N-able N-central Multi-CVE Takeover — September 2026 Refresh

Looks for: a Windows service whose display name or image path references cloudflared. Accomplishes: preserves the strongest service-persistence hunt from the prior pack and exposes tunnel installation on a downstream endpoint after RMM access.

Trace: H01 · A01

// HUNT: Cloudflared service registration on an N-central-managed endpoint
// HYPOTHESIS: H01
// USE: alert-candidate
// MITRE: T1543.003, T1572
// CONF: high
// FP: low
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: CreateService; ServiceDisplayName, ServiceImagePath, ComputerName, UserName, aid
// FALSE POSITIVES: organizations that legitimately run Cloudflare Tunnel or Zero Trust connectors
// TUNING: exclude only owner-approved connector hosts by ComputerName after path and change review
// VALIDATION: STATIC-ONLY
#event_simpleName = /^CreateService$/
| ServiceDisplayName = /cloudflared/i or ServiceImagePath = /cloudflared/i
| table([@timestamp, aid, ComputerName, UserName, ServiceDisplayName, ServiceImagePath])
| sort(@timestamp, order=desc, limit=200)

Looks for: a PE named svchost.exe written beneath a user's Documents, Downloads, Desktop, or Public path. Accomplishes: retains the prior pack's high-fidelity masquerading-file signal before execution while preserving writer context.

Trace: H02 · A02

// HUNT: PE named svchost.exe written into a user profile directory
// HYPOTHESIS: H02
// USE: alert-candidate
// MITRE: T1036.005
// CONF: high
// FP: low
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: PeFileWritten or NewExecutableWritten; TargetFileName, ContextBaseFileName, aid
// FALSE POSITIVES: malware-analysis or incident-response systems staging a known sample
// TUNING: exclude only named analysis hosts and exact case windows; do not widen the path rule
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(PeFileWritten|NewExecutableWritten)$/
| TargetFileName = /\\Users\\[^\\]+\\(Documents|Downloads|Desktop|Public)\\/i
| TargetFileName = /\\svchost\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, TargetFileName, ContextBaseFileName])
| sort(@timestamp, order=desc, limit=200)

Looks for: svchost.exe executing from a user-writable profile path rather than a Windows system directory. Accomplishes: keeps the prior pack's execution-side confirmation and returns lineage, command line, and hash for incident scoping.

Trace: H02 · A03

// HUNT: Masquerading svchost.exe running outside System32
// HYPOTHESIS: H02
// USE: alert-candidate
// MITRE: T1036.005
// CONF: high
// FP: low
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2; FileName, ImageFileName, CommandLine, SHA256HashData, aid
// FALSE POSITIVES: authorized malware-analysis systems
// TUNING: exclude only isolated research assets with case ownership and a bounded window
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName = /^svchost\.exe$/i
| ImageFileName = /\\Users\\[^\\]+\\(Documents|Downloads|Desktop|AppData|Public)\\/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])
| sort(@timestamp, order=desc, limit=200)

Looks for: cloudflared execution or command lines with tunnel run, token, or URL arguments. Accomplishes: retains the process-side tunnel hunt and identifies sanctioned-versus-unapproved connector context without relying on a listening port.

Trace: H01 · hunt-only

// HUNT: cloudflared execution or tunnel arguments on a managed endpoint
// HYPOTHESIS: H01
// USE: hunt
// MITRE: T1572, T1219
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2; FileName, ImageFileName, CommandLine, ParentBaseFileName, aid
// FALSE POSITIVES: developer quick tunnels and sanctioned Cloudflare Zero Trust connectors
// TUNING: exclude approved connector hosts and signed paths; never exclude solely by attacker-controlled parent
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName = /^cloudflared(\.exe)?$/i or CommandLine = /\btunnel\s+(run|--token|--url)\b/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])
| sort(@timestamp, order=desc, limit=300)

Looks for: IPv4 connections involving the six addresses retained from the prior incident pack. Accomplishes: preserves historical network pivots but keeps the two shared VPN exits in a same-host corroboration workflow.

Trace: H03 · hunt-only

// HUNT: Endpoint traffic to retained N-able incident addresses
// HYPOTHESIS: H03
// USE: hunt
// MITRE: T1071, T1090
// CONF: medium
// FP: high
// COST: medium
// TIMEFRAME: 7d — bounded analyst review window
// REQUIRES: NetworkConnectIP4 or NetworkReceiveAcceptIP4; RemoteAddressIP4, ContextBaseFileName, aid
// FALSE POSITIVES: commercial VPN use, shared hosting, research, and historical telemetry
// TUNING: require Q01-Q04 or unexplained platform activity before incident escalation
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(NetworkConnectIP4|NetworkReceiveAcceptIP4)$/
| in(RemoteAddressIP4, values=["173.249.252.200", "87.249.138.34", "37.19.210.32", "68.235.46.214", "37.153.90.88", "92.118.112.181"])
| table([@timestamp, aid, ComputerName, UserName, LocalAddressIP4, RemoteAddressIP4, RemotePort, ContextBaseFileName])
| sort(@timestamp, order=desc, limit=300)

Looks for: DNS requests to the three relay hostnames retained from the prior N-central incident. Accomplishes: preserves the historical domain sweep while forcing ownership, resolver, and same-host checks before escalation.

Trace: H04 · hunt-only

// HUNT: DNS resolution of retained incident relay hostnames
// HYPOTHESIS: H04
// USE: hunt
// MITRE: T1071.001
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: DnsRequest or SuspiciousDnsRequest; DomainName, ContextBaseFileName, aid
// FALSE POSITIVES: security research, reassigned hosts, or legitimate Synology QuickConnect use
// TUNING: scope to the exact hostnames and correlate with endpoint/RMM evidence
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName = /(^|\.)(mousears\.synology\.me|wagoosh\.direct\.quickconnect\.to|who-ripped-one\.direct\.quickconnect\.to)$/i
| table([@timestamp, aid, ComputerName, UserName, DomainName, ContextBaseFileName])
| sort(@timestamp, order=desc, limit=300)

Looks for: clustered discovery utilities and process-enumeration commands on the same host and user. Accomplishes: retains the prior low-fidelity post-access pivot for use only inside a known anomalous Take Control window.

Trace: H05 · hunt-only

// HUNT: Discovery-utility burst scoped to a suspect remote-support window
// HYPOTHESIS: H05
// USE: hunt
// MITRE: T1057
// CONF: low
// FP: high
// COST: medium
// TIMEFRAME: 7d — bounded analyst review window
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2; FileName, CommandLine, ComputerName, UserName, aid
// FALSE POSITIVES: RMM inventory, monitoring, backup preflight, and help-desk scripts
// TUNING: set the suspect host/time window first and exclude documented service accounts
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName = /^(tasklist|qprocess|quser|whoami|systeminfo|nltest|hostname)\.exe$/i or CommandLine = /get-process\b|win32_process/i
| groupBy([aid, ComputerName, UserName], function=[count(as=Hits), collect(FileName), collect(CommandLine)], limit=200)
| sort(Hits, order=desc, limit=100)
| table([ComputerName, UserName, Hits, FileName, CommandLine])

Looks for: service creation whose binary path points into Users, ProgramData, Temp, AppData, or Public. Accomplishes: retains the broad persistence backstop for payloads that change names while keeping vendor updater baselining explicit.

Trace: H06 · hunt-only

// HUNT: New service whose image path sits in a user-writable directory
// HYPOTHESIS: H06
// USE: hunt
// MITRE: T1543.003
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: CreateService; ServiceDisplayName, ServiceImagePath, ComputerName, aid
// FALSE POSITIVES: per-user updaters and deployment agents that legitimately stage services
// TUNING: baseline named vendor services; keep Users, AppData, and Temp paths high priority
// VALIDATION: STATIC-ONLY
#event_simpleName = /^CreateService$/
| ServiceImagePath = /\\(Users|ProgramData|Temp|AppData|Public)\\/i
| table([@timestamp, aid, ComputerName, UserName, ServiceDisplayName, ServiceImagePath])
| sort(@timestamp, order=desc, limit=300)

Looks for: IPv4 network sessions whose process context is cloudflared. Accomplishes: retains the tunnel-egress view and lets analysts compare destination, port, host ownership, and approved connector inventory.

Trace: H01 · hunt-only

// HUNT: Network sessions initiated by a cloudflared process
// HYPOTHESIS: H01
// USE: hunt
// MITRE: T1572, T1102
// CONF: high
// FP: medium
// COST: medium
// TIMEFRAME: 7d — bounded analyst review window
// REQUIRES: NetworkConnectIP4; ContextBaseFileName, RemoteAddressIP4, RemotePort, aid
// FALSE POSITIVES: approved Cloudflare Zero Trust connectors
// TUNING: exclude only owner-approved connector hosts and compare with Q01/Q04
// VALIDATION: STATIC-ONLY
#event_simpleName = /^NetworkConnectIP4$/
| ContextBaseFileName = /^cloudflared(\.exe)?$/i
| groupBy([aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], function=count(as=Hits), limit=500)
| sort(Hits, order=desc, limit=200)
| table([ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort, Hits])