ICMacOS (Icarus macOS): Infostealer to Persistent RAT

// HUNT: macOS keychain password validation or dump via the security CLI
// MITRE: T1555.001
// CONF: high  FP: medium  COST: low | REQUIRES: macOS process creation with command line
// LOOKBACK: 7d
// TUNING: exclude CI service accounts that unlock a build keychain, e.g. add | UserName!=/^(jenkins|buildkite|runner)$/i after the CommandLine filter. A user-context dump-keychain -d has almost no benign use and should stay in scope.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Mac
| FileName=/^security$/i
| CommandLine=/unlock-keychain\s+(\S+\s+)*-p\s|dump-keychain\s+(\S+\s+)*-d/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine])

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline

// HUNT: macOS keychain password validation or dump via the security CLI
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1555.001
// CONF: high | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the security binary by name with the unlock-keychain -p or dump-keychain -d argument pattern. matches is case-insensitive, which reproduces the CQL /i intent. The new process is tgt.process.*.
// REQUIRES: SentinelOne process-creation events with command line from macOS agents
// TUNING: Exclude CI service accounts that unlock a build keychain after a baseline review. A user-context dump-keychain -d has almost no benign use and should stay in scope.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A keychain command run by a process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('security') tgt.process.cmdline matches 'unlock-keychain\\s+(\\S+\\s+)*-p\\s|dump-keychain\\s+(\\S+\\s+)*-d'
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: macOS keychain password validation or dump via the security CLI
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1555.001
// CONF: high | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the security binary by name with the unlock-keychain -p or dump-keychain -d pattern. The regex carries (?i) to keep the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry from macOS devices (DeviceProcessEvents)
// TUNING: Exclude CI service accounts that unlock a build keychain after a baseline review.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A keychain command run by a process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName =~ "security"
| where ProcessCommandLine matches regex @"(?i)unlock-keychain\\s+(\\S+\\s+)*-p\\s|dump-keychain\\s+(\\S+\\s+)*-d"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FolderPath, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: browser Safe Storage key read through the security CLI
// MITRE: T1555.003
// CONF: medium  FP: medium  COST: low | REQUIRES: macOS process creation with command line
// LOOKBACK: 7d
// TUNING: exclude known IT or forensics tooling by ParentBaseFileName once baselined. Browsers read their own key through the Security framework, not this CLI, so benign hits are uncommon.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Mac
| FileName=/^security$/i
| CommandLine=/find-generic-password/i
| CommandLine=/Safe\s+Storage/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine])

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline

// HUNT: browser Safe Storage key read through the security CLI
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1555.003
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the security binary reading a generic password whose arguments mention Safe Storage. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation events with command line from macOS agents
// TUNING: Exclude known IT or forensics tooling by creating process name once baselined. Browsers read their own key through the Security framework, not this CLI, so benign hits are uncommon.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A key read through the Security framework API rather than the command line tool is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('security') tgt.process.cmdline contains 'find-generic-password' tgt.process.cmdline matches 'Safe\\s+Storage'
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: browser Safe Storage key read through the security CLI
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1555.003
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the security binary with find-generic-password and a Safe Storage service name. Both string tests are case-insensitive.
// REQUIRES: Defender for Endpoint process-creation telemetry from macOS devices (DeviceProcessEvents)
// TUNING: Exclude known IT or forensics tooling by initiating process name once baselined.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A key read through the Security framework API rather than the command line tool is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName =~ "security"
| where ProcessCommandLine contains "find-generic-password"
| where ProcessCommandLine matches regex @"(?i)Safe\\s+Storage"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FolderPath, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: osascript spoofed System Preferences prompt or privileged keychain dump
// MITRE: T1056.002, T1059.002, T1548
// CONF: medium  FP: medium  COST: low | REQUIRES: macOS process creation with command line
// LOOKBACK: 7d
// TUNING: exclude management agents with | ParentBaseFileName!=/^(jamf|Self Service|mdmclient|installer)$/i after baselining; keep any hit whose CommandLine also contains dump-keychain or hidden answer.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Mac
| FileName=/^osascript$/i
| CommandLine=/System Preferences|hidden answer|with administrator privileges|dump-keychain/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine])

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline

// HUNT: osascript spoofed System Preferences prompt or privileged keychain dump
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1056.002, T1059.002, T1548
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: osascript whose arguments carry a System Preferences prompt, a hidden answer field, an administrator-privileges request or dump-keychain. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation events with command line from macOS agents
// TUNING: Exclude management agents by creating process name after baselining; keep any hit whose command line also contains dump-keychain or hidden answer.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An AppleScript run from a script file rather than the command line is not captured when the prompt text is not in the arguments.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('osascript') tgt.process.cmdline matches 'System Preferences|hidden answer|with administrator privileges|dump-keychain'
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: osascript spoofed System Preferences prompt or privileged keychain dump
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1056.002, T1059.002, T1548
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: osascript with a System Preferences prompt, hidden answer, administrator-privileges request or dump-keychain in its arguments. contains is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry from macOS devices (DeviceProcessEvents)
// TUNING: Exclude management agents by initiating process name after baselining.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An AppleScript run from a script file rather than the command line is not captured when the prompt text is not in the arguments.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName =~ "osascript"
| where ProcessCommandLine contains "System Preferences" or ProcessCommandLine contains "hidden answer" or ProcessCommandLine contains "with administrator privileges" or ProcessCommandLine contains "dump-keychain"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FolderPath, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: com.apple.Terminal preference edits and killall Terminal
// MITRE: T1564
// CONF: medium  FP: medium  COST: low | REQUIRES: macOS process creation with command line
// LOOKBACK: 7d
// TUNING: single hits are noisy. Raise to alert only when one aid shows both a Terminal preference edit and killall Terminal within 10 minutes, or exclude managed-config scripts by ParentBaseFileName.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Mac
| FileName=/^(defaults|plutil|PlistBuddy|killall)$/i
| CommandLine=/com\.apple\.Terminal|killall\s+Terminal/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine])

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline

// HUNT: com.apple.Terminal preference edits and killall Terminal
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1564
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: defaults, plutil, PlistBuddy or killall whose arguments name the com.apple.Terminal preferences or killall Terminal. The CQL names the file and domain-style literal verbatim; contains and matches are case-insensitive, reproducing the /i intent.
// REQUIRES: SentinelOne process-creation events with command line from macOS agents
// TUNING: Single hits are noisy. Raise to alert only when one host shows both a Terminal preference edit and killall Terminal within 10 minutes, or exclude managed-config scripts by creating process name.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The 10-minute pairing of a preference edit and killall Terminal is a tuning step and is not enforced by this query.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('defaults', 'plutil', 'PlistBuddy', 'killall') (tgt.process.cmdline contains 'com.apple.Terminal' or tgt.process.cmdline matches 'killall\\s+Terminal')
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: com.apple.Terminal preference edits and killall Terminal
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1564
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: defaults, plutil, PlistBuddy or killall with com.apple.Terminal or killall Terminal in the arguments.
// REQUIRES: Defender for Endpoint process-creation telemetry from macOS devices (DeviceProcessEvents)
// TUNING: Raise to alert only when one device shows both a Terminal preference edit and killall Terminal within 10 minutes.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The 10-minute pairing of a preference edit and killall Terminal is a tuning step and is not enforced by this query.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ("defaults", "plutil", "PlistBuddy", "killall")
| where ProcessCommandLine contains "com.apple.Terminal" or ProcessCommandLine matches regex @"(?i)killall\\s+Terminal"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FolderPath, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: published ICMacOS infrastructure and staging strings in command lines
// MITRE: T1204.004, T1059.004, T1105
// CONF: high  FP: low  COST: low | REQUIRES: macOS process creation with command line
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Mac
| CommandLine=/escapeai\.live|mikoblico\.xyz|icmacos_run_v2|loader_v2\.sh|ICMacOs\?arch=|\.update-tmp|\.update-helper\.log|\.cache-update\.log|\.systemd-private-helper\.zip/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline

// HUNT: published ICMacOS infrastructure and staging strings in command lines
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.004, T1059.004, T1105
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: any process whose command line carries one of the published ICMacOS domains or staging strings. Each alternative is a literal substring test, case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation events with command line from macOS agents
// TUNING: None expected: the strings are specific to this campaign.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A string split across arguments or built at run time is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.cmdline matches 'escapeai\\.live|mikoblico\\.xyz|icmacos_run_v2|loader_v2\\.sh|ICMacOs\\?arch=|\\.update-tmp|(\\.)update-helper\\.log|(\\.)cache-update\\.log|(\\.)systemd-private-helper\\.zip'
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: published ICMacOS infrastructure and staging strings in command lines
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.004, T1059.004, T1105
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: any command line carrying one of the published ICMacOS domains or staging strings, as case-insensitive substring tests.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected: the strings are specific to this campaign.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A string split across arguments or built at run time is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine matches regex @"(?i)escapeai\.live|mikoblico\.xyz|icmacos_run_v2|loader_v2\.sh|ICMacOs\?arch=|\.update-tmp|(\.)update-helper\.log|(\.)cache-update\.log|(\.)systemd-private-helper\.zip"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: DNS resolution of ICMacOS domains
// MITRE: T1071.001, T1567
// CONF: high  FP: low  COST: low | REQUIRES: endpoint DNS request telemetry
// LOOKBACK: 7d
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(escapeai\.live|mikoblico\.xyz)$/i
| table([@timestamp, aid, ComputerName, DomainName, ContextProcessId_decimal])

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, event.dns.request

// HUNT: DNS resolution of ICMacOS domains
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1567
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same intent: a DNS resolution for either ICMacOS domain. The CQL anchors the name to the domain or a subdomain of it; this query uses a substring test, which can also match a longer name that merely contains the domain.
// REQUIRES: SentinelOne DNS Resolved events from macOS agents
// TUNING: None expected: both domains are specific to this campaign.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The suffix anchoring of the CQL is replaced by a substring test.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' (event.dns.request contains 'escapeai.live' or event.dns.request contains 'mikoblico.xyz')
| sort -event.time
| limit 200
| columns event.time, endpoint.name, event.dns.request, src.process.name, src.process.pid

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: DNS resolution of ICMacOS domains
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1567
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same intent: a DNS resolution for either ICMacOS domain, read from DeviceEvents DnsQueryResponse. The name sits inside AdditionalFields, and the CQL suffix anchoring is replaced by a substring test.
// REQUIRES: Defender for Endpoint DnsQueryResponse events in DeviceEvents
// TUNING: None expected: both domains are specific to this campaign.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The suffix anchoring of the CQL is replaced by a substring test.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "DnsQueryResponse"
| extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where DnsName contains "escapeai.live" or DnsName contains "mikoblico.xyz"
| project Timestamp, ReportId, DeviceId, DeviceName, DnsName, InitiatingProcessFileName, InitiatingProcessId
| sort by Timestamp desc
| take 200

// HUNT: outbound connection to published ICMacOS IP addresses
// MITRE: T1071.001
// CONF: high  FP: low  COST: low | REQUIRES: endpoint network connection telemetry
// LOOKBACK: 7d
#event_simpleName=NetworkConnectIP4
| in(RemoteAddressIP4, values=["85.137.253.61", "45.13.186.247"])
| table([@timestamp, aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort, LocalAddressIP4])

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.time, dst.ip.address

// HUNT: outbound connection to published ICMacOS IP addresses
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same intent: an outbound connection to either published ICMacOS address. The acting process on a network event is src.process.*.
// REQUIRES: SentinelOne IP Connect events from macOS agents
// TUNING: None expected: both addresses are specific to this campaign.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connections that go through a proxy show the proxy address, not the destination.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' dst.ip.address in ('85.137.253.61', '45.13.186.247')
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.name, src.ip.address, dst.ip.address, dst.port.number

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, RemoteIP, RemotePort
| take 5

// HUNT: outbound connection to published ICMacOS IP addresses
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same intent: an outbound connection to either published ICMacOS address, read from DeviceNetworkEvents.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: None expected: both addresses are specific to this campaign.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connections that go through a proxy show the proxy address, not the destination.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where RemoteIP in ("85.137.253.61", "45.13.186.247")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, LocalIP
| sort by Timestamp desc
| take 200

// HUNT: launchctl referencing the com.apple.systemupdater persistence label
// MITRE: T1543.001, T1036.005
// CONF: high  FP: low  COST: low | REQUIRES: macOS process creation with command line
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Mac
| FileName=/^launchctl$/i
| CommandLine=/systemupdater/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine])

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline

// HUNT: launchctl referencing the com.apple.systemupdater persistence label
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1543.001, T1036.005
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: launchctl whose arguments mention systemupdater. contains is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation events with command line from macOS agents
// TUNING: None expected: the label is specific to this campaign.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A LaunchAgent loaded by launchd at login without a launchctl command is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('launchctl') tgt.process.cmdline contains 'systemupdater'
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: launchctl referencing the com.apple.systemupdater persistence label
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1543.001, T1036.005
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: launchctl with systemupdater in its arguments. contains is case-insensitive.
// REQUIRES: Defender for Endpoint process-creation telemetry from macOS devices (DeviceProcessEvents)
// TUNING: None expected: the label is specific to this campaign.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A LaunchAgent loaded by launchd at login without a launchctl command is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName =~ "launchctl"
| where ProcessCommandLine contains "systemupdater"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FolderPath, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: com.apple.* LaunchAgent loaded from a per-user LaunchAgents folder
// MITRE: T1543.001, T1036.005
// CONF: medium  FP: medium  COST: low | REQUIRES: macOS process creation with command line
// LOOKBACK: 7d
// TUNING: after a one-week baseline, exclude known-good labels with | CommandLine!=/com\.apple\.(labelA|labelB)\.plist/i. Keep unknown labels and anything whose plist sits under /tmp or a hidden folder.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Mac
| FileName=/^launchctl$/i
| CommandLine=/bootstrap|load|submit|kickstart/i
| CommandLine=/\/Users\/[^\/]+\/Library\/LaunchAgents\/com\.apple\./i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine])

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline

// HUNT: com.apple.* LaunchAgent loaded from a per-user LaunchAgents folder
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1543.001, T1036.005
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: launchctl with a load, bootstrap, submit or kickstart verb whose arguments point at a com.apple. plist in a per-user LaunchAgents folder. matches and contains are case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation events with command line from macOS agents
// TUNING: After a one-week baseline, exclude known-good labels. Keep unknown labels and anything whose plist sits under /tmp or a hidden folder.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A plist loaded from a path that does not start with /Users/ is not matched; the other CQL cards cover the campaign label.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('launchctl') tgt.process.cmdline matches 'bootstrap|load|submit|kickstart' tgt.process.cmdline matches '/Users/[^/]+/Library/LaunchAgents/com[.]apple[.]'
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: com.apple.* LaunchAgent loaded from a per-user LaunchAgents folder
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1543.001, T1036.005
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: launchctl with a load, bootstrap, submit or kickstart verb and a com.apple. plist in a per-user LaunchAgents folder. The regex carries (?i) to keep the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry from macOS devices (DeviceProcessEvents)
// TUNING: After a one-week baseline, exclude known-good labels. Keep unknown labels and anything whose plist sits under /tmp or a hidden folder.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A plist loaded from a path that does not start with /Users/ is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName =~ "launchctl"
| where ProcessCommandLine contains "bootstrap" or ProcessCommandLine contains "load" or ProcessCommandLine contains "submit" or ProcessCommandLine contains "kickstart"
| where ProcessCommandLine matches regex @"(?i)/Users/[^/]+/Library/LaunchAgents/com\.apple\."
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FolderPath, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: ICMacOs implant binary or .update-tmp staging execution
// MITRE: T1059.004, T1036.005
// CONF: high  FP: low  COST: low | REQUIRES: macOS process creation with image path
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Mac
| FileName=/^ICMacOs$/i or ImageFileName=/\.update-tmp/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData])

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.image.path

// HUNT: ICMacOs implant binary or .update-tmp staging execution
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.004, T1036.005
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a process named ICMacOs, or one whose image path contains .update-tmp. The new process is tgt.process.*. contains is case-insensitive and in:anycase makes the name test case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation events with image path from macOS agents
// TUNING: None expected: the name and staging folder are specific to this campaign.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An implant renamed and run from outside a .update-tmp folder is not matched by name or path.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' (tgt.process.name in:anycase ('ICMacOs') or tgt.process.image.path contains '.update-tmp')
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.image.sha256, tgt.process.cmdline

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath
| take 5

// HUNT: ICMacOs implant binary or .update-tmp staging execution
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.004, T1036.005
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a created process named ICMacOs, or one whose path contains .update-tmp.
// REQUIRES: Defender for Endpoint process-creation telemetry from macOS devices (DeviceProcessEvents)
// TUNING: None expected: the name and staging folder are specific to this campaign.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An implant renamed and run from outside a .update-tmp folder is not matched by name or path.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName =~ "ICMacOs" or FolderPath contains ".update-tmp"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: processes spawned by the ICMacOs implant
// MITRE: T1059.004, T1115, T1082, T1033
// CONF: high  FP: low  COST: low | REQUIRES: macOS process creation with parent name
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Mac
| ParentBaseFileName=/^ICMacOs$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' src.process.name = *
| limit 5
| columns event.time, src.process.name, tgt.process.name

// HUNT: processes spawned by the ICMacOs implant
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.004, T1115, T1082, T1033
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a process whose creator is named ICMacOs. On a Process Creation event the creator is src.process.*, so the implant is matched there and the child is tgt.process.*. in:anycase reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation events from macOS agents
// TUNING: None expected: a child of the implant is suspicious by definition.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Children of an implant renamed away from ICMacOs are not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name in:anycase ('ICMacOs')
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName
| take 5

// HUNT: processes spawned by the ICMacOs implant
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.004, T1115, T1082, T1033
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a created process whose initiating process is named ICMacOs. The CQL parent field maps to InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry from macOS devices (DeviceProcessEvents)
// TUNING: None expected: a child of the implant is suspicious by definition.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Children of an implant renamed away from ICMacOs are not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName =~ "ICMacOs"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: CIS geofence checks (locale ru_RU, ipinfo country lookup)
// MITRE: T1480
// CONF: medium  FP: medium  COST: low | REQUIRES: macOS process creation with command line
// LOOKBACK: 7d
// TUNING: exclude well-known IT inventory scripts by ParentBaseFileName; prioritise hosts where both ru_RU and ipinfo.io/country appear for one aid inside 60 seconds.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Mac
| FileName=/^(sh|bash|zsh|curl|grep)$/i
| CommandLine=/ru_RU|ipinfo\.io\/country/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine])

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline

// HUNT: CIS geofence checks (locale ru_RU, ipinfo country lookup)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1480
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: sh, bash, zsh, curl or grep whose arguments carry ru_RU or ipinfo.io/country. contains is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation events with command line from macOS agents
// TUNING: Exclude well-known IT inventory scripts by creating process name; prioritise hosts where both ru_RU and ipinfo.io/country appear within 60 seconds.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The 60-second pairing of a locale check and an ipinfo.io lookup is a tuning step and is not enforced by this query.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('sh', 'bash', 'zsh', 'curl', 'grep') (tgt.process.cmdline contains 'ru_RU' or tgt.process.cmdline contains 'ipinfo.io/country')
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: CIS geofence checks (locale ru_RU, ipinfo country lookup)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1480
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: sh, bash, zsh, curl or grep with ru_RU or ipinfo.io/country in the arguments.
// REQUIRES: Defender for Endpoint process-creation telemetry from macOS devices (DeviceProcessEvents)
// TUNING: Exclude well-known IT inventory scripts by initiating process name.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The 60-second pairing of a locale check and an ipinfo.io lookup is a tuning step and is not enforced by this query.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ("sh", "bash", "zsh", "curl", "grep")
| where ProcessCommandLine contains "ru_RU" or ProcessCommandLine contains "ipinfo.io/country"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FolderPath, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: ClickFix-style curl-to-shell one-liners
// MITRE: T1204.004, T1059.004
// CONF: medium  FP: high  COST: medium | REQUIRES: macOS process creation with command line
// LOOKBACK: 7d
// TUNING: exclude the Homebrew installer and other vendor installers you allow: the CommandLine!=/Homebrew\/install/i line below is a starting point. Prioritise hits to new or low-reputation hosts, or where the next stage lands under /tmp and is a .command file.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Mac
| FileName=/^(sh|bash|zsh)$/i
| CommandLine=/-c\s+.*\$\(\s*curl|curl\s.*\|\s*(ba|z)?sh/i
| CommandLine!=/Homebrew\/install/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine])

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.cmdline

// HUNT: ClickFix-style curl-to-shell one-liners
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.004, T1059.004
// CONF: medium | FP: high
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a shell running a curl command substitution or piping curl into a shell, excluding the Homebrew installer. matches and contains are case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation events with command line from macOS agents
// TUNING: Exclude the Homebrew installer and other vendor installers you allow. Prioritise hits to new or low-reputation hosts, or where the next stage lands under /tmp and is a .command file.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Expect a high false-positive rate from legitimate installers; the Homebrew exclusion is only a starting point. A download written with wget or a language runtime instead of curl is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('sh', 'bash', 'zsh') tgt.process.cmdline matches '-c\\s+.*[$][(]\\s*curl|curl\\s.*[|]\\s*(ba|z)?sh' !(tgt.process.cmdline contains 'Homebrew/install')
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: ClickFix-style curl-to-shell one-liners
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.004, T1059.004
// CONF: medium | FP: high
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a shell running a curl command substitution or piping curl into a shell, excluding the Homebrew installer. The regex carries (?i) to keep the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry from macOS devices (DeviceProcessEvents)
// TUNING: Exclude the Homebrew installer and other vendor installers you allow. Prioritise hits to new or low-reputation hosts.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Expect a high false-positive rate from legitimate installers; the Homebrew exclusion is only a starting point. A download written with wget or a language runtime instead of curl is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ("sh", "bash", "zsh")
| where ProcessCommandLine matches regex @"(?i)-c\\s+.*[$][(]\\s*curl|curl\\s.*[|]\\s*(ba|z)?sh"
| where ProcessCommandLine !contains "Homebrew/install"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FolderPath, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: published ICMacOS SHA-256 values as process images
// MITRE: T1059.004
// CONF: high  FP: low  COST: low | REQUIRES: macOS process creation with SHA-256
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| in(SHA256HashData, values=["5dfb0c01ac5c075e23ec37873b30ba16cf28e290e9439d04101f0a8191f929d8", "8cc449e7e240894e77187f6faff415bc8b9f2f9da73f60eef1f7605debd9144a", "62e435102e1e1de74537f174ede7c8ff198dc4df3fd2e1167f537096e0b4dd17", "857236d1902f4604acdf27519c0310064d21f8a82af3b95b1e4f02fef581b1d0", "6917505bbdc8efa01ea1a0298eae62a93a57a8c98d3712a69d822dca4a667f05", "dca852b53c259641e1782bd9122c5007130614a7a8fd17102400acb4f50f6e94", "e7e8ac14aaee970c6d00c6cbb398decc56dfc128974c01bfc8e7acd13a18576e", "ec37acd3bd15f50eee2941d5644ca0ee738b36ce4a39e9e08058e35ebc7961fc", "fcf9de13ecc70b4fda3998ed7a93849edf86c48767a1a13f32f4a6a631a65ae2", "3d4f70172c8f31813e7b37fc1a49bce193663e33c4eb65952bb5aec9d7176826", "8b7606bdccdd6ff691db875283fdf5b6b658dd8d4d141b44e07f8f2583ff5604", "bc8d70f000e73c0c7a69a2676805190e7109cab59df3e34c5a74d2cb7f13a7e4", "a9b21ac0112855b835b5e5850ef167471eff7305d42b3a8104c1961b257a444d", "c8136413ad38a1028050f5d508e25267b518c5fdeac80b6442103d1009d8924c", "e52855d447d152bb698e565f361161cdc8946183ab09bf3cbea89765a2b5ff31", "d9df05a3fb68d302ecf134a1214b609c6ec0a3fb9122907214afac3908b587f4", "8b4303a065e18e80050ef22031ec60b1a4e84f958d9e56cc5cc34cd29d988d69"])
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, SHA256HashData, CommandLine])

event.type = 'Process Creation' tgt.process.image.sha256 = *
| limit 5
| columns event.time, tgt.process.name, tgt.process.image.sha256

// HUNT: published ICMacOS SHA-256 values as process images
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.004
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a created process whose SHA-256 is one of the 17 published ICMacOS values. The new process is tgt.process.*; in:anycase makes the hash comparison case-insensitive.
// REQUIRES: SentinelOne process-creation events with a populated SHA-256 on macOS agents
// TUNING: None expected: the hashes are specific to this campaign.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A rebuilt or re-signed sample has a new hash and is not matched; the behavioural cards cover it.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.image.sha256 in:anycase ('5dfb0c01ac5c075e23ec37873b30ba16cf28e290e9439d04101f0a8191f929d8', '8cc449e7e240894e77187f6faff415bc8b9f2f9da73f60eef1f7605debd9144a', '62e435102e1e1de74537f174ede7c8ff198dc4df3fd2e1167f537096e0b4dd17', '857236d1902f4604acdf27519c0310064d21f8a82af3b95b1e4f02fef581b1d0', '6917505bbdc8efa01ea1a0298eae62a93a57a8c98d3712a69d822dca4a667f05', 'dca852b53c259641e1782bd9122c5007130614a7a8fd17102400acb4f50f6e94', 'e7e8ac14aaee970c6d00c6cbb398decc56dfc128974c01bfc8e7acd13a18576e', 'ec37acd3bd15f50eee2941d5644ca0ee738b36ce4a39e9e08058e35ebc7961fc', 'fcf9de13ecc70b4fda3998ed7a93849edf86c48767a1a13f32f4a6a631a65ae2', '3d4f70172c8f31813e7b37fc1a49bce193663e33c4eb65952bb5aec9d7176826', '8b7606bdccdd6ff691db875283fdf5b6b658dd8d4d141b44e07f8f2583ff5604', 'bc8d70f000e73c0c7a69a2676805190e7109cab59df3e34c5a74d2cb7f13a7e4', 'a9b21ac0112855b835b5e5850ef167471eff7305d42b3a8104c1961b257a444d', 'c8136413ad38a1028050f5d508e25267b518c5fdeac80b6442103d1009d8924c', 'e52855d447d152bb698e565f361161cdc8946183ab09bf3cbea89765a2b5ff31', 'd9df05a3fb68d302ecf134a1214b609c6ec0a3fb9122907214afac3908b587f4', '8b4303a065e18e80050ef22031ec60b1a4e84f958d9e56cc5cc34cd29d988d69')
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.path, tgt.process.image.sha256, tgt.process.cmdline

DeviceProcessEvents
| where Timestamp > ago(1d)
| where isnotempty(SHA256)
| project Timestamp, SHA256
| take 5

// HUNT: published ICMacOS SHA-256 values as process images
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.004
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a created process whose SHA-256 is one of the 17 published ICMacOS values. SHA256 is often unpopulated in DeviceProcessEvents, so an empty result is weaker evidence than on the CQL tab.
// REQUIRES: Defender for Endpoint process-creation telemetry with a populated SHA256 (DeviceProcessEvents)
// TUNING: None expected: the hashes are specific to this campaign.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: SHA256 is often unpopulated in DeviceProcessEvents, and the CQL carries no SHA1 values to pivot on instead. A rebuilt or re-signed sample has a new hash and is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where SHA256 in~ ("5dfb0c01ac5c075e23ec37873b30ba16cf28e290e9439d04101f0a8191f929d8", "8cc449e7e240894e77187f6faff415bc8b9f2f9da73f60eef1f7605debd9144a", "62e435102e1e1de74537f174ede7c8ff198dc4df3fd2e1167f537096e0b4dd17", "857236d1902f4604acdf27519c0310064d21f8a82af3b95b1e4f02fef581b1d0", "6917505bbdc8efa01ea1a0298eae62a93a57a8c98d3712a69d822dca4a667f05", "dca852b53c259641e1782bd9122c5007130614a7a8fd17102400acb4f50f6e94", "e7e8ac14aaee970c6d00c6cbb398decc56dfc128974c01bfc8e7acd13a18576e", "ec37acd3bd15f50eee2941d5644ca0ee738b36ce4a39e9e08058e35ebc7961fc", "fcf9de13ecc70b4fda3998ed7a93849edf86c48767a1a13f32f4a6a631a65ae2", "3d4f70172c8f31813e7b37fc1a49bce193663e33c4eb65952bb5aec9d7176826", "8b7606bdccdd6ff691db875283fdf5b6b658dd8d4d141b44e07f8f2583ff5604", "bc8d70f000e73c0c7a69a2676805190e7109cab59df3e34c5a74d2cb7f13a7e4", "a9b21ac0112855b835b5e5850ef167471eff7305d42b3a8104c1961b257a444d", "c8136413ad38a1028050f5d508e25267b518c5fdeac80b6442103d1009d8924c", "e52855d447d152bb698e565f361161cdc8946183ab09bf3cbea89765a2b5ff31", "d9df05a3fb68d302ecf134a1214b609c6ec0a3fb9122907214afac3908b587f4", "8b4303a065e18e80050ef22031ec60b1a4e84f958d9e56cc5cc34cd29d988d69")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, SHA1, SHA256, ProcessCommandLine
| sort by Timestamp desc
| take 200