NetamLoader

// HUNT: PatchMyPC-ScriptRunner.exe launched from the Windows update download folder
// MITRE: T1574.014, T1195
// CONF: high  FP: low  COST: low
// REQUIRES: process creation with image path and command line (ProcessRollup2)
// FALSE POSITIVES: none expected. Patch My PC documents CCMCache and IMECache as its staging folders, not SoftwareDistribution.
// SOURCE: Securelist 2026-10-29 (observed command line used -updatepackage from the Install subfolder)
// NOTE: the binary is a legitimate signed product file. Detect only, never prevent.
// LOOKBACK: 30d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^PatchMyPC-ScriptRunner\.exe$/i
| ImageFileName=/\\SoftwareDistribution\\Download\\/i
| table([@timestamp, ComputerName, aid, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])

event.type = 'Process Creation' and tgt.process.name = *
| limit 5
| columns event.type, tgt.process.name, tgt.process.image.path

// HUNT: PatchMyPC-ScriptRunner.exe launched from the Windows update download folder
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.014, T1195
// CONF: high | FP: low
// FALSE POSITIVES: none expected. Patch My PC documents CCMCache and IMECache as its staging folders, not SoftwareDistribution.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the Patch My PC script runner image name running from the Windows update download folder. On a Process Creation event the created process is tgt.process.*, so name and path are read there. The name test is case-insensitive like the CQL /i.
// REQUIRES: SentinelOne Process Creation events with the created process image path and command line
// TUNING: None expected. The binary is legitimate, so this stays a detect-only hunt, never a block.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and tgt.process.name in:anycase ('PatchMyPC-ScriptRunner.exe') and tgt.process.image.path matches '\\\\SoftwareDistribution\\\\Download\\\\'
| columns event.time, endpoint.name, agent.uuid, src.process.user, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, src.process.name, tgt.process.image.sha256
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath
| take 5

// HUNT: PatchMyPC-ScriptRunner.exe launched from the Windows update download folder
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.014, T1195
// CONF: high | FP: low
// FALSE POSITIVES: none expected. Patch My PC documents CCMCache and IMECache as its staging folders, not SoftwareDistribution.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on DeviceProcessEvents: the runner image name from the update download folder. =~ and contains are case-insensitive, which reproduces the CQL /i intent. The parent is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected. The binary is legitimate, so this stays a detect-only hunt.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName =~ "PatchMyPC-ScriptRunner.exe"
| where FolderPath contains "\\SoftwareDistribution\\Download\\"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Patch My PC and Microsoft connector components extracted into SoftwareDistribution\Download\Install
// MITRE: T1574.014, T1195
// CONF: high  FP: low  COST: low
// REQUIRES: PE file write events with target path (PeFileWritten, NewExecutableWritten)
// FALSE POSITIVES: none expected for these names in this folder.
// SOURCE: Securelist 2026-10-29 (files extracted from the CAB to Download\Install); THN 2026-11-01 (PatchMyPC-Enum.dll, PatchMyPC-Models.dll)
// NOTE: names are legitimate product files. The folder is the signal. Detect only.
// LOOKBACK: 30d
#event_simpleName=/PeFileWritten|NewExecutableWritten/
| TargetFileName=/\\SoftwareDistribution\\Download\\Install\\/i
| FileName=/^(PatchMyPC-ScriptRunner|PatchMyPC-Enum|PatchMyPC-Models|Microsoft\.HostIntegration\.Connectors)\.(exe|dll)$/i
| table([@timestamp, ComputerName, aid, FileName, TargetFileName, ContextBaseFileName, SHA256HashData])

event.type = 'File Creation' and tgt.file.path = *
| limit 5
| columns event.type, tgt.file.path

// HUNT: Patch My PC and Microsoft connector components extracted into SoftwareDistribution\Download\Install
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.014, T1195
// CONF: high | FP: low
// FALSE POSITIVES: none expected for these names in this folder.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same file-write predicate: the four loader component names written under the update download Install folder. The CQL's PE-write event is approximated by File Creation and File Modification on a .exe or .dll name. On a File event the acting process is src.process.*.
// REQUIRES: SentinelOne File Creation and File Modification events with the target path
// TUNING: None expected for these names in this folder. The names are legitimate product files, so the folder is the signal. Detect only.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A write the agent did not report as a file event is not captured, and the CQL's PE-specific event type has no separate equivalent.
// VALIDATION LEVEL: static-reviewed
event.type in ('File Creation', 'File Modification') and tgt.file.path matches '\\\\SoftwareDistribution\\\\Download\\\\Install\\\\(.*\\\\)?(PatchMyPC-ScriptRunner|PatchMyPC-Enum|PatchMyPC-Models|Microsoft\\.HostIntegration\\.Connectors)\\.(exe|dll)$'
| columns event.time, endpoint.name, agent.uuid, tgt.file.path, src.process.name, tgt.file.sha256
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, FileName, FolderPath
| take 5

// HUNT: Patch My PC and Microsoft connector components extracted into SoftwareDistribution\Download\Install
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.014, T1195
// CONF: high | FP: low
// FALSE POSITIVES: none expected for these names in this folder.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same file-write predicate on DeviceFileEvents: the four component names in the update download Install folder. FileCreated and FileModified stand in for the CQL's PE-write events, and the executable name keeps the population to PE files.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: None expected for these names in this folder. Detect only.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL's PE-specific write event has no separate equivalent; the executable name is the filter.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath contains "\\SoftwareDistribution\\Download\\Install\\"
| where FileName matches regex @"(?i)^(PatchMyPC-ScriptRunner|PatchMyPC-Enum|PatchMyPC-Models|Microsoft\.HostIntegration\.Connectors)\.(exe|dll)$"
| project Timestamp, ReportId, DeviceId, DeviceName, FileName, FolderPath, InitiatingProcessFileName, SHA256
| sort by Timestamp desc
| take 200

// HUNT: executables running from SoftwareDistribution\Download, rarest first
// MITRE: T1574.014, T1195
// CONF: medium  FP: medium  COST: medium
// REQUIRES: process creation with image path (ProcessRollup2)
// FALSE POSITIVES: servicing stack and driver or firmware installers that unpack and run from the Download folder
// TUNING: baseline 30 days, then exclude verified signed installers, for example add: | FileName!=/^(approved-installer-1|approved-installer-2)\.exe$/i
// SOURCE: Kaspersky press release 2026-10-29 (monitor update folders for unexpected executables)
// LOOKBACK: 30d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ImageFileName=/\\SoftwareDistribution\\Download\\/i
| groupBy([FileName, ImageFileName], function=[count(aid, distinct=true, as=Hosts), count(as=Runs), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])
| sort(Runs, order=asc, limit=200)

event.type = 'Process Creation' and tgt.process.image.path = *
| limit 5
| columns event.type, event.time, agent.uuid, tgt.process.name, tgt.process.image.path

// HUNT: executables running from SoftwareDistribution\Download, rarest first
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.014, T1195
// CONF: medium | FP: medium
// FALSE POSITIVES: servicing stack and driver or firmware installers that unpack and run from the Download folder
// EQUIVALENCE: equivalent-with-schema-assumptions - Same rarity view: every process created from the update download folder, grouped by name and path with host and run counts, rarest first. The created process is tgt.process.* on a Process Creation event.
// REQUIRES: SentinelOne Process Creation events with the created process image path
// TUNING: Baseline 30 days, then exclude verified signed installers by tgt.process.name.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Servicing stack and driver installers that run from the Download folder are expected noise until baselined.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and tgt.process.image.path matches '\\\\SoftwareDistribution\\\\Download\\\\'
| group hosts = estimate_distinct(agent.uuid), runs = count(), first_seen = min(event.time), last_seen = max(event.time) by tgt.process.name, tgt.process.image.path
| sort +runs
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceId, FileName, FolderPath
| take 5

// HUNT: executables running from SoftwareDistribution\Download, rarest first
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.014, T1195
// CONF: medium | FP: medium
// FALSE POSITIVES: servicing stack and driver or firmware installers that unpack and run from the Download folder
// EQUIVALENCE: equivalent-with-schema-assumptions - Same rarity view on DeviceProcessEvents: processes created from the update download folder, grouped by name and path with host and run counts, rarest first.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Baseline 30 days, then exclude verified signed installers by FileName.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Servicing stack and driver installers that run from the Download folder are expected noise until baselined.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FolderPath contains "\\SoftwareDistribution\\Download\\"
| summarize Hosts = dcount(DeviceId), Runs = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by FileName, FolderPath
| sort by Runs asc
| take 200

// HUNT: dllhost.exe launched for the NetamLoader remote COM object or its DllSurrogate AppID
// MITRE: T1559.001, T1574.014
// CONF: medium  FP: low  COST: low
// REQUIRES: process creation with command line (ProcessRollup2)
// FALSE POSITIVES: none expected for these two GUIDs. A miss does not clear a host: the command line format is inferred, not published.
// SOURCE: Securelist 2026-10-29 (remote COM object CLSID used to start dllhost.exe; DllSurrogate AppID written by the .NET 2 Plugin)
// NOTE: dllhost.exe is a Windows binary. Detect only, never prevent.
// LOOKBACK: 30d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^dllhost\.exe$/i
| CommandLine=/Processid:\{(ab8902b4-09ca-4bb6-b78d-a8f59079a8d5|ff259bcd-2f0a-44de-b34a-0092fec1d8a2)\}/i
| table([@timestamp, ComputerName, aid, UserName, FileName, CommandLine, ParentBaseFileName, SHA256HashData])

event.type = 'Process Creation' and tgt.process.name = *
| limit 5
| columns event.type, tgt.process.name, tgt.process.cmdline

// HUNT: dllhost.exe launched for the NetamLoader remote COM object or its DllSurrogate AppID
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1559.001, T1574.014
// CONF: medium | FP: low
// FALSE POSITIVES: none expected for these two GUIDs. A miss does not clear a host: the command line format is inferred, not published.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: dllhost.exe whose command line carries either of the two GUIDs from the report. contains is case-insensitive like the CQL /i. The created process is tgt.process.*.
// REQUIRES: SentinelOne Process Creation events with the created process command line
// TUNING: None expected for these two GUIDs. A miss does not clear a host: the command line format is inferred, not published.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The command line format is inferred, not published, so a zero result does not clear a host.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and tgt.process.name in:anycase ('dllhost.exe') and (tgt.process.cmdline contains 'Processid:{ab8902b4-09ca-4bb6-b78d-a8f59079a8d5}' or tgt.process.cmdline contains 'Processid:{ff259bcd-2f0a-44de-b34a-0092fec1d8a2}')
| columns event.time, endpoint.name, agent.uuid, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.name, tgt.process.image.sha256
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: dllhost.exe launched for the NetamLoader remote COM object or its DllSurrogate AppID
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1559.001, T1574.014
// CONF: medium | FP: low
// FALSE POSITIVES: none expected for these two GUIDs. A miss does not clear a host: the command line format is inferred, not published.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on DeviceProcessEvents: dllhost.exe whose command line carries either GUID. =~ and contains are case-insensitive, which reproduces the CQL /i intent. The parent is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected for these two GUIDs. A miss does not clear a host: the command line format is inferred, not published.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The command line format is inferred, not published, so a zero result does not clear a host.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName =~ "dllhost.exe"
| where ProcessCommandLine contains "Processid:{ab8902b4-09ca-4bb6-b78d-a8f59079a8d5}" or ProcessCommandLine contains "Processid:{ff259bcd-2f0a-44de-b34a-0092fec1d8a2}"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256
| sort by Timestamp desc
| take 200

// HUNT: dllhost.exe outbound connections to non-private addresses, rare destinations first
// MITRE: T1071.001, T1497.003, T1559.001
// CONF: medium  FP: medium  COST: medium
// REQUIRES: outbound network connection events with initiating process (NetworkConnectIP4)
// FALSE POSITIVES: COM surrogate hosts for Microsoft services, thumbnail or preview handlers that fetch content, endpoint security components
// TUNING: baseline 30 days, then exclude known-good destinations, for example add: | !cidr(RemoteAddressIP4, subnet=["203.0.113.0/24"]) with your own approved ranges
// SOURCE: Securelist 2026-10-29 (.NET 2 Plugin polls over HTTPS from dllhost.exe; initial 20 to 40 minute delay; 5 to 6 minute poll; 22 to 28 hour retry)
// NOTE: the C2 sits behind a shared CDN address, so do not treat the destination address alone as an indicator.
// LOOKBACK: 7d
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^dllhost\.exe$/i
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16"])
| groupBy([aid, ComputerName, RemoteAddressIP4, RemotePort], function=[count(as=Conns), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])
| sort(Conns, order=asc, limit=200)

event.type = 'IP Connect' and dst.ip.address = *
| limit 5
| columns event.type, event.time, agent.uuid, src.process.name, dst.ip.address, dst.port.number

// HUNT: dllhost.exe outbound connections to non-private addresses, rare destinations first
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1497.003, T1559.001
// CONF: medium | FP: medium
// FALSE POSITIVES: COM surrogate hosts for Microsoft services, thumbnail or preview handlers that fetch content, endpoint security components
// EQUIVALENCE: equivalent-with-schema-assumptions - Same analytic: dllhost.exe outbound connections to non-private addresses, grouped by host and destination, rarest first. On an IP Connect event the acting process is src.process.*. The CQL's five excluded ranges are reproduced by the RFC 1918 test plus loopback and link-local subnet tests.
// REQUIRES: SentinelOne IP Connect events with the acting process name
// TUNING: Baseline 30 days on the CQL tab, then exclude known-good destinations with a net_ipsubnet test on dst.ip.address using your own approved ranges. The C2 sits behind a shared CDN address, so the destination alone is not an indicator.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: COM surrogate hosts for Microsoft services and security components also connect outward until baselined.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' and src.process.name in:anycase ('dllhost.exe') and dst.ip.address = * and !(net_rfc1918(dst.ip.address)) and !(net_ipsubnet(dst.ip.address, '127.0.0.0/8')) and !(net_ipsubnet(dst.ip.address, '169.254.0.0/16'))
| group conns = count(), first_seen = min(event.time), last_seen = max(event.time) by agent.uuid, endpoint.name, dst.ip.address, dst.port.number
| sort +conns
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, RemoteIPType, RemoteIP, RemotePort
| take 5

// HUNT: dllhost.exe outbound connections to non-private addresses, rare destinations first
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1497.003, T1559.001
// CONF: medium | FP: medium
// FALSE POSITIVES: COM surrogate hosts for Microsoft services, thumbnail or preview handlers that fetch content, endpoint security components
// EQUIVALENCE: equivalent-with-schema-assumptions - Same analytic on DeviceNetworkEvents: dllhost.exe outbound connections to public addresses, grouped by host and destination, rarest first. RemoteIPType equal to Public stands in for the CQL's five excluded ranges.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Baseline 30 days on the CQL tab, then exclude known-good destinations with an ipv4_is_in_range test using your own approved ranges. The C2 sits behind a shared CDN address, so the destination alone is not an indicator.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: COM surrogate hosts for Microsoft services and security components also connect outward until baselined.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName =~ "dllhost.exe"
| where RemoteIPType == "Public"
| summarize Conns = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName, RemoteIP, RemotePort
| sort by Conns asc
| take 200

// HUNT: DNS lookups for openaigpt4v.com
// MITRE: T1071.001
// CONF: high  FP: low  COST: low
// REQUIRES: DNS request events with process context (DnsRequest)
// FALSE POSITIVES: researchers or analysts resolving the domain from a lab or from a threat-intel enrichment tool
// SOURCE: Securelist 2026-10-29 (C2 domain, first seen 2023-09-27 per Kaspersky); THN 2026-11-01 repeats it
// LOOKBACK: 90d
#event_simpleName=DnsRequest
| DomainName=/(^|\.)openaigpt4v\.com$/i
| groupBy([aid, ComputerName, ContextBaseFileName, DomainName], function=[count(as=Requests), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])
| sort(FirstSeen, order=desc, limit=200)

event.type = 'DNS Resolved' and event.dns.request = *
| limit 5
| columns event.type, event.time, agent.uuid, src.process.name, event.dns.request

// HUNT: DNS lookups for openaigpt4v.com
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001
// CONF: high | FP: low
// FALSE POSITIVES: researchers or analysts resolving the domain from a lab or from a threat-intel enrichment tool
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: lookups for the C2 domain or any subdomain of it, grouped by host, process and name. On a DNS event the acting process is src.process.*. The name is read from event.dns.request, the field the independent backend maps.
// REQUIRES: SentinelOne DNS Resolved events with the requested name
// TUNING: Exclude analyst or threat-intel enrichment hosts that resolve the domain on purpose.
// LOOKBACK: 90d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Lookups by a resolver the agent does not observe are not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' and event.dns.request = * and (event.dns.request in:anycase ('openaigpt4v.com') or event.dns.request contains '.openaigpt4v.com')
| group requests = count(), first_seen = min(event.time), last_seen = max(event.time) by agent.uuid, endpoint.name, src.process.name, event.dns.request
| sort -first_seen
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: DNS lookups for openaigpt4v.com
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001
// CONF: high | FP: low
// FALSE POSITIVES: researchers or analysts resolving the domain from a lab or from a threat-intel enrichment tool
// EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: lookups for the C2 domain or any subdomain. There is no endpoint DNS table, so the name is read from the DnsQueryResponse action on DeviceEvents by bracket access into AdditionalFields.
// REQUIRES: Defender for Endpoint DNS telemetry (DeviceEvents, DnsQueryResponse)
// TUNING: Exclude analyst or threat-intel enrichment hosts that resolve the domain on purpose.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days, so the CQL tab's 90d window is not reproduced here.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| extend QueryName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where QueryName =~ "openaigpt4v.com" or QueryName endswith ".openaigpt4v.com"
| summarize Requests = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName, InitiatingProcessFileName, QueryName
| sort by FirstSeen desc
| take 200

// HUNT: DllSurrogate value created under a COM AppID registry key
// MITRE: T1559.001, T1112
// CONF: low  FP: medium  COST: low
// REQUIRES: registry value write events (RegGenericValueUpdate). Sensor coverage of Classes\AppID is unconfirmed: validate in tenant that a test write to this key is recorded before trusting a zero result.
// FALSE POSITIVES: software installers and COM server registrations that legitimately use a surrogate host
// TUNING: baseline 30 days, then exclude known installer images, for example add: | ContextBaseFileName!=/^(msiexec|setup)\.exe$/i
// SOURCE: Securelist 2026-10-29 (DllSurrogate set to an empty string under LocalMachine\SOFTWARE\Classes\appid\{GUID}; the GUID derives from the C2 URL)
// LOOKBACK: 30d
#event_simpleName=/RegGenericValueUpdate|AsepValueUpdate/
| RegObjectName=/\\Classes\\AppID\\\{[0-9a-f-]{36}\}$/i
| RegValueName=/^DllSurrogate$/i
| table([@timestamp, ComputerName, aid, UserName, RegObjectName, RegValueName, RegStringValue, ContextBaseFileName, ImageFileName])

event.type = 'Registry Value Modified' and registry.keyPath = *
| limit 5
| columns event.type, registry.keyPath, registry.valueName

// HUNT: DllSurrogate value created under a COM AppID registry key
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1559.001, T1112
// CONF: low | FP: medium
// FALSE POSITIVES: software installers and COM server registrations that legitimately use a surrogate host
// EQUIVALENCE: equivalent-with-schema-assumptions - Same registry predicate: a DllSurrogate value written under a GUID-named AppID key. On a registry event the acting process is src.process.*. A non-alphanumeric class stands for the path separator so the pattern needs no backslash escaping, and the GUID shape is kept.
// REQUIRES: SentinelOne Registry Value Modified events with key path and value name
// TUNING: Baseline 30 days, then exclude known installer images by src.process.name. Validate in tenant that a test write to this key is recorded before trusting a zero result.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Coverage of the AppID key by the agent is unconfirmed, so this hunt can be silent while the write happens.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified' and registry.valueName in:anycase ('DllSurrogate') and registry.keyPath matches 'Classes[^a-z0-9]AppID[^a-z0-9][{][0-9a-f-]{36}[}]$'
| columns event.time, endpoint.name, agent.uuid, src.process.user, registry.keyPath, registry.valueName, registry.value, src.process.name, src.process.image.path
| limit 200

DeviceRegistryEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, RegistryKey, RegistryValueName
| take 5

// HUNT: DllSurrogate value created under a COM AppID registry key
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1559.001, T1112
// CONF: low | FP: medium
// FALSE POSITIVES: software installers and COM server registrations that legitimately use a surrogate host
// EQUIVALENCE: equivalent-with-schema-assumptions - Same registry predicate on DeviceRegistryEvents: a DllSurrogate value set under a GUID-named AppID key. A non-alphanumeric class stands for the path separator so the pattern needs only one backslash escape, for the braces.
// REQUIRES: Defender for Endpoint registry telemetry (DeviceRegistryEvents)
// TUNING: Baseline 30 days, then exclude known installer images by InitiatingProcessFileName. Validate in tenant that a test write to this key is recorded before trusting a zero result.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Coverage of the AppID key by the sensor is unconfirmed, so this hunt can be silent while the write happens.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceRegistryEvents
| where Timestamp >= ago(30d)
| where ActionType == "RegistryValueSet"
| where RegistryValueName =~ "DllSurrogate"
| where RegistryKey matches regex @"(?i)Classes[^a-z0-9]AppID[^a-z0-9]\{[0-9a-f-]{36}\}$"
| project Timestamp, ReportId, DeviceId, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessFolderPath
| sort by Timestamp desc
| take 200