MythicRatatoskr: Yggdrasil-Hidden Backdoor and the Sandworm SDelete Wiping Stage

// HUNT: MythicRatatoskr service persistence (ieupdate)
// MITRE: T1543.003, T1036.005
// CONF: high  FP: low  COST: low | REQUIRES: service creation telemetry (CreateService)
// LOOKBACK: 30d (set with the time picker)
#event_simpleName=CreateService
| ServiceName=/^ieupdate$/i or ServiceImagePath=/\\(ieupdate|windowsdefendersvc|krbtman|onedriveliveupdater|nbtresolver)\.exe/i or ServiceImagePath=/\\windows\\system32\\updater\.exe/i
| table([@timestamp, aid, ComputerName, UserName, ServiceName, ServiceDisplayName, ServiceImagePath])
| sort(@timestamp, order=desc)

event.type = 'Registry Value Modified' registry.keyPath = *
| limit 5
| columns event.time, event.type, registry.keyPath, registry.valueName, registry.value

// HUNT: MythicRatatoskr service persistence (ieupdate)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1543.003, T1036.005
// CONF: high | FP: low
// EQUIVALENCE: approximate-analytic - SentinelOne lists no service-creation event type, so the hunt reads the registry write that creates the service: the ImagePath value under the Services key. It tests the same two things as the CQL, a service named ieupdate and a service image with a masquerade name.
// REQUIRES: SentinelOne endpoint registry telemetry (Registry Value Modified events)
// TUNING: Baseline legitimate vendor updaters that register a service named updater under System32 before alerting.
// LOOKBACK: 30d; set with the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A service created through a path that does not write ImagePath to the registry on the monitored host is not seen. The CQL's service display name and service name fields have no separate column here.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified' registry.valueName = 'ImagePath' registry.keyPath contains 'Services'
(registry.keyPath matches '\\\\Services\\\\ieupdate(\\\\|$)' or registry.value matches '\\\\(ieupdate|windowsdefendersvc|krbtman|onedriveliveupdater|nbtresolver)\\.exe' or registry.value matches '\\\\windows\\\\system32\\\\updater\\.exe')
| columns event.time, endpoint.name, src.process.user, registry.keyPath, registry.value, src.process.name
| sort -event.time
| limit 200

DeviceRegistryEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, RegistryKey, RegistryValueName, RegistryValueData
| take 5

// HUNT: MythicRatatoskr service persistence (ieupdate)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1543.003, T1036.005
// CONF: high | FP: low
// EQUIVALENCE: approximate-analytic - Defender records a service creation as a registry write, so the hunt reads the ImagePath value under the Services key rather than a service-creation event. It tests the same two things as the CQL, a service named ieupdate and a service image with a masquerade name.
// REQUIRES: Defender for Endpoint registry telemetry (DeviceRegistryEvents)
// TUNING: Baseline legitimate vendor updaters that register a service named updater under System32 before alerting.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A service created without a recorded ImagePath registry write is not seen. The CQL's service display name has no separate column here.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceRegistryEvents
| where Timestamp >= ago(30d)
| where ActionType == "RegistryValueSet"
| where RegistryValueName =~ "ImagePath"
| where RegistryKey matches regex @"(?i)\\Services\\ieupdate$" or RegistryValueData matches regex @"(?i)\\(ieupdate|windowsdefendersvc|krbtman|onedriveliveupdater|nbtresolver)\.exe" or RegistryValueData matches regex @"(?i)\\windows\\system32\\updater\.exe"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueData, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: MythicRatatoskr and bindProxy binaries written to observed install paths
// MITRE: T1036.005, T1105
// CONF: high  FP: medium  COST: low | REQUIRES: executable write telemetry (PeFileWritten, NewExecutableWritten)
// TUNING: baseline 14 days. If a software-distribution tool legitimately stages an updater.exe, exclude that writer with a ContextBaseFileName filter. Drop the Downloads ie.exe branch first if it is noisy.
// LOOKBACK: 30d (set with the time picker)
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| TargetFileName=/(\\windows\\system32\\(updater|krbtman|windowsdefendersvc)\.exe|\\microsoft\\onedrive\\onedriveliveupdater\.exe|\\microsoft\.net\\adomd\.net\\110\\applicationasphost\.exe|\\office2010\\utilities\\act64\.exe|\\downloads\\(windowsdefendersvc|ieupdate|ie|krbtman)\.exe|\\internet explorer\\ieupdate\.exe|\\appdata\\local\\ieupdate\.exe|\\smbcache\\nbtresolver\.exe)$/i
| table([@timestamp, aid, ComputerName, UserName, TargetFileName, ContextBaseFileName, SHA256HashData])
| sort(@timestamp, order=desc)

event.type = 'File Creation' tgt.file.path = *
| limit 5
| columns event.time, event.type, tgt.file.path

// HUNT: MythicRatatoskr and bindProxy binaries written to observed install paths
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1036.005, T1105
// CONF: high | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same file-write predicate: the full path must end in one of the observed masquerade binaries under its observed install directory. The writer is src.process.* because this is not a process-creation event. The CQL's PE-write sensor events become File Creation and File Modification.
// REQUIRES: SentinelOne endpoint file telemetry (File Creation and File Modification events)
// TUNING: Baseline 14 days. If a software-distribution tool legitimately stages an updater.exe, exclude that writer with a src.process.name filter. Drop the Downloads ie.exe branch first if it is noisy.
// LOOKBACK: 30d; set with the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL fires only on executable (PE) writes; this query matches on the path alone, so a non-PE file of the same name also matches.
// VALIDATION LEVEL: static-reviewed
event.type in ('File Creation', 'File Modification') tgt.file.path matches '(\\\\windows\\\\system32\\\\(updater|krbtman|windowsdefendersvc)\\.exe|\\\\microsoft\\\\onedrive\\\\onedriveliveupdater\\.exe|\\\\microsoft\\.net\\\\adomd\\.net\\\\110\\\\applicationasphost\\.exe|\\\\office2010\\\\utilities\\\\act64\\.exe|\\\\downloads\\\\(windowsdefendersvc|ieupdate|ie|krbtman)\\.exe|\\\\internet explorer\\\\ieupdate\\.exe|\\\\appdata\\\\local\\\\ieupdate\\.exe|\\\\smbcache\\\\nbtresolver\\.exe)$'
| columns event.time, endpoint.name, src.process.user, tgt.file.path, src.process.name, tgt.file.sha256
| sort -event.time
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, FolderPath, FileName
| take 5

// HUNT: MythicRatatoskr and bindProxy binaries written to observed install paths
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1036.005, T1105
// CONF: high | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same file-write predicate: a masquerade file name under its observed install directory. The directory and the name are tested separately because FolderPath may or may not include the file name. The CQL's PE-write sensor events become FileCreated and FileModified.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: Baseline 14 days. If a software-distribution tool legitimately stages an updater.exe, exclude that writer by InitiatingProcessFileName. Drop the Downloads ie.exe branch first if it is noisy.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL fires only on executable (PE) writes; this query matches on the path alone, so a non-PE file of the same name also matches.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where ActionType in ("FileCreated", "FileModified")
| where (FolderPath contains @"\windows\system32" and FileName in~ ("updater.exe", "krbtman.exe", "windowsdefendersvc.exe"))
    or (FolderPath contains @"\microsoft\onedrive" and FileName =~ "onedriveliveupdater.exe")
    or (FolderPath contains @"\microsoft.net\adomd.net\110" and FileName =~ "applicationasphost.exe")
    or (FolderPath contains @"\office2010\utilities" and FileName =~ "act64.exe")
    or (FolderPath contains @"\downloads" and FileName in~ ("windowsdefendersvc.exe", "ieupdate.exe", "ie.exe", "krbtman.exe"))
    or (FolderPath contains @"\internet explorer" and FileName =~ "ieupdate.exe")
    or (FolderPath contains @"\appdata\local" and FileName =~ "ieupdate.exe")
    or (FolderPath contains @"\smbcache" and FileName =~ "nbtresolver.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, FolderPath, FileName, InitiatingProcessFileName, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: MythicRatatoskr and bindProxy process execution from observed install paths
// MITRE: T1036.005, T1543.003
// CONF: high  FP: medium  COST: low | REQUIRES: process creation with image path (ProcessRollup2)
// TUNING: baseline 14 days. Exclude a sanctioned updater by SHA256HashData allowlist, not by name, because the attackers reuse common names.
// LOOKBACK: 30d (set with the time picker)
#event_simpleName=ProcessRollup2
| ImageFileName=/(\\windows\\system32\\(updater|krbtman|windowsdefendersvc)\.exe|\\microsoft\\onedrive\\onedriveliveupdater\.exe|\\microsoft\.net\\adomd\.net\\110\\applicationasphost\.exe|\\office2010\\utilities\\act64\.exe|\\downloads\\(windowsdefendersvc|ieupdate|ie|krbtman)\.exe|\\internet explorer\\ieupdate\.exe|\\appdata\\local\\ieupdate\.exe|\\smbcache\\nbtresolver\.exe)$/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, ParentBaseFileName, CommandLine, SHA1HashData, SHA256HashData])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.image.path = *
| limit 5
| columns event.time, event.type, tgt.process.image.path

// HUNT: MythicRatatoskr and bindProxy process execution from observed install paths
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1036.005, T1543.003
// CONF: high | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the new process image path must end in one of the observed masquerade binaries under its observed install directory. The image is tgt.process.* because this is a Process Creation event and src.process.* is the creator.
// REQUIRES: SentinelOne endpoint process-creation telemetry (Process Creation events)
// TUNING: Baseline 14 days. Exclude a sanctioned updater by tgt.process.image.sha1 allowlist, not by name, because the attackers reuse common names.
// LOOKBACK: 30d; set with the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.image.path matches '(\\\\windows\\\\system32\\\\(updater|krbtman|windowsdefendersvc)\\.exe|\\\\microsoft\\\\onedrive\\\\onedriveliveupdater\\.exe|\\\\microsoft\\.net\\\\adomd\\.net\\\\110\\\\applicationasphost\\.exe|\\\\office2010\\\\utilities\\\\act64\\.exe|\\\\downloads\\\\(windowsdefendersvc|ieupdate|ie|krbtman)\\.exe|\\\\internet explorer\\\\ieupdate\\.exe|\\\\appdata\\\\local\\\\ieupdate\\.exe|\\\\smbcache\\\\nbtresolver\\.exe)$'
| columns event.time, endpoint.name, src.process.user, tgt.process.image.path, src.process.name, tgt.process.cmdline, tgt.process.image.sha1, tgt.process.image.sha256
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FolderPath, FileName
| take 5

// HUNT: MythicRatatoskr and bindProxy process execution from observed install paths
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1036.005, T1543.003
// CONF: high | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a masquerade image name under its observed install directory. The directory and the name are tested separately because FolderPath may or may not include the file name. The parent is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Baseline 14 days. Exclude a sanctioned updater by SHA1 allowlist, not by name, because the attackers reuse common names.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where (FolderPath contains @"\windows\system32" and FileName in~ ("updater.exe", "krbtman.exe", "windowsdefendersvc.exe"))
    or (FolderPath contains @"\microsoft\onedrive" and FileName =~ "onedriveliveupdater.exe")
    or (FolderPath contains @"\microsoft.net\adomd.net\110" and FileName =~ "applicationasphost.exe")
    or (FolderPath contains @"\office2010\utilities" and FileName =~ "act64.exe")
    or (FolderPath contains @"\downloads" and FileName in~ ("windowsdefendersvc.exe", "ieupdate.exe", "ie.exe", "krbtman.exe"))
    or (FolderPath contains @"\internet explorer" and FileName =~ "ieupdate.exe")
    or (FolderPath contains @"\appdata\local" and FileName =~ "ieupdate.exe")
    or (FolderPath contains @"\smbcache" and FileName =~ "nbtresolver.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FolderPath, FileName, InitiatingProcessFileName, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: MythicRatatoskr and bindProxy SHA-1 match (ESET)
// MITRE: T1543.003, T1090.001
// CONF: high  FP: low  COST: low | REQUIRES: process creation with SHA-1 (ProcessRollup2)
// NOTE: krbtman.exe is MythicRatatoskr on some hosts and the SOCKS5 server on others. Read SHA1HashData to tell them apart.
// LOOKBACK: 30d (set with the time picker)
#event_simpleName=ProcessRollup2
| SHA1HashData=/^(D5F9288DAEBF87AE4579945F8DC6CF235B093CFD|B69EF0E45B401440C0FDE22046775D0C57E87415|4E3E6577866E4CE2ED73CA089700AE04230E768F|69969EEB7E0A3D84C4E70193636FCF934C6AA388|01855153CA7A33AD5FF36451DE5612DFBA0DD2CA|E29AF83A07FB32EB47C28733A9382E766D53F704|028CA11F3F0D8396043AF7BF756231FC2F50F829|9085896989947C0919A660352F75F6B233FC645B|D7E6A5A46C6ED3510997E91B11E51BE0250FD2A2|131A371A1E4EE78EC3B2863607C99290EC3B58A6|09C816697C0C2AFF9B4FF58681558CA30D04C9CD|8CEB5F8BCDF4995B7164996F1629D682613BB17B|8CEB5F8BCDF4995B7164996F1429D682613BB17B)$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, SHA1HashData, ParentBaseFileName, CommandLine])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.image.sha1 = *
| limit 5
| columns event.time, event.type, tgt.process.image.sha1

// HUNT: MythicRatatoskr and bindProxy SHA-1 match (ESET)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1543.003, T1090.001
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the SHA-1 of the new process image is one of the 13 ESET-published values. in:anycase reproduces the CQL /i match on the hex digits.
// REQUIRES: SentinelOne endpoint process-creation telemetry with the image SHA-1 populated
// TUNING: krbtman.exe is MythicRatatoskr on some hosts and the SOCKS5 server on others; read tgt.process.image.sha1 to tell them apart.
// LOOKBACK: 30d; set with the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An empty result is only meaningful if the readiness test shows tgt.process.image.sha1 populated; an unpopulated hash field returns nothing.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.image.sha1 in:anycase ('D5F9288DAEBF87AE4579945F8DC6CF235B093CFD', 'B69EF0E45B401440C0FDE22046775D0C57E87415', '4E3E6577866E4CE2ED73CA089700AE04230E768F', '69969EEB7E0A3D84C4E70193636FCF934C6AA388', '01855153CA7A33AD5FF36451DE5612DFBA0DD2CA', 'E29AF83A07FB32EB47C28733A9382E766D53F704', '028CA11F3F0D8396043AF7BF756231FC2F50F829', '9085896989947C0919A660352F75F6B233FC645B', 'D7E6A5A46C6ED3510997E91B11E51BE0250FD2A2', '131A371A1E4EE78EC3B2863607C99290EC3B58A6', '09C816697C0C2AFF9B4FF58681558CA30D04C9CD', '8CEB5F8BCDF4995B7164996F1629D682613BB17B', '8CEB5F8BCDF4995B7164996F1429D682613BB17B')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.path, tgt.process.image.sha1, src.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, SHA1
| take 5

// HUNT: MythicRatatoskr and bindProxy SHA-1 match (ESET)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1543.003, T1090.001
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the SHA-1 of the created process is one of the 13 ESET-published values. in~ reproduces the CQL /i match on the hex digits. SHA1 is used because SHA256 is often unpopulated.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) with SHA1 populated
// TUNING: krbtman.exe is MythicRatatoskr on some hosts and the SOCKS5 server on others; read SHA1 to tell them apart.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An empty result is only meaningful if the readiness test shows SHA1 populated.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where SHA1 in~ ("D5F9288DAEBF87AE4579945F8DC6CF235B093CFD", "B69EF0E45B401440C0FDE22046775D0C57E87415", "4E3E6577866E4CE2ED73CA089700AE04230E768F", "69969EEB7E0A3D84C4E70193636FCF934C6AA388", "01855153CA7A33AD5FF36451DE5612DFBA0DD2CA", "E29AF83A07FB32EB47C28733A9382E766D53F704", "028CA11F3F0D8396043AF7BF756231FC2F50F829", "9085896989947C0919A660352F75F6B233FC645B", "D7E6A5A46C6ED3510997E91B11E51BE0250FD2A2", "131A371A1E4EE78EC3B2863607C99290EC3B58A6", "09C816697C0C2AFF9B4FF58681558CA30D04C9CD", "8CEB5F8BCDF4995B7164996F1629D682613BB17B", "8CEB5F8BCDF4995B7164996F1429D682613BB17B")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, SHA1, InitiatingProcessFileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Connections to MythicRatatoskr hardcoded public Yggdrasil peers (IPv4)
// MITRE: T1090.003, T1573
// CONF: medium  FP: medium  COST: low | REQUIRES: outbound network connection telemetry (NetworkConnectIP4)
// TUNING: exclude hosts on an approved Yggdrasil or mesh-networking allowlist. A service-hosted binary in System32 or a user profile that connects here is the high-value case.
// LOOKBACK: 14d (set with the time picker)
#event_simpleName=NetworkConnectIP4
| in(RemoteAddressIP4, values=["37.205.14.171", "109.176.250.101", "65.21.57.122", "95.217.35.92", "51.255.223.60", "51.15.204.214", "62.210.85.80", "23.137.249.65", "78.27.153.163", "193.93.119.42"])
| groupBy([aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], function=[count(as=conns), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)])
| sort(conns, order=desc)

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.time, event.type, endpoint.name, src.process.name, dst.ip.address, dst.port.number

// HUNT: Connections to MythicRatatoskr hardcoded public Yggdrasil peers (IPv4)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1090.003, T1573
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same connection predicate: the remote address is one of the 10 hardcoded Yggdrasil peers, grouped by host, process and peer with a count and first and last seen. The connecting process is src.process.* because this is not a process-creation event.
// REQUIRES: SentinelOne endpoint network telemetry (IP Connect events)
// TUNING: Exclude hosts on an approved Yggdrasil or mesh-networking allowlist. A service-hosted binary in System32 or a user profile that connects here is the high-value case.
// LOOKBACK: 14d; set with the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A peer reached only over the IPv6 overlay is not seen here; Query 7 covers that range.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' dst.ip.address in ('37.205.14.171', '109.176.250.101', '65.21.57.122', '95.217.35.92', '51.255.223.60', '51.15.204.214', '62.210.85.80', '23.137.249.65', '78.27.153.163', '193.93.119.42')
| group conns = count(), first_seen = min(event.time), last_seen = max(event.time) by endpoint.name, src.process.name, dst.ip.address, dst.port.number
| sort -conns
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| take 5

// HUNT: Connections to MythicRatatoskr hardcoded public Yggdrasil peers (IPv4)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1090.003, T1573
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same connection predicate: the remote address is one of the 10 hardcoded Yggdrasil peers, grouped by host, process and peer with a count and first and last seen. The connecting process is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Exclude hosts on an approved Yggdrasil or mesh-networking allowlist. A service-hosted binary in System32 or a user profile that connects here is the high-value case.
// LOOKBACK: 14d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A peer reached only over the IPv6 overlay is not seen here; Query 7 covers that range.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(14d)
| where RemoteIP in ("37.205.14.171", "109.176.250.101", "65.21.57.122", "95.217.35.92", "51.255.223.60", "51.15.204.214", "62.210.85.80", "23.137.249.65", "78.27.153.163", "193.93.119.42")
| summarize Connections = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| sort by Connections desc
| take 200

// HUNT: DNS resolution of MythicRatatoskr hardcoded Yggdrasil peer hostnames
// MITRE: T1090.003, T1071.001
// CONF: medium  FP: medium  COST: low | REQUIRES: DNS request telemetry (DnsRequest)
// TUNING: exclude approved mesh-networking hosts. Prefer hosts where distinctPeers is 2 or more.
// LOOKBACK: 14d (set with the time picker)
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(s2\.i2pd\.xyz|vpn\.ltha\.de|mlupo\.duckdns\.org|ip6\.fvm\.mywire\.org|helium\.avevad\.com|yggdrasil\.neilalexander\.dev|bode\.theender\.net|g\.ygg\.yt|b\.ygg\.yt|n\.ygg\.yt|ygg1\.grin\.hu|srl\.newsdeef\.eu|ygg-nl\.incognet\.io|0\.ygg\.l1qu1d\.net|london\.sabretruth\.org|yggdrasil\.sunsung\.fun|sysop\.link|sto01\.yggdrasil\.hosted-by\.skhron\.eu|ygg\.ace\.ctrl-c\.liu\.se|spain\.magicum\.net|y\.zbin\.eu)$/i
| groupBy([aid, ComputerName], function=[count(DomainName, distinct=true, as=distinctPeers), count(as=lookups), collect([DomainName])])
| sort(distinctPeers, order=desc)

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, event.type, endpoint.name, event.dns.request

// HUNT: DNS resolution of MythicRatatoskr hardcoded Yggdrasil peer hostnames
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1090.003, T1071.001
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: the queried name is, or is a subdomain of, one of the 21 hardcoded Yggdrasil peer hostnames, grouped per host with a distinct-name count. The distinct count is an estimate in SentinelOne where the CQL's is exact.
// REQUIRES: SentinelOne endpoint DNS telemetry (DNS Resolved events)
// TUNING: Exclude approved mesh-networking hosts. Prefer hosts where distinct_peers is 2 or more.
// LOOKBACK: 14d; set with the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL's collected list of queried names has no equivalent aggregate in this query; the pivot is the host and the distinct count.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' event.dns.request matches '(^|\\.)(s2\\.i2pd\\.xyz|vpn\\.ltha\\.de|mlupo\\.duckdns\\.org|ip6\\.fvm\\.mywire\\.org|helium\\.avevad\\.com|yggdrasil\\.neilalexander\\.dev|bode\\.theender\\.net|g\\.ygg\\.yt|b\\.ygg\\.yt|n\\.ygg\\.yt|ygg1\\.grin\\.hu|srl\\.newsdeef\\.eu|ygg-nl\\.incognet\\.io|0\\.ygg\\.l1qu1d\\.net|london\\.sabretruth\\.org|yggdrasil\\.sunsung\\.fun|sysop\\.link|sto01\\.yggdrasil\\.hosted-by\\.skhron\\.eu|ygg\\.ace\\.ctrl-c\\.liu\\.se|spain\\.magicum\\.net|y\\.zbin\\.eu)$'
| group distinct_peers = estimate_distinct(event.dns.request), lookups = count(), first_seen = min(event.time), last_seen = max(event.time) by endpoint.name
| sort -distinct_peers
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, DeviceName, ActionType, AdditionalFields
| take 5

// HUNT: DNS resolution of MythicRatatoskr hardcoded Yggdrasil peer hostnames
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1090.003, T1071.001
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: the queried name is, or is a subdomain of, one of the 21 hardcoded Yggdrasil peer hostnames, grouped per host with a distinct-name count. Defender has no endpoint DNS table, so the name is read from the DnsQueryResponse action's AdditionalFields.
// REQUIRES: Defender for Endpoint DNS action telemetry (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: Exclude approved mesh-networking hosts. Prefer hosts where DistinctPeers is 2 or more.
// LOOKBACK: 14d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: If DnsQueryResponse is not populated for the tenant the query returns nothing; the readiness test shows which AdditionalFields key is present.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(14d)
| where ActionType == "DnsQueryResponse"
| extend QueryName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where QueryName matches regex @"(?i)(^|\.)(s2\.i2pd\.xyz|vpn\.ltha\.de|mlupo\.duckdns\.org|ip6\.fvm\.mywire\.org|helium\.avevad\.com|yggdrasil\.neilalexander\.dev|bode\.theender\.net|g\.ygg\.yt|b\.ygg\.yt|n\.ygg\.yt|ygg1\.grin\.hu|srl\.newsdeef\.eu|ygg-nl\.incognet\.io|0\.ygg\.l1qu1d\.net|london\.sabretruth\.org|yggdrasil\.sunsung\.fun|sysop\.link|sto01\.yggdrasil\.hosted-by\.skhron\.eu|ygg\.ace\.ctrl-c\.liu\.se|spain\.magicum\.net|y\.zbin\.eu)$"
| summarize DistinctPeers = dcount(QueryName), Lookups = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Domains = make_set(QueryName, 25) by DeviceName
| sort by DistinctPeers desc
| take 200

// HUNT: Outbound IPv6 into Yggdrasil 200::/7 (includes the ESET C&C address)
// MITRE: T1090.003, T1573
// CONF: low  FP: low  COST: low | REQUIRES: outbound IPv6 connection telemetry (NetworkConnectIP6)
// NOTE: yggstack keeps overlay traffic in user space, so absence of hits does not clear a host. Use Queries 5, 6 and 8 for the underlay.
// LOOKBACK: 30d (set with the time picker)
#event_simpleName=NetworkConnectIP6
| RemoteAddressIP6=/^0?[23][0-9a-f]{2}:/i
| table([@timestamp, aid, ComputerName, ContextBaseFileName, RemoteAddressIP6, RemotePort])
| sort(@timestamp, order=desc)

event.type = 'IP Connect' dst.ip.address matches ':'
| limit 5
| columns event.time, event.type, dst.ip.address

// HUNT: Outbound IPv6 into Yggdrasil 200::/7 (includes the ESET C&C address)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1090.003, T1573
// CONF: low | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same address predicate: the remote address is in 200::/7, written as a leading 02xx or 03xx group. The connecting process is src.process.* because this is not a process-creation event.
// REQUIRES: SentinelOne endpoint network telemetry (IP Connect events) carrying IPv6 destinations
// TUNING: yggstack keeps overlay traffic in user space, so absence of hits does not clear a host. Use Queries 5, 6 and 8 for the underlay.
// LOOKBACK: 30d; set with the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Overlay traffic handled entirely in user space never reaches the endpoint network stack and is not seen.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' dst.ip.address matches '^0?[23][0-9a-f]{2}:'
| columns event.time, endpoint.name, src.process.name, dst.ip.address, dst.port.number
| sort -event.time
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| where RemoteIP contains ":"
| project Timestamp, RemoteIP
| take 5

// HUNT: Outbound IPv6 into Yggdrasil 200::/7 (includes the ESET C&C address)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1090.003, T1573
// CONF: low | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same address predicate: the remote address is in 200::/7, written as a leading 02xx or 03xx group. The connecting process is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents) carrying IPv6 destinations
// TUNING: yggstack keeps overlay traffic in user space, so absence of hits does not clear a host. Use Queries 5, 6 and 8 for the underlay.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Overlay traffic handled entirely in user space never reaches the endpoint network stack and is not seen.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemoteIP matches regex @"(?i)^0?[23][0-9a-f]{2}:"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| sort by Timestamp desc
| take 200

// HUNT: Masquerade-named MythicRatatoskr or bindProxy process with external connections
// MITRE: T1071.001, T1090.003
// CONF: high  FP: low  COST: low | REQUIRES: outbound network connection telemetry (NetworkConnectIP4)
// LOOKBACK: 14d (set with the time picker)
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^(ieupdate|windowsdefendersvc|krbtman|onedriveliveupdater|nbtresolver|act64)\.exe$/i
| !cidr(RemoteAddressIP4, subnet="10.0.0.0/8")
| !cidr(RemoteAddressIP4, subnet="172.16.0.0/12")
| !cidr(RemoteAddressIP4, subnet="192.168.0.0/16")
| !cidr(RemoteAddressIP4, subnet="127.0.0.0/8")
| groupBy([aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], function=[count(as=conns), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)])
| sort(conns, order=desc)

event.type = 'IP Connect' src.process.name = *
| limit 5
| columns event.time, event.type, endpoint.name, src.process.name, dst.ip.address, dst.port.number

// HUNT: Masquerade-named MythicRatatoskr or bindProxy process with external connections
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1090.003
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same connection predicate: a masquerade-named process connecting to an address outside 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 and 127.0.0.0/8, grouped by host, process and destination. The connecting process is src.process.* because this is not a process-creation event.
// REQUIRES: SentinelOne endpoint network telemetry (IP Connect events)
// TUNING: The masquerade names are specific, so little tuning is expected. Review any legitimate Microsoft binary that shares one of these names by image path and signer.
// LOOKBACK: 14d; set with the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A connection made by a renamed copy of the implant is not seen; Query 4 covers the known hashes.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' src.process.name matches '^(ieupdate|windowsdefendersvc|krbtman|onedriveliveupdater|nbtresolver|act64)\\.exe$'
| filter !(net_ipsubnet(dst.ip.address, '10.0.0.0/8')) and !(net_ipsubnet(dst.ip.address, '172.16.0.0/12')) and !(net_ipsubnet(dst.ip.address, '192.168.0.0/16')) and !(net_ipsubnet(dst.ip.address, '127.0.0.0/8'))
| group conns = count(), first_seen = min(event.time), last_seen = max(event.time) by endpoint.name, src.process.name, dst.ip.address, dst.port.number
| sort -conns
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| take 5

// HUNT: Masquerade-named MythicRatatoskr or bindProxy process with external connections
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1090.003
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same connection predicate: a masquerade-named process connecting to an address outside 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 and 127.0.0.0/8, grouped by host, process and destination. The connecting process is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: The masquerade names are specific, so little tuning is expected. Review any legitimate Microsoft binary that shares one of these names by InitiatingProcessFolderPath and signer.
// LOOKBACK: 14d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A connection made by a renamed copy of the implant is not seen; Query 4 covers the known hashes.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(14d)
| where InitiatingProcessFileName in~ ("ieupdate.exe", "windowsdefendersvc.exe", "krbtman.exe", "onedriveliveupdater.exe", "nbtresolver.exe", "act64.exe")
| where not(ipv4_is_in_range(RemoteIP, "10.0.0.0/8")) and not(ipv4_is_in_range(RemoteIP, "172.16.0.0/12")) and not(ipv4_is_in_range(RemoteIP, "192.168.0.0/16")) and not(ipv4_is_in_range(RemoteIP, "127.0.0.0/8"))
| summarize Connections = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| sort by Connections desc
| take 200

// HUNT: bindProxy SOCKS5 listener on port 33690
// MITRE: T1090.001
// CONF: high  FP: low  COST: low | REQUIRES: listening port telemetry (NetworkListenIP4)
// LOOKBACK: 30d (set with the time picker)
#event_simpleName=NetworkListenIP4
| LocalPort=33690
| table([@timestamp, aid, ComputerName, LocalAddressIP4, LocalPort, ContextBaseFileName])
| sort(@timestamp, order=desc)

event.type = 'IP Listen' src.port.number = *
| limit 5
| columns event.time, event.type, src.port.number, dst.ip.address, dst.port.number

// HUNT: bindProxy SOCKS5 listener on port 33690
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1090.001
// CONF: high | FP: low
// EQUIVALENCE: approximate-analytic - SentinelOne's listen event type is not attested in the field model, so the hunt tests two signals for the same SOCKS5 listener on port 33690: a listen event on that local port, and a loopback connection to it. Either one finds a running bindProxy.
// REQUIRES: SentinelOne endpoint network telemetry (IP Listen and IP Connect events)
// TUNING: Port 33690 is specific to bindProxy in the published reporting; confirm the process on any hit before closing it.
// LOOKBACK: 30d; set with the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: If the tenant records no IP Listen events, only the loopback connection signal can fire.
// VALIDATION LEVEL: static-reviewed
(event.type = 'IP Listen' src.port.number = 33690) or (event.type = 'IP Connect' dst.ip.address = '127.0.0.1' dst.port.number = 33690)
| columns event.time, endpoint.name, event.type, src.process.name, src.ip.address, src.port.number, dst.ip.address, dst.port.number
| sort -event.time
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| where ActionType == "ListeningConnectionCreated"
| project Timestamp, ActionType, LocalPort
| take 5

// HUNT: bindProxy SOCKS5 listener on port 33690
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1090.001
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same listener predicate: a listening-connection record whose local port is 33690. The listening process is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents, ActionType ListeningConnectionCreated)
// TUNING: Port 33690 is specific to bindProxy in the published reporting; confirm the process on any hit before closing it.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: If the tenant records no ListeningConnectionCreated actions the query returns nothing.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where ActionType == "ListeningConnectionCreated" and LocalPort == 33690
| project Timestamp, ReportId, DeviceId, DeviceName, LocalIP, LocalPort, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: MythicRatatoskr shell command (cmd.exe child) and config file handling
// MITRE: T1059.003, T1027.013
// CONF: high  FP: low  COST: low | REQUIRES: process creation with parent and command line (ProcessRollup2)
// LOOKBACK: 30d (set with the time picker)
#event_simpleName=ProcessRollup2
| (FileName=/^cmd\.exe$/i and ParentBaseFileName=/^(ieupdate|windowsdefendersvc|krbtman|onedriveliveupdater|nbtresolver|act64)\.exe$/i) or CommandLine=/[\\\/]\.(updatecache|crond)\b/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, event.type, tgt.process.name, src.process.name, tgt.process.cmdline

// HUNT: MythicRatatoskr shell command (cmd.exe child) and config file handling
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.003, T1027.013
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: cmd.exe whose creator is a masquerade binary, or any command line naming a hidden .updatecache or .crond file after a path separator. The new process is tgt.process.* and its creator is src.process.* because this is a Process Creation event.
// REQUIRES: SentinelOne endpoint process-creation telemetry (Process Creation events)
// TUNING: Both branches are specific to this implant, so little tuning is expected. The command-line branch can also match an analyst listing the hidden files.
// LOOKBACK: 30d; set with the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A shell spawned through a path that does not create a cmd.exe process is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' ((tgt.process.name matches '^cmd\\.exe$' and src.process.name matches '^(ieupdate|windowsdefendersvc|krbtman|onedriveliveupdater|nbtresolver|act64)\\.exe$') or tgt.process.cmdline matches '[\\\\/]\\.(updatecache|crond)\\b')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, src.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, InitiatingProcessFileName, ProcessCommandLine
| take 5

// HUNT: MythicRatatoskr shell command (cmd.exe child) and config file handling
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.003, T1027.013
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: cmd.exe whose initiating process is a masquerade binary, or any command line naming a hidden .updatecache or .crond file after a path separator. The parent is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Both branches are specific to this implant, so little tuning is expected. The command-line branch can also match an analyst listing the hidden files.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A shell spawned through a path that does not create a cmd.exe process is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where (FileName =~ "cmd.exe" and InitiatingProcessFileName in~ ("ieupdate.exe", "windowsdefendersvc.exe", "krbtman.exe", "onedriveliveupdater.exe", "nbtresolver.exe", "act64.exe")) or ProcessCommandLine matches regex @"(?i)[\\/]\.(updatecache|crond)\b"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, InitiatingProcessFileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: SDelete executed (Sandworm data-wiping stage)
// MITRE: T1485, T1484.001
// CONF: medium  FP: medium  COST: low | REQUIRES: process creation with parent and command line (ProcessRollup2)
// TUNING: exclude named secure-erase or decommissioning hosts by ComputerName. Never exclude by file hash, because attackers rename and the tool is the legitimate Sysinternals binary.
// LOOKBACK: 90d (set with the time picker)
#event_simpleName=ProcessRollup2
| FileName=/^sdelete(64|64a)?\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, ParentBaseFileName, CommandLine])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, event.type, tgt.process.name

// HUNT: SDelete executed (Sandworm data-wiping stage)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1485, T1484.001
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the new process is sdelete.exe, sdelete64.exe or sdelete64a.exe. The new process is tgt.process.* and its creator is src.process.* because this is a Process Creation event.
// REQUIRES: SentinelOne endpoint process-creation telemetry (Process Creation events)
// TUNING: Exclude named secure-erase or decommissioning hosts by endpoint.name. Never exclude by file hash, because attackers rename and the tool is the legitimate Sysinternals binary.
// LOOKBACK: 90d on the CQL tab; set the console picker to the tenant's retention
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed copy of the tool is not matched by name.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name matches '^sdelete(64|64a)?\\.exe$'
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.path, src.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName
| take 5

// HUNT: SDelete executed (Sandworm data-wiping stage)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1485, T1484.001
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the created process is sdelete.exe, sdelete64.exe or sdelete64a.exe. The parent is InitiatingProcessFileName. Advanced Hunting keeps 30 days, so the window is shorter than the CQL's 90.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude named secure-erase or decommissioning hosts by DeviceName. Never exclude by file hash, because attackers rename and the tool is the legitimate Sysinternals binary.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting retains 30 days, so executions older than that are only on the CQL tab (90d). A renamed copy of the tool is not matched by name.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("sdelete.exe", "sdelete64.exe", "sdelete64a.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: SDelete executed across many hosts with one command line (GPO-deployed wiper)
// MITRE: T1485, T1484.001
// CONF: high  FP: low  COST: medium | REQUIRES: process creation with command line (ProcessRollup2)
// LOOKBACK: 24h (set with the time picker; widen to 7d to catch a staged rollout)
#event_simpleName=ProcessRollup2
| FileName=/^sdelete(64|64a)?\.exe$/i
| groupBy([FileName, CommandLine], function=[count(aid, distinct=true, as=hosts), count(as=execs), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen), collect([ParentBaseFileName])])
| hosts >= 5
| sort(hosts, order=desc)

event.type = 'Process Creation' agent.uuid = *
| limit 5
| columns event.time, event.type, agent.uuid, tgt.process.name, tgt.process.cmdline

// HUNT: SDelete executed across many hosts with one command line (GPO-deployed wiper)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1485, T1484.001
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same fan-out predicate: SDelete process creations grouped by tool name and exact command line, kept when five or more distinct hosts ran the same line. The host count is an estimate in SentinelOne where the CQL's is exact.
// REQUIRES: SentinelOne endpoint process-creation telemetry (Process Creation events)
// TUNING: Widen the console time picker to 7 days to catch a staged rollout. The threshold of 5 hosts is the CQL's.
// LOOKBACK: 24h; set with the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The grouping is by exact command line, so a rollout that varies the arguments per host splits across rows.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name matches '^sdelete(64|64a)?\\.exe$'
| group hosts = estimate_distinct(agent.uuid), execs = count(), first_seen = min(event.time), last_seen = max(event.time), parent = any(src.process.name) by tgt.process.name, tgt.process.cmdline
| filter hosts >= 5
| sort -hosts
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceId, FileName, ProcessCommandLine
| take 5

// HUNT: SDelete executed across many hosts with one command line (GPO-deployed wiper)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1485, T1484.001
// CONF: high | FP: low
// EQUIVALENCE: equivalent-with-schema-assumptions - Same fan-out predicate: SDelete process creations grouped by tool name and exact command line, kept when five or more distinct devices ran the same line. dcount is an estimate where the CQL's count is exact.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Widen the window to 7d to catch a staged rollout. The threshold of 5 hosts is the CQL's.
// LOOKBACK: 24h
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The grouping is by exact command line, so a rollout that varies the arguments per host splits across rows.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(24h)
| where FileName in~ ("sdelete.exe", "sdelete64.exe", "sdelete64a.exe")
| summarize Hosts = dcount(DeviceId), Execs = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Parents = make_set(InitiatingProcessFileName, 20) by FileName, ProcessCommandLine
| where Hosts >= 5
| sort by Hosts desc
| take 200

// HUNT: UAC-0099 delivery chain artifacts for this intrusion (pdfopentask, temporarydoc.txt, UpdateMonitor)
// MITRE: T1053.005, T1547.001, T1059.001
// CONF: high  FP: low  COST: low | REQUIRES: scheduled task, process creation and autostart registry telemetry (ScheduledTaskRegistered, ProcessRollup2, AsepValueUpdate)
// LOOKBACK: 90d (set with the time picker)
#event_simpleName=/^(ScheduledTaskRegistered|ProcessRollup2|AsepValueUpdate)$/
| (TaskName=/(^|\\)pdfopentask$/i or CommandLine=/temporarydoc\.txt/i or (RegValueName=/^UpdateMonitor$/i and RegObjectName=/\\CurrentVersion\\Run$/i))
| table([@timestamp, aid, ComputerName, UserName, #event_simpleName, TaskName, CommandLine, RegObjectName, RegValueName, RegStringValue])
| sort(@timestamp, order=desc)

event.type = 'Registry Value Modified' registry.keyPath = *
| limit 5
| columns event.time, event.type, tgt.process.cmdline, registry.keyPath, registry.valueName

// HUNT: UAC-0099 delivery chain artifacts for this intrusion (pdfopentask, temporarydoc.txt, UpdateMonitor)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1053.005, T1547.001, T1059.001
// CONF: high | FP: low
// EQUIVALENCE: approximate-analytic - SentinelOne has no attested scheduled-task registration event, so the task is found through the command line that creates or runs it. The temporarydoc.txt command-line branch and the UpdateMonitor Run value branch match the CQL; the pdfopentask task name is matched in a process command line instead of a task-registration record.
// REQUIRES: SentinelOne endpoint process-creation and registry telemetry (Process Creation and Registry Value Modified events)
// TUNING: All three branches are specific to this intrusion, so little tuning is expected.
// LOOKBACK: 90d on the CQL tab; set the console picker to the tenant's retention
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A task registered by an API call that never appears in a process command line is not seen; the CQL's task-registration record is not reproduced.
// VALIDATION LEVEL: static-reviewed
(event.type = 'Process Creation' (tgt.process.cmdline contains 'temporarydoc.txt' or tgt.process.cmdline contains 'pdfopentask')) or (event.type = 'Registry Value Modified' registry.valueName matches '^UpdateMonitor$' registry.keyPath matches '\\\\CurrentVersion\\\\Run(\\\\UpdateMonitor)?$')
| columns event.time, endpoint.name, event.type, src.process.user, tgt.process.cmdline, registry.keyPath, registry.valueName, registry.value
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: UAC-0099 delivery chain artifacts for this intrusion (pdfopentask, temporarydoc.txt, UpdateMonitor)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1053.005, T1547.001, T1059.001
// CONF: high | FP: low
// EQUIVALENCE: telemetry-gap - A partial pivot on the command-line branch. The table is DeviceProcessEvents, which sees the temporarydoc.txt and pdfopentask names on a command line, but the UpdateMonitor Run value needs DeviceRegistryEvents and the task-registration record has no table here, and one query reads only one table.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Pair with a DeviceRegistryEvents hunt for a Run value named UpdateMonitor to cover the third branch.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The UpdateMonitor Run value under CurrentVersion\Run is not covered; that needs DeviceRegistryEvents. The scheduled-task registration record is not covered. Advanced Hunting retains 30 days, so older activity is only on the CQL tab (90d).
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine contains "temporarydoc.txt" or ProcessCommandLine contains "pdfopentask"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: Delivery-chain domains for this intrusion (MATCHWOK C&C and staging host)
// MITRE: T1071.001, T1105
// CONF: medium  FP: medium  COST: low | REQUIRES: DNS request telemetry (DnsRequest)
// TUNING: for egyptanimals.com, pivot to the process that resolved it (Query 13 for the host) and discount plain browser lookups.
// LOOKBACK: 90d (set with the time picker)
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(uztickets\.com|egyptanimals\.com)$/i
| table([@timestamp, aid, ComputerName, UserName, DomainName, ContextProcessId])
| sort(@timestamp, order=desc)

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, event.type, event.dns.request

// HUNT: Delivery-chain domains for this intrusion (MATCHWOK C&C and staging host)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1105
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: the queried name is, or is a subdomain of, uztickets.com or egyptanimals.com. The resolving process is src.process.* because this is not a process-creation event.
// REQUIRES: SentinelOne endpoint DNS telemetry (DNS Resolved events)
// TUNING: For egyptanimals.com, pivot to the process that resolved it (src.process.name here, Query 13 for the host) and discount plain browser lookups.
// LOOKBACK: 90d on the CQL tab; set the console picker to the tenant's retention
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A lookup that never reaches the endpoint resolver, such as one over DNS-over-HTTPS inside a browser, is not seen.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' event.dns.request matches '(^|\\.)(uztickets\\.com|egyptanimals\\.com)$'
| columns event.time, endpoint.name, src.process.user, event.dns.request, src.process.name
| sort -event.time
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: Delivery-chain domains for this intrusion (MATCHWOK C&C and staging host)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1105
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: the queried name is, or is a subdomain of, uztickets.com or egyptanimals.com. Defender has no endpoint DNS table, so the name is read from the DnsQueryResponse action's AdditionalFields.
// REQUIRES: Defender for Endpoint DNS action telemetry (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: For egyptanimals.com, pivot to the process that resolved it (InitiatingProcessFileName here, Query 13 for the host) and discount plain browser lookups.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting retains 30 days, so lookups older than that are only on the CQL tab (90d). If DnsQueryResponse is not populated for the tenant the query returns nothing.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| extend QueryName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where QueryName matches regex @"(?i)(^|\.)(uztickets\.com|egyptanimals\.com)$"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, QueryName, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: OpenSSH SFTP server used to move implants laterally
// MITRE: T1021.004, T1570
// CONF: medium  FP: medium  COST: low | REQUIRES: process creation with parent (ProcessRollup2)
// TUNING: exclude hosts with an approved OpenSSH Server role by ComputerName. Pivot on Query 2 for binaries written within 15 minutes of the hit.
// LOOKBACK: 30d (set with the time picker)
#event_simpleName=ProcessRollup2
| FileName=/^(sftp-server|sshd)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, ParentBaseFileName, CommandLine])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, event.type, tgt.process.name

// HUNT: OpenSSH SFTP server used to move implants laterally
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1021.004, T1570
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the new process is sftp-server.exe or sshd.exe. The new process is tgt.process.* and its creator is src.process.* because this is a Process Creation event.
// REQUIRES: SentinelOne endpoint process-creation telemetry (Process Creation events)
// TUNING: Exclude hosts with an approved OpenSSH Server role by endpoint.name. Pivot on Query 2 for binaries written within 15 minutes of the hit.
// LOOKBACK: 30d; set with the console time picker
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An SFTP server renamed before launch is not matched by name.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name matches '^(sftp-server|sshd)\\.exe$'
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.path, src.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName
| take 5

// HUNT: OpenSSH SFTP server used to move implants laterally
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1021.004, T1570
// CONF: medium | FP: medium
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the created process is sftp-server.exe or sshd.exe. The parent is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude hosts with an approved OpenSSH Server role by DeviceName. Pivot on Query 2 for binaries written within 15 minutes of the hit.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An SFTP server renamed before launch is not matched by name.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("sftp-server.exe", "sshd.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName, ProcessCommandLine
| sort by Timestamp desc
| take 200