NIK C2: AI-Enabled Command-and-Control Framework

// HUNT: NIK C2 C2 domain resolution
// MITRE: T1071.001, T1573.001
// CONF: high  FP: low  COST: low | REQUIRES: DnsRequest (DomainName, ContextProcessId)
// FALSE POSITIVES: none expected. Malware sandboxes and research hosts that detonate samples will also resolve it.
// LOOKBACK: 90d (set in the time picker)
#event_simpleName=DnsRequest
| DomainName=/(^|\.)total-sitevv\.lol$/i
| groupBy([aid, ComputerName, DomainName], function=[count(as=Lookups), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen), collect(ContextProcessId, limit=10)], limit=1000)
| sort(LastSeen, order=desc, limit=1000)

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, event.type, event.dns.request

// HUNT: NIK C2 C2 domain resolution
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1573.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected. Malware sandboxes and research hosts that detonate samples will also resolve it.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS-resolution predicate: the exact apex or any subdomain of the C2 domain, grouped per host with a count and first and last seen. The DNS request field name is the pySigma-attested one.
// REQUIRES: SentinelOne Deep Visibility DNS Resolved events
// TUNING: None expected. Sandboxes and research hosts that detonate samples will also resolve the domain.
// LOOKBACK: 90d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The querying process id is not collected as it is on the CQL tab.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' (event.dns.request in:anycase ('total-sitevv.lol') or event.dns.request matches '^.*\\.total-sitevv\\.lol$')
| group lookups=count(), first_seen=min(event.time), last_seen=max(event.time) by agent.uuid, endpoint.name, event.dns.request
| sort -last_seen
| limit 1000

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: NIK C2 C2 domain resolution
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1573.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected. Malware sandboxes and research hosts that detonate samples will also resolve it.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS-resolution predicate on the DnsQueryResponse action of DeviceEvents, with the name read from AdditionalFields. Advanced Hunting keeps 30 days, the CQL covers 90.
// REQUIRES: Defender for Endpoint network telemetry with DNS response events (DeviceEvents)
// TUNING: None expected. Sandboxes and research hosts that detonate samples will also resolve the domain.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting retains 30 days, so lookups from days 31 to 90 are visible only on the CQL tab. The querying process id is not collected.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where DnsName =~ "total-sitevv.lol" or DnsName endswith ".total-sitevv.lol"
| summarize Lookups = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName, DnsName
| sort by LastSeen desc
| take 1000

// HUNT: NIK C2 C2 IP connection
// MITRE: T1071.001, T1041
// CONF: high  FP: low  COST: low | REQUIRES: NetworkConnectIP4 (RemoteAddressIP4, RemotePort)
// FALSE POSITIVES: none expected. Address reuse after the operator abandons it is possible; check the first-seen date against the report (2026-10-29).
// LOOKBACK: 90d (set in the time picker)
#event_simpleName=NetworkConnectIP4
| RemoteAddressIP4=/^(87\.120\.196\.120|2\.26\.51\.12)$/
| groupBy([aid, ComputerName, RemoteAddressIP4, RemotePort], function=[count(as=Connections), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen), collect(ContextProcessId, limit=10)], limit=1000)
| sort(LastSeen, order=desc, limit=1000)

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.time, event.type, dst.ip.address, dst.port.number

// HUNT: NIK C2 C2 IP connection
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1041
// CONF: high | FP: low
// FALSE POSITIVES: none expected. Address reuse after the operator abandons it is possible; check the first-seen date against the report (2026-10-29).
// EQUIVALENCE: equivalent-with-schema-assumptions - Same outbound-connection predicate on the two C2 addresses, grouped per host and port with a count and first and last seen.
// REQUIRES: SentinelOne Deep Visibility IP Connect events
// TUNING: None expected. Address reuse after the operator abandons it is possible; check the first-seen date against the report.
// LOOKBACK: 90d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The connecting process id is not collected as it is on the CQL tab.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' dst.ip.address in ('87.120.196.120', '2.26.51.12')
| group connections=count(), first_seen=min(event.time), last_seen=max(event.time) by agent.uuid, endpoint.name, dst.ip.address, dst.port.number
| sort -last_seen
| limit 1000

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, RemoteIP, RemotePort
| take 5

// HUNT: NIK C2 C2 IP connection
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1041
// CONF: high | FP: low
// FALSE POSITIVES: none expected. Address reuse after the operator abandons it is possible; check the first-seen date against the report (2026-10-29).
// EQUIVALENCE: equivalent-with-schema-assumptions - Same outbound-connection predicate on DeviceNetworkEvents, grouped per host and port. Advanced Hunting keeps 30 days, the CQL covers 90.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: None expected. Address reuse after the operator abandons it is possible; check the first-seen date against the report.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting retains 30 days, so connections from days 31 to 90 are visible only on the CQL tab. The connecting process id is not collected.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemoteIP in ("87.120.196.120", "2.26.51.12")
| summarize Connections = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName, RemoteIP, RemotePort
| sort by LastSeen desc
| take 1000

// HUNT: NIK C2 implant SHA-256 match
// MITRE: T1204.002, T1036.005
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2, PeFileWritten, NewExecutableWritten (SHA256HashData)
// FALSE POSITIVES: none expected. Analysis hosts that store samples will match on write events.
// LOOKBACK: 90d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| SHA256HashData=/^(ae38f1181c9dd0db7224d6023e335eb2cdabb0f441906d14ffba8602b7abca3c|6583eb22ca554e749b647d68ae76f7279a8dc538196ebde1412669357a027de5|30817712277bba54e4cb8640f4005aad35f5172f88cf046aea545d029e12ccba|1fee4cd8d3560e6c60ba50451860adf6e705f26fd3fe1c1ccc058f4e8b13073a|bf83345ca66bdc4bd45ade608a06361d18927dd80351e9a1d8cbe8eda5d78402|99573a79f393299049216237d0d23761d67f6a8507a7a0cfe17cb30837f68f00|5d25efba2119f52d08214a590fedb45a5c9fe5e2850fd87e7bca24c92745e6d1|2a01056369cc691f5bed6bd2654930a81d1bc240a568a0d5b209aceef3b5c9c9)$/i
| groupBy([aid, ComputerName, SHA256HashData, FileName], function=[count(as=Events), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=1000)
| sort(LastSeen, order=desc, limit=1000)

tgt.process.image.sha256 = * or tgt.file.sha256 = *
| limit 5
| columns event.time, tgt.process.image.sha256, tgt.file.sha256

// HUNT: NIK C2 implant SHA-256 match
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.002, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected. Analysis hosts that store samples will match on write events.
// EQUIVALENCE: approximate-analytic - Matches the eight SHA-256 values on the launched process image and on the written file, which covers the CQL's process-start and file-write events. Rows are listed, not grouped, and only Process Creation populates the process hash.
// REQUIRES: SentinelOne Deep Visibility Process Creation and File Creation events with SHA-256 populated
// TUNING: None expected. Analysis hosts that store samples will match on file events.
// LOOKBACK: 90d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Rows are not grouped per host and hash as on the CQL tab. Hash population varies by event type and tenant.
// VALIDATION LEVEL: static-reviewed
tgt.process.image.sha256 in:anycase ('ae38f1181c9dd0db7224d6023e335eb2cdabb0f441906d14ffba8602b7abca3c', '6583eb22ca554e749b647d68ae76f7279a8dc538196ebde1412669357a027de5', '30817712277bba54e4cb8640f4005aad35f5172f88cf046aea545d029e12ccba', '1fee4cd8d3560e6c60ba50451860adf6e705f26fd3fe1c1ccc058f4e8b13073a', 'bf83345ca66bdc4bd45ade608a06361d18927dd80351e9a1d8cbe8eda5d78402', '99573a79f393299049216237d0d23761d67f6a8507a7a0cfe17cb30837f68f00', '5d25efba2119f52d08214a590fedb45a5c9fe5e2850fd87e7bca24c92745e6d1', '2a01056369cc691f5bed6bd2654930a81d1bc240a568a0d5b209aceef3b5c9c9') or tgt.file.sha256 in:anycase ('ae38f1181c9dd0db7224d6023e335eb2cdabb0f441906d14ffba8602b7abca3c', '6583eb22ca554e749b647d68ae76f7279a8dc538196ebde1412669357a027de5', '30817712277bba54e4cb8640f4005aad35f5172f88cf046aea545d029e12ccba', '1fee4cd8d3560e6c60ba50451860adf6e705f26fd3fe1c1ccc058f4e8b13073a', 'bf83345ca66bdc4bd45ade608a06361d18927dd80351e9a1d8cbe8eda5d78402', '99573a79f393299049216237d0d23761d67f6a8507a7a0cfe17cb30837f68f00', '5d25efba2119f52d08214a590fedb45a5c9fe5e2850fd87e7bca24c92745e6d1', '2a01056369cc691f5bed6bd2654930a81d1bc240a568a0d5b209aceef3b5c9c9')
| columns event.time, event.type, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.sha256, tgt.file.path, tgt.file.sha256
| sort -event.time
| limit 1000

DeviceFileEvents
| where Timestamp > ago(1d)
| where isnotempty(SHA256)
| project Timestamp, FileName, SHA256
| take 5

// HUNT: NIK C2 implant SHA-256 match
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.002, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected. Analysis hosts that store samples will match on write events.
// EQUIVALENCE: telemetry-gap - Partial pivot on written files only: DeviceFileEvents carries the SHA-256, but the process-start half of the CQL needs DeviceProcessEvents, where SHA256 is usually unpopulated, and a query reads one table.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents) with SHA256 populated
// TUNING: None expected. Analysis hosts that store samples will match on write events.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Process launches are not covered: DeviceProcessEvents is a second table and its SHA256 is usually unpopulated. Advanced Hunting retains 30 days, so hits from days 31 to 90 are visible only on the CQL tab.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where SHA256 in~ ("ae38f1181c9dd0db7224d6023e335eb2cdabb0f441906d14ffba8602b7abca3c", "6583eb22ca554e749b647d68ae76f7279a8dc538196ebde1412669357a027de5", "30817712277bba54e4cb8640f4005aad35f5172f88cf046aea545d029e12ccba", "1fee4cd8d3560e6c60ba50451860adf6e705f26fd3fe1c1ccc058f4e8b13073a", "bf83345ca66bdc4bd45ade608a06361d18927dd80351e9a1d8cbe8eda5d78402", "99573a79f393299049216237d0d23761d67f6a8507a7a0cfe17cb30837f68f00", "5d25efba2119f52d08214a590fedb45a5c9fe5e2850fd87e7bca24c92745e6d1", "2a01056369cc691f5bed6bd2654930a81d1bc240a568a0d5b209aceef3b5c9c9")
| project Timestamp, ReportId, DeviceId, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessAccountName
| sort by Timestamp desc
| take 1000

// HUNT: NIK C2 screen-lock launch via mshta and lock_start.bat
// MITRE: T1218.005, T1059.003, T1491.001
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 (FileName, CommandLine, ParentBaseFileName)
// FALSE POSITIVES: near none. A kiosk or lock-screen product that uses the same two file names would match; confirm the parent process.
// LOOKBACK: 30d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(mshta|cmd)\.exe$/i
| CommandLine=/(lock_screen\.html|lock_start\.bat)/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, ImageFileName], limit=200)

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.cmdline

// HUNT: NIK C2 screen-lock launch via mshta and lock_start.bat
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1218.005, T1059.003, T1491.001
// CONF: high | FP: low
// FALSE POSITIVES: near none. A kiosk or lock-screen product that uses the same two file names would match; confirm the parent process.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: mshta or cmd whose command line names lock_screen.html or lock_start.bat. The created process is tgt.process.* and its creator src.process.*.
// REQUIRES: SentinelOne Deep Visibility Process Creation events
// TUNING: A kiosk or lock-screen product using the same file names would match; confirm the creating process in src.process.name.
// LOOKBACK: 30d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('mshta.exe', 'cmd.exe') (tgt.process.cmdline contains 'lock_screen.html' or tgt.process.cmdline contains 'lock_start.bat')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name, tgt.process.image.path
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: NIK C2 screen-lock launch via mshta and lock_start.bat
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1218.005, T1059.003, T1491.001
// CONF: high | FP: low
// FALSE POSITIVES: near none. A kiosk or lock-screen product that uses the same two file names would match; confirm the parent process.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on DeviceProcessEvents. The parent is InitiatingProcessFileName; contains is case-insensitive, matching the CQL intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: A kiosk or lock-screen product using the same file names would match; confirm the creating process.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("mshta.exe", "cmd.exe")
| where ProcessCommandLine contains "lock_screen.html" or ProcessCommandLine contains "lock_start.bat"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: NIK C2 SystemLock autostart value
// MITRE: T1547.001
// CONF: high  FP: low  COST: low | REQUIRES: AsepValueUpdate, RegGenericValueUpdate (RegValueName, RegObjectName, RegStringValue)
// FALSE POSITIVES: low. A product that names its own Run value SystemLock would match; check RegStringValue for lock_start.bat.
// LOOKBACK: 30d (set in the time picker)
#event_simpleName=/^(AsepValueUpdate|RegGenericValueUpdate)$/
| RegValueName=/^SystemLock$/i
| table([@timestamp, aid, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, ContextBaseFileName], limit=200)

event.type = 'Registry Value Modified' registry.valueName = *
| limit 5
| columns event.time, event.type, registry.valueName

// HUNT: NIK C2 SystemLock autostart value
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1547.001
// CONF: high | FP: low
// FALSE POSITIVES: low. A product that names its own Run value SystemLock would match; check RegStringValue for lock_start.bat.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same registry-value predicate: a value named SystemLock was set. On a registry event the writer is src.process.*.
// REQUIRES: SentinelOne Deep Visibility Registry Value Modified events
// TUNING: A product that names its own Run value SystemLock would match; check registry.value for lock_start.bat.
// LOOKBACK: 30d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The lock_start.bat check on the value data is a manual triage step, not part of the filter.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified' registry.valueName in:anycase ('SystemLock')
| columns event.time, endpoint.name, src.process.user, registry.keyPath, registry.valueName, registry.value, src.process.name
| sort -event.time
| limit 200

DeviceRegistryEvents
| where Timestamp > ago(1d)
| where ActionType == "RegistryValueSet"
| project Timestamp, ActionType, RegistryValueName
| take 5

// HUNT: NIK C2 SystemLock autostart value
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1547.001
// CONF: high | FP: low
// FALSE POSITIVES: low. A product that names its own Run value SystemLock would match; check RegStringValue for lock_start.bat.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same registry-value predicate on DeviceRegistryEvents RegistryValueSet.
// REQUIRES: Defender for Endpoint registry telemetry (DeviceRegistryEvents)
// TUNING: A product that names its own Run value SystemLock would match; check RegistryValueData for lock_start.bat.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The lock_start.bat check on the value data is a manual triage step, not part of the filter.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceRegistryEvents
| where Timestamp >= ago(30d)
| where ActionType == "RegistryValueSet"
| where RegistryValueName =~ "SystemLock"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: ms-settings Shell Open command write (fodhelper UAC bypass, NIK C2)
// MITRE: T1548.002, T1546.015
// CONF: medium  FP: low  COST: low | REQUIRES: RegGenericValueUpdate, AsepValueUpdate (RegObjectName, RegStringValue)
// FALSE POSITIVES: near none; a legitimate app rarely registers a handler under ms-settings Shell Open command. Red-team exercises use the same key.
// LOOKBACK: 30d (set in the time picker)
#event_simpleName=/^(AsepValueUpdate|RegGenericValueUpdate)$/
| RegObjectName=/\\Software\\Classes\\ms-settings\\Shell\\Open\\command/i
| table([@timestamp, aid, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, ContextBaseFileName], limit=200)

event.type = 'Registry Value Modified' registry.keyPath = *
| limit 5
| columns event.time, event.type, registry.keyPath

// HUNT: ms-settings Shell Open command write (fodhelper UAC bypass, NIK C2)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1548.002, T1546.015
// CONF: medium | FP: low
// FALSE POSITIVES: near none; a legitimate app rarely registers a handler under ms-settings Shell Open command. Red-team exercises use the same key.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same registry predicate: a value written under the ms-settings Shell Open command key. The key path is matched as a case-insensitive substring.
// REQUIRES: SentinelOne Deep Visibility Registry Value Modified events
// TUNING: Near none; red-team exercises use the same key. Confirm the writing process in src.process.name.
// LOOKBACK: 30d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A key created without a value write is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified' registry.keyPath contains 'Software\\Classes\\ms-settings\\Shell\\Open\\command'
| columns event.time, endpoint.name, src.process.user, registry.keyPath, registry.valueName, registry.value, src.process.name
| sort -event.time
| limit 200

DeviceRegistryEvents
| where Timestamp > ago(1d)
| where ActionType == "RegistryValueSet"
| project Timestamp, ActionType, RegistryKey
| take 5

// HUNT: ms-settings Shell Open command write (fodhelper UAC bypass, NIK C2)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1548.002, T1546.015
// CONF: medium | FP: low
// FALSE POSITIVES: near none; a legitimate app rarely registers a handler under ms-settings Shell Open command. Red-team exercises use the same key.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same registry predicate on DeviceRegistryEvents: a value set under the ms-settings Shell Open command key.
// REQUIRES: Defender for Endpoint registry telemetry (DeviceRegistryEvents)
// TUNING: Near none; red-team exercises use the same key. Confirm the writing process.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A key created without a value write is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceRegistryEvents
| where Timestamp >= ago(30d)
| where ActionType == "RegistryValueSet"
| where RegistryKey contains "\\Software\\Classes\\ms-settings\\Shell\\Open\\command"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: PowerShell raw read of PhysicalDrive0 or mbr_backup.bin (NIK C2 boot ransomware)
// MITRE: T1006, T1059.001, T1542.003
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 (FileName, CommandLine, ParentBaseFileName)
// FALSE POSITIVES: low. Disk imaging, forensic and backup scripts that open the physical drive from PowerShell.
// LOOKBACK: 30d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(powershell|pwsh)\.exe$/i
| CommandLine=/(PhysicalDrive0|mbr_backup\.bin)/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, ImageFileName], limit=200)

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.cmdline

// HUNT: PowerShell raw read of PhysicalDrive0 or mbr_backup.bin (NIK C2 boot ransomware)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1006, T1059.001, T1542.003
// CONF: high | FP: low
// FALSE POSITIVES: low. Disk imaging, forensic and backup scripts that open the physical drive from PowerShell.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: PowerShell whose command line names PhysicalDrive0 or mbr_backup.bin. The created process is tgt.process.*.
// REQUIRES: SentinelOne Deep Visibility Process Creation events
// TUNING: Disk imaging, forensic and backup scripts that open the physical drive from PowerShell will match; confirm the creating process.
// LOOKBACK: 30d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A script file that opens the drive without naming it on the command line is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('powershell.exe', 'pwsh.exe') (tgt.process.cmdline contains 'PhysicalDrive0' or tgt.process.cmdline contains 'mbr_backup.bin')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name, tgt.process.image.path
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: PowerShell raw read of PhysicalDrive0 or mbr_backup.bin (NIK C2 boot ransomware)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1006, T1059.001, T1542.003
// CONF: high | FP: low
// FALSE POSITIVES: low. Disk imaging, forensic and backup scripts that open the physical drive from PowerShell.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on DeviceProcessEvents. contains is case-insensitive, matching the CQL intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Disk imaging, forensic and backup scripts that open the physical drive from PowerShell will match; confirm the creating process.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A script file that opens the drive without naming it on the command line is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine contains "PhysicalDrive0" or ProcessCommandLine contains "mbr_backup.bin"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: chcp 65001 prefixed recon commands (NIK C2 host survey)
// MITRE: T1082, T1518.001, T1057
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 (CommandLine, ParentBaseFileName)
// FALSE POSITIVES: low. Some inventory scripts set the code page before systeminfo; check the parent process and whether the other recon commands follow.
// LOOKBACK: 30d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/chcp\s+65001.*(systeminfo|lastbootuptime|SecurityCenter2|ConvertTo-Json)/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, ImageFileName], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.cmdline

// HUNT: chcp 65001 prefixed recon commands (NIK C2 host survey)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1082, T1518.001, T1057
// CONF: high | FP: low
// FALSE POSITIVES: low. Some inventory scripts set the code page before systeminfo; check the parent process and whether the other recon commands follow.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a command line with chcp 65001 followed later by a host-survey token. matches is case-insensitive by default, reproducing the CQL /i intent.
// REQUIRES: SentinelOne Deep Visibility Process Creation events
// TUNING: Some inventory scripts set the code page before systeminfo; check the creating process and whether the other recon commands follow.
// LOOKBACK: 30d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Recon commands issued in a later separate process are not linked to the chcp call.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.cmdline matches 'chcp\\s+65001.*(systeminfo|lastbootuptime|SecurityCenter2|ConvertTo-Json)'
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name, tgt.process.image.path
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: chcp 65001 prefixed recon commands (NIK C2 host survey)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1082, T1518.001, T1057
// CONF: high | FP: low
// FALSE POSITIVES: low. Some inventory scripts set the code page before systeminfo; check the parent process and whether the other recon commands follow.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation regex on ProcessCommandLine with the (?i) prefix to keep the CQL case-insensitive intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Some inventory scripts set the code page before systeminfo; check the creating process and whether the other recon commands follow.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Recon commands issued in a later separate process are not linked to the chcp call.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine matches regex @"(?i)chcp\s+65001.*(systeminfo|lastbootuptime|SecurityCenter2|ConvertTo-Json)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: netsh wlan show profile key=clear (NIK C2 Wi-Fi theft)
// MITRE: T1555, T1016.002
// CONF: medium  FP: medium  COST: low | REQUIRES: ProcessRollup2 (FileName, CommandLine, ParentBaseFileName)
// FALSE POSITIVES: help-desk and wireless-troubleshooting scripts; IT onboarding tools that export Wi-Fi profiles.
// TUNING: exclude approved IT tooling by ParentBaseFileName (for example your remote-support agent) and review hits where the parent is a binary running from a user temp or profile path.
// LOOKBACK: 30d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^netsh\.exe$/i
| CommandLine=/wlan\s+show\s+profile.*key\s*=\s*clear/i
| table([@timestamp, aid, ComputerName, UserName, CommandLine, ParentBaseFileName, ImageFileName], limit=200)

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.cmdline

// HUNT: netsh wlan show profile key=clear (NIK C2 Wi-Fi theft)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1555, T1016.002
// CONF: medium | FP: medium
// FALSE POSITIVES: help-desk and wireless-troubleshooting scripts; IT onboarding tools that export Wi-Fi profiles.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: netsh showing a wlan profile with key=clear.
// REQUIRES: SentinelOne Deep Visibility Process Creation events
// TUNING: Exclude approved IT tooling by src.process.name and review hits where the creating process runs from a user temp or profile path.
// LOOKBACK: 30d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Help-desk and wireless-troubleshooting scripts will match until tuned.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('netsh.exe') tgt.process.cmdline matches 'wlan\\s+show\\s+profile.*key\\s*=\\s*clear'
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name, tgt.process.image.path
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: netsh wlan show profile key=clear (NIK C2 Wi-Fi theft)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1555, T1016.002
// CONF: medium | FP: medium
// FALSE POSITIVES: help-desk and wireless-troubleshooting scripts; IT onboarding tools that export Wi-Fi profiles.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on DeviceProcessEvents, with the (?i) prefix keeping the CQL case-insensitive intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude approved IT tooling by InitiatingProcessFileName and review hits where the initiating process runs from a user temp or profile path.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Help-desk and wireless-troubleshooting scripts will match until tuned.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName =~ "netsh.exe"
| where ProcessCommandLine matches regex @"(?i)wlan\s+show\s+profile.*key\s*=\s*clear"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: bcdedit enum plus Confirm-SecureBootUEFI on one host (NIK C2 bootkit preparation)
// MITRE: T1542.003, T1082
// CONF: medium  FP: medium  COST: medium | REQUIRES: ProcessRollup2 (CommandLine)
// FALSE POSITIVES: inventory, compliance and imaging tools that check boot mode and Secure Boot state.
// TUNING: exclude hosts and parent processes belonging to your inventory or compliance agent; keep the hit when the same host also matches Q7 or Q4.
// LOOKBACK: 7d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(bcdedit.*enum|Confirm-SecureBootUEFI)/i
| case { CommandLine=/Confirm-SecureBootUEFI/i | Check := "secureboot"; * | Check := "bcdedit"; }
| groupBy([aid, ComputerName], function=[count(Check, distinct=true, as=DistinctChecks), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen), collect(ParentBaseFileName, limit=10)], limit=1000)
| DistinctChecks >= 2
| sort(LastSeen, order=desc, limit=1000)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, agent.uuid, tgt.process.cmdline

// HUNT: bcdedit enum plus Confirm-SecureBootUEFI on one host (NIK C2 bootkit preparation)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1542.003, T1082
// CONF: medium | FP: medium
// FALSE POSITIVES: inventory, compliance and imaging tools that check boot mode and Secure Boot state.
// EQUIVALENCE: approximate-analytic - Counts a bcdedit enum call and a Confirm-SecureBootUEFI call per host and keeps hosts with both. The CQL counts distinct checks with a case that gives Confirm-SecureBootUEFI precedence, so one command line naming both counts once there and twice here.
// REQUIRES: SentinelOne Deep Visibility Process Creation events
// TUNING: Exclude hosts and creating processes belonging to your inventory or compliance agent; keep the hit when the same host also matches the raw disk read or screen-lock cards.
// LOOKBACK: 7d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The creating process list collected on the CQL tab is not collected here.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' (tgt.process.cmdline matches 'bcdedit.*enum' or tgt.process.cmdline contains 'Confirm-SecureBootUEFI')
| group bcdedit_checks=count(tgt.process.cmdline matches 'bcdedit.*enum'), secureboot_checks=count(tgt.process.cmdline contains 'Confirm-SecureBootUEFI'), first_seen=min(event.time), last_seen=max(event.time) by agent.uuid, endpoint.name
| filter bcdedit_checks > 0 and secureboot_checks > 0
| sort -last_seen
| limit 1000

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceId, ProcessCommandLine
| take 5

// HUNT: bcdedit enum plus Confirm-SecureBootUEFI on one host (NIK C2 bootkit preparation)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1542.003, T1082
// CONF: medium | FP: medium
// FALSE POSITIVES: inventory, compliance and imaging tools that check boot mode and Secure Boot state.
// EQUIVALENCE: approximate-analytic - Counts a bcdedit enum call and a Confirm-SecureBootUEFI call per host with countif and keeps hosts with both. One command line naming both counts for both checks, where the CQL counts it once.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude hosts and initiating processes belonging to your inventory or compliance agent; keep the hit when the same host also matches the raw disk read or screen-lock cards.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The initiating process list collected on the CQL tab is not collected here.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine matches regex @"(?i)(bcdedit.*enum|Confirm-SecureBootUEFI)"
| summarize BcdeditChecks = countif(ProcessCommandLine matches regex @"(?i)bcdedit.*enum"), SecureBootChecks = countif(ProcessCommandLine contains "Confirm-SecureBootUEFI"), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName
| where BcdeditChecks > 0 and SecureBootChecks > 0
| sort by LastSeen desc
| take 1000

// HUNT: AmsiInitFailed in a command line (AMSI patch, NIK C2)
// MITRE: T1562.001, T1059.001
// CONF: medium  FP: medium  COST: low | REQUIRES: ProcessRollup2 (CommandLine)
// FALSE POSITIVES: red-team and training labs that demonstrate AMSI bypasses; security tools that scan for the string.
// TUNING: exclude known red-team hosts by ComputerName and approved security-scanner parents by ParentBaseFileName.
// LOOKBACK: 30d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/AmsiInitFailed/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.cmdline

// HUNT: AmsiInitFailed in a command line (AMSI patch, NIK C2)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1562.001, T1059.001
// CONF: medium | FP: medium
// FALSE POSITIVES: red-team and training labs that demonstrate AMSI bypasses; security tools that scan for the string.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: AmsiInitFailed anywhere in a command line, matched case-insensitively.
// REQUIRES: SentinelOne Deep Visibility Process Creation events
// TUNING: Exclude known red-team hosts by endpoint.name and approved security-scanner creating processes by src.process.name.
// LOOKBACK: 30d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An AMSI patch delivered without the string on a command line is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.cmdline contains 'AmsiInitFailed'
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: AmsiInitFailed in a command line (AMSI patch, NIK C2)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1562.001, T1059.001
// CONF: medium | FP: medium
// FALSE POSITIVES: red-team and training labs that demonstrate AMSI bypasses; security tools that scan for the string.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on ProcessCommandLine; contains is case-insensitive, matching the CQL intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude known red-team hosts by DeviceName and approved security-scanner initiating processes by InitiatingProcessFileName.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An AMSI patch delivered without the string on a command line is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine contains "AmsiInitFailed"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: csrss, svchost or simvol running outside System32 (NIK C2 masquerade)
// MITRE: T1036.005
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 (FileName, ImageFileName)
// FALSE POSITIVES: near none for csrss.exe and simvol.exe. svchost.exe copies appear in some servicing and recovery paths under WinSxS.
// LOOKBACK: 30d (set in the time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(csrss|svchost|simvol)\.exe$/i
| ImageFileName!=/\\Windows\\(System32|SysWOW64|WinSxS)\\/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData], limit=200)

event.type = 'Process Creation' tgt.process.image.path = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.image.path

// HUNT: csrss, svchost or simvol running outside System32 (NIK C2 masquerade)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: near none for csrss.exe and simvol.exe. svchost.exe copies appear in some servicing and recovery paths under WinSxS.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: csrss, svchost or simvol whose image path is outside System32, SysWOW64 and WinSxS. The created process is tgt.process.*.
// REQUIRES: SentinelOne Deep Visibility Process Creation events with the image path populated
// TUNING: Near none for csrss.exe and simvol.exe. svchost.exe copies appear in some servicing and recovery paths under WinSxS, which the query already excludes.
// LOOKBACK: 30d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process with an empty image path is not returned.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('csrss.exe', 'svchost.exe', 'simvol.exe') tgt.process.image.path = * !(tgt.process.image.path contains '\\Windows\\System32\\' or tgt.process.image.path contains '\\Windows\\SysWOW64\\' or tgt.process.image.path contains '\\Windows\\WinSxS\\')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, src.process.name, tgt.process.image.sha256
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath
| take 5

// HUNT: csrss, svchost or simvol running outside System32 (NIK C2 masquerade)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: near none for csrss.exe and simvol.exe. svchost.exe copies appear in some servicing and recovery paths under WinSxS.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on DeviceProcessEvents: the created process name is in the list and its folder is outside System32, SysWOW64 and WinSxS.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Near none for csrss.exe and simvol.exe. svchost.exe copies appear in some servicing and recovery paths under WinSxS, which the query already excludes.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process with an empty folder path would also be returned.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("csrss.exe", "svchost.exe", "simvol.exe")
| where not(FolderPath contains "\\Windows\\System32\\" or FolderPath contains "\\Windows\\SysWOW64\\" or FolderPath contains "\\Windows\\WinSxS\\")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: api.openai.com resolution by host (NIK C2 ai_generate baseline)
// MITRE: T1071.001
// CONF: low  FP: high  COST: low | REQUIRES: DnsRequest (DomainName, ContextProcessId)
// FALSE POSITIVES: every approved AI tool, browser and developer workstation.
// TUNING: baseline for 14 days, then exclude approved hosts by ComputerName and keep servers, kiosks and hosts with no AI software; pivot unexpected process ids with P1.
// LOOKBACK: 14d (set in the time picker)
#event_simpleName=DnsRequest
| DomainName=/^api\.openai\.com$/i
| groupBy([aid, ComputerName], function=[count(as=Lookups), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen), collect(ContextProcessId, limit=10)], limit=2000)
| sort(Lookups, order=asc, limit=500)

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, event.type, event.dns.request

// HUNT: api.openai.com resolution by host (NIK C2 ai_generate baseline)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001
// CONF: low | FP: high
// FALSE POSITIVES: every approved AI tool, browser and developer workstation.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS-resolution predicate for api.openai.com, grouped per host and sorted so the hosts with the fewest lookups come first.
// REQUIRES: SentinelOne Deep Visibility DNS Resolved events
// TUNING: Baseline for 14 days, then exclude approved hosts by endpoint.name and keep servers, kiosks and hosts with no AI software.
// LOOKBACK: 14d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The querying process id is not collected as it is on the CQL tab. Every approved AI tool and browser will match until baselined.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' event.dns.request in:anycase ('api.openai.com')
| group lookups=count(), first_seen=min(event.time), last_seen=max(event.time) by agent.uuid, endpoint.name
| sort +lookups
| limit 500

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: api.openai.com resolution by host (NIK C2 ai_generate baseline)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001
// CONF: low | FP: high
// FALSE POSITIVES: every approved AI tool, browser and developer workstation.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS-resolution predicate on the DnsQueryResponse action of DeviceEvents, with the name read from AdditionalFields.
// REQUIRES: Defender for Endpoint network telemetry with DNS response events (DeviceEvents)
// TUNING: Baseline for 14 days, then exclude approved hosts by DeviceName and keep servers, kiosks and hosts with no AI software.
// LOOKBACK: 14d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The querying process id is not collected. Every approved AI tool and browser will match until baselined.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(14d)
| where ActionType == "DnsQueryResponse"
| extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where DnsName =~ "api.openai.com"
| summarize Lookups = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName
| sort by Lookups asc
| take 500

// HUNT: browserdata.zip archive written (NIK C2 staging)
// MITRE: T1560, T1005
// CONF: medium  FP: low  COST: low | REQUIRES: ZipFileWritten (TargetFileName)
// FALSE POSITIVES: low. A browser-export or backup tool that uses the same archive name.
// LOOKBACK: 30d (set in the time picker)
#event_simpleName=ZipFileWritten
| TargetFileName=/\\browserdata\.zip$/i
| table([@timestamp, aid, ComputerName, UserName, TargetFileName, ContextBaseFileName], limit=200)

event.type = 'File Creation' tgt.file.path = *
| limit 5
| columns event.time, event.type, tgt.file.path

// HUNT: browserdata.zip archive written (NIK C2 staging)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1560, T1005
// CONF: medium | FP: low
// FALSE POSITIVES: low. A browser-export or backup tool that uses the same archive name.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same file-write predicate: browserdata.zip created. On a file event the writer is src.process.*.
// REQUIRES: SentinelOne Deep Visibility File Creation events
// TUNING: A browser-export or backup tool that uses the same archive name will match; confirm the writing process in src.process.name.
// LOOKBACK: 30d (set in the time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An archive created under another name or renamed into place is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'File Creation' tgt.file.path contains '\\browserdata.zip'
| columns event.time, endpoint.name, src.process.user, tgt.file.path, src.process.name
| sort -event.time
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| where ActionType == "FileCreated"
| project Timestamp, ActionType, FileName
| take 5

// HUNT: browserdata.zip archive written (NIK C2 staging)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1560, T1005
// CONF: medium | FP: low
// FALSE POSITIVES: low. A browser-export or backup tool that uses the same archive name.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same file-write predicate on DeviceFileEvents: FileCreated for a file named browserdata.zip.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: A browser-export or backup tool that uses the same archive name will match; confirm the initiating process.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An archive created under another name or renamed into place is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where ActionType == "FileCreated"
| where FileName =~ "browserdata.zip"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, FileName, FolderPath, InitiatingProcessFileName
| sort by Timestamp desc
| take 200