)(\.exe)?$/i
| CommandLine=/(Compress-Archive|CreateFromDirectory|ZipFile)/i
| CommandLine=/(\.(ovpn|kdbx|rdp|pfx|jks|zs2)\b.*){2,}/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, CommandLine])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.cmdline

// HUNT: PowerShell archiving or enumerating credential/key file extensions
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1560, T1005, T1059.001
// CONF: medium | FP: low
// FALSE POSITIVES: admin scripts that archive VPN profiles for distribution
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: PowerShell with an archive API in the command line and at least two credential or key file extensions. The repeat count is kept as a regex quantifier.
// REQUIRES: SentinelOne process-creation telemetry (event.type 'Process Creation') with command lines
// TUNING: Exclude admin scripts that archive VPN profiles for distribution by adding a negated test on tgt.process.cmdline.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Archiving done by a script file that does not put the extensions on the command line is not visible.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('powershell.exe','powershell','pwsh.exe','pwsh') tgt.process.cmdline contains ('Compress-Archive','CreateFromDirectory','ZipFile') tgt.process.cmdline matches '(\\.(ovpn|kdbx|rdp|pfx|jks|zs2)\\b.*){2,}'
| sort -event.time
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: PowerShell archiving or enumerating credential/key file extensions
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1560, T1005, T1059.001
// CONF: medium | FP: low
// FALSE POSITIVES: admin scripts that archive VPN profiles for distribution
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: PowerShell with an archive API in the command line and at least two credential or key file extensions. The repeat count is kept as a regex quantifier.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude admin scripts that archive VPN profiles for distribution with a negated test on ProcessCommandLine.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Archiving done by a script file that does not put the extensions on the command line is not visible.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ('powershell.exe', 'powershell', 'pwsh.exe', 'pwsh')
| where ProcessCommandLine contains 'Compress-Archive' or ProcessCommandLine contains 'CreateFromDirectory' or ProcessCommandLine contains 'ZipFile'
| where ProcessCommandLine matches regex @"(?i)(\.(ovpn|kdbx|rdp|pfx|jks|zs2)\b.*){2,}"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Telegram Bot API lookup from an unexpected process
// MITRE: T1567, T1071.001
// CONF: medium  FP: medium  COST: medium
// REQUIRES: DNS request with process id (DnsRequest) and process creation (ProcessRollup2)
// FALSE POSITIVES: sanctioned alerting bots and scripts posting to Telegram
// TUNING: exclude approved automation hosts with | ComputerName!=/^(ALERTBOT-)/i
// LOOKBACK: 7d
#event_simpleName=DnsRequest
| DomainName=/^api\.telegram\.org$/i
| rename(field=ContextProcessId_decimal, as=TargetProcessId_decimal)
| join(query={#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ | FileName!=/^(telegram|chrome|msedge|firefox|opera|brave|vivaldi)(\.exe)?$/i}, field=[aid, TargetProcessId_decimal], include=[FileName, ImageFileName, CommandLine, UserName], mode=inner)
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, CommandLine, DomainName])

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, event.type, src.process.name, event.dns.request

// HUNT: Telegram Bot API lookup from an unexpected process
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1567, T1071.001
// CONF: medium | FP: medium
// FALSE POSITIVES: sanctioned alerting bots and scripts posting to Telegram
// EQUIVALENCE: approximate-analytic - Same behaviour, a Telegram Bot API lookup by an unexpected process, by a different analytic: the SentinelOne DNS event already carries the acting process as src.process.*, so no join to a process-creation event is needed. The exclusion list is applied to that process name.
// REQUIRES: SentinelOne DNS telemetry (event.type 'DNS Resolved') carrying the acting process
// TUNING: Exclude approved automation hosts by adding a negated test on endpoint.name.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL joins on process id to a process-creation record; this query relies on the process attributes already on the DNS event.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' event.dns.request in:anycase ('api.telegram.org') !(src.process.name in:anycase ('telegram.exe','telegram','chrome.exe','chrome','msedge.exe','msedge','firefox.exe','firefox','opera.exe','opera','brave.exe','brave','vivaldi.exe','vivaldi'))
| sort -event.time
| columns event.time, endpoint.name, src.process.user, src.process.name, src.process.image.path, src.process.cmdline, event.dns.request
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == 'DnsQueryResponse'
| project Timestamp, ActionType, AdditionalFields, InitiatingProcessFileName
| take 5

// HUNT: Telegram Bot API lookup from an unexpected process
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1567, T1071.001
// CONF: medium | FP: medium
// FALSE POSITIVES: sanctioned alerting bots and scripts posting to Telegram
// EQUIVALENCE: equivalent-with-schema-assumptions - Same behaviour: a lookup of the Telegram Bot API host by a process outside the browser and Telegram list. The name is read from AdditionalFields on DnsQueryResponse actions, and the process is InitiatingProcessFileName, so no join is needed.
// REQUIRES: Defender for Endpoint DNS action telemetry (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: Exclude approved automation hosts with a negated test on DeviceName.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: If DnsQueryResponse is not populated the query returns nothing; run the readiness test first.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == 'DnsQueryResponse'
| extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where DnsName =~ 'api.telegram.org'
| where InitiatingProcessFileName !in~ ('telegram.exe', 'telegram', 'chrome.exe', 'chrome', 'msedge.exe', 'msedge', 'firefox.exe', 'firefox', 'opera.exe', 'opera', 'brave.exe', 'brave', 'vivaldi.exe', 'vivaldi')
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, DnsName
| sort by Timestamp desc
| take 200

// HUNT: Connections to ESET-published Gorbag C2 and exfil IPs
// MITRE: T1071.001, T1567
// CONF: high  FP: low  COST: low
// REQUIRES: outbound IPv4 connections (NetworkConnectIP4)
// FALSE POSITIVES: reassigned hosting space after the campaign infrastructure is retired
// LOOKBACK: 7d
#event_simpleName=NetworkConnectIP4
| RemoteAddressIP4=/^(89\.44\.9\.186|142\.111\.194\.73)$/
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort, LocalAddressIP4])

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.time, event.type, src.process.name, dst.ip.address

// HUNT: Connections to ESET-published Gorbag C2 and exfil IPs
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1567
// CONF: high | FP: low
// FALSE POSITIVES: reassigned hosting space after the campaign infrastructure is retired
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an outbound connection to either of the two published Gorbag addresses. The acting process on an IP Connect event is src.process.*.
// REQUIRES: SentinelOne network telemetry (event.type 'IP Connect')
// TUNING: Retire the indicators once the hosting space is reassigned.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connections made through a proxy show the proxy address, not the indicator.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' dst.ip.address in ('89.44.9.186','142.111.194.73')
| sort -event.time
| columns event.time, endpoint.name, src.process.user, src.process.name, dst.ip.address, dst.port.number, src.ip.address
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, RemoteIP, RemotePort, InitiatingProcessFileName
| take 5

// HUNT: Connections to ESET-published Gorbag C2 and exfil IPs
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1567
// CONF: high | FP: low
// FALSE POSITIVES: reassigned hosting space after the campaign infrastructure is retired
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a connection to either of the two published Gorbag addresses on DeviceNetworkEvents. All connection action types are kept, as the CQL keeps every connect event.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Retire the indicators once the hosting space is reassigned.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connections made through a proxy show the proxy address, not the indicator.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where RemoteIP in ('89.44.9.186', '142.111.194.73')
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteIP, RemotePort, LocalIP, ActionType
| sort by Timestamp desc
| take 200

// HUNT: SHA-1 sweep of ESET-published Gorbag sample hashes
// MITRE: T1204.002, T1059.001
// CONF: medium  FP: low  COST: low
// REQUIRES: SHA-1 on process and PE-written events (SHA1HashData); validate in tenant that SHA1HashData is populated
// FALSE POSITIVES: none expected for exact-hash matches
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| SHA1HashData=/^(C17369B4B49113D07F080DF832E218156FB0940F|A5E0A82BF6CC302A20D917235643B748F73FCC27|E27E0D0A4B308F9B6B0469159931EB5E343E7FF8|0589D2079FBEF814DC7BB95C4B3B555C8B933AF6)$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, SHA1HashData, CommandLine])

event.type in ('Process Creation','File Creation') tgt.process.image.sha1 = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.image.sha1, tgt.file.sha1

// HUNT: SHA-1 sweep of ESET-published Gorbag sample hashes
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.002, T1059.001
// CONF: medium | FP: low
// FALSE POSITIVES: none expected for exact-hash matches
// EQUIVALENCE: equivalent-with-schema-assumptions - Same SHA-1 sweep of the four published sample hashes across process-creation and file-creation events. in:anycase reproduces the CQL case-insensitive match.
// REQUIRES: SentinelOne process-creation and file-creation telemetry with SHA-1 populated
// TUNING: None for exact-hash matches; confirm the SHA-1 fields are populated first.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A hash absent from a tenant's SHA-1 field returns nothing, which reads as a clean estate.
// VALIDATION LEVEL: static-reviewed
event.type in ('Process Creation','File Creation') (tgt.process.image.sha1 in:anycase ('C17369B4B49113D07F080DF832E218156FB0940F','A5E0A82BF6CC302A20D917235643B748F73FCC27','E27E0D0A4B308F9B6B0469159931EB5E343E7FF8','0589D2079FBEF814DC7BB95C4B3B555C8B933AF6') or tgt.file.sha1 in:anycase ('C17369B4B49113D07F080DF832E218156FB0940F','A5E0A82BF6CC302A20D917235643B748F73FCC27','E27E0D0A4B308F9B6B0469159931EB5E343E7FF8','0589D2079FBEF814DC7BB95C4B3B555C8B933AF6'))
| sort -event.time
| columns event.time, endpoint.name, src.process.user, event.type, tgt.process.name, tgt.process.image.sha1, tgt.file.path, tgt.file.sha1, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| where isnotempty(SHA1)
| project Timestamp, FileName, SHA1
| take 5

// HUNT: SHA-1 sweep of ESET-published Gorbag sample hashes
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.002, T1059.001
// CONF: medium | FP: low
// FALSE POSITIVES: none expected for exact-hash matches
// EQUIVALENCE: telemetry-gap - Partial pivot: the SHA-1 sweep covers process creation only. The CQL also sweeps executables written to disk, which needs DeviceFileEvents and cannot share a single-table query.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) with SHA1 populated
// TUNING: None for exact-hash matches; confirm SHA1 is populated first.
// LOOKBACK: 30d (Advanced Hunting retention; matches the CQL window)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Executables written to disk but never run are not swept; run the same hash list against DeviceFileEvents SHA1 separately.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where SHA1 in~ ('C17369B4B49113D07F080DF832E218156FB0940F', 'A5E0A82BF6CC302A20D917235643B748F73FCC27', 'E27E0D0A4B308F9B6B0469159931EB5E343E7FF8', '0589D2079FBEF814DC7BB95C4B3B555C8B933AF6')
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, SHA1, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Gorbag lure file names and .bwetyutgvy extension
// MITRE: T1566.001, T1204.002
// CONF: medium  FP: low  COST: low
// REQUIRES: process creation and archive written events (ProcessRollup2, ZipFileWritten)
// FALSE POSITIVES: none expected for these exact names
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|ZipFileWritten)$/
| (CommandLine=/(додаток податкова\.xlsm|[Пп]овідомлення 4726-49\.rar|\.bwetyutgvy)/i or TargetFileName=/(додаток податкова\.xlsm|[Пп]овідомлення 4726-49\.rar|\.bwetyutgvy)/i)
| table([@timestamp, aid, ComputerName, UserName, FileName, TargetFileName, CommandLine])

event.type in ('Process Creation','File Creation') tgt.file.path = *
| limit 5
| columns event.time, event.type, tgt.process.cmdline, tgt.file.path

// HUNT: Gorbag lure file names and .bwetyutgvy extension
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1566.001, T1204.002
// CONF: medium | FP: low
// FALSE POSITIVES: none expected for these exact names
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a lure file name or the test extension in a process command line or in a created file path. The CQL character class for the first letter of the .rar name is replaced by the shared tail of the name, which matches both letter cases.
// REQUIRES: SentinelOne process-creation and file-creation telemetry
// TUNING: None expected for these exact names.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Case-insensitive matching of Cyrillic letters depends on the tenant engine; the shared tail of the name avoids the first-letter case issue.
// VALIDATION LEVEL: static-reviewed
event.type in ('Process Creation','File Creation') (tgt.process.cmdline contains ('додаток податкова.xlsm','овідомлення 4726-49.rar','.bwetyutgvy') or tgt.file.path contains ('додаток податкова.xlsm','овідомлення 4726-49.rar','.bwetyutgvy'))
| sort -event.time
| columns event.time, endpoint.name, src.process.user, event.type, tgt.process.name, tgt.process.cmdline, tgt.file.path
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: Gorbag lure file names and .bwetyutgvy extension
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1566.001, T1204.002
// CONF: medium | FP: low
// FALSE POSITIVES: none expected for these exact names
// EQUIVALENCE: telemetry-gap - Partial pivot: the lure names are searched in process command lines only. The CQL also searches the names of written archives, which needs DeviceFileEvents and cannot share a single-table query.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected for these exact names.
// LOOKBACK: 30d (Advanced Hunting retention; matches the CQL window)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Archives written to disk but never named on a command line are not found; search DeviceFileEvents FileName for the same names separately.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine contains 'додаток податкова.xlsm' or ProcessCommandLine contains 'овідомлення 4726-49.rar' or ProcessCommandLine contains '.bwetyutgvy'
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: cmd self-delete of a ProgramData payload
// MITRE: T1070.004
// CONF: medium  FP: medium  COST: low
// REQUIRES: process creation with command line (ProcessRollup2)
// FALSE POSITIVES: vendor installers and updaters deleting their own staging files
// TUNING: exclude known updaters by parent with | ParentBaseFileName!=/^(knownupdater)(\.exe)?$/i
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^cmd(\.exe)?$/i
| CommandLine=/\\ProgramData\\[^\\]+\.(exe|bat|ps1|lnk)/i
| CommandLine=/(\bdel\b|\berase\b)/i
| CommandLine=/(ping|timeout|choice)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, CommandLine])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.cmdline

// HUNT: cmd self-delete of a ProgramData payload
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1070.004
// CONF: medium | FP: medium
// FALSE POSITIVES: vendor installers and updaters deleting their own staging files
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: cmd with a ProgramData payload path, a delete verb and a delay verb in the command line. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation telemetry (event.type 'Process Creation') with command lines
// TUNING: Exclude known updaters by adding a negated in:anycase test on src.process.name.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Self-deletion done without cmd, for example by a deletion API call, is not visible.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('cmd.exe','cmd') tgt.process.cmdline matches '\\\\ProgramData\\\\[^\\\\]+\\.(exe|bat|ps1|lnk)' tgt.process.cmdline matches '(\\bdel\\b|\\berase\\b)' tgt.process.cmdline matches '(ping|timeout|choice)'
| sort -event.time
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: cmd self-delete of a ProgramData payload
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1070.004
// CONF: medium | FP: medium
// FALSE POSITIVES: vendor installers and updaters deleting their own staging files
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: cmd with a ProgramData payload path, a delete verb and a delay verb in the command line. The regex is prefixed with (?i) to reproduce the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude known updaters with a negated in~ test on InitiatingProcessFileName.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Self-deletion done without cmd, for example by a deletion API call, is not visible.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ('cmd.exe', 'cmd')
| where ProcessCommandLine matches regex @"(?i)\\ProgramData\\[^\\]+\.(exe|bat|ps1|lnk)"
| where ProcessCommandLine matches regex @"(?i)(\bdel\b|\berase\b)"
| where ProcessCommandLine matches regex @"(?i)(ping|timeout|choice)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine
| sort by Timestamp desc
| take 200