Node2Shell: Google Brotli Decoder Out-of-Bounds Write (CVE-2026-111497)

// HUNT: Application runtime (Node.js, Bun, .NET, Envoy) spawning a shell, downloader or interpreter
// MITRE: T1190, T1059.004, T1059.003, T1105 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 with parent lineage on Linux and Windows
// FALSE POSITIVES: npm and yarn scripts, build and CI hosts, process managers, health-check wrappers
// TUNING: exclude build and CI hosts by ComputerName and developer workstations by UserName
// TUNING: baseline production web tiers for 7 days with Q9, then allowlist exact CommandLine values
// TUNING: rather than binary names, because the binary names are the signal
// LOOKBACK: 14d (set in the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(node|nodejs|node\.exe|bun|bun\.exe|dotnet|dotnet\.exe|envoy)$/i
| FileName=/^(sh|bash|dash|ash|zsh|ksh|busybox|curl|wget|nc|ncat|socat|python[0-9.]*|perl|ruby|cmd\.exe|powershell\.exe|pwsh\.exe)$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=200)

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, src.process.name, tgt.process.name

// HUNT: Application runtime (Node.js, Bun, .NET, Envoy) spawning a shell, downloader or interpreter
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1059.004, T1059.003, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: npm and yarn scripts, build and CI hosts, process managers, health-check wrappers
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a runtime creator (Node.js, Bun, .NET or Envoy by name) and a created shell, downloader or interpreter. On a Process Creation event the creator is src.process.* and the created process is tgt.process.*, so the CQL parent maps to src.process.name and the child to tgt.process.name.
// REQUIRES: SentinelOne EDR process-creation events with creator lineage on Linux and Windows
// TUNING: Exclude build and CI hosts by endpoint.name and developer workstations by src.process.user, then allowlist exact tgt.process.cmdline values after a 7 day baseline with Q9.
// LOOKBACK: 14d (set in the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A child started by a runtime process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name in:anycase ('node', 'nodejs', 'node.exe', 'bun', 'bun.exe', 'dotnet', 'dotnet.exe', 'envoy') tgt.process.name matches '^(sh|bash|dash|ash|zsh|ksh|busybox|curl|wget|nc|ncat|socat|python[0-9.]*|perl|ruby|cmd\\.exe|powershell\\.exe|pwsh\\.exe)$'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, agent.uuid
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName
| take 5

// HUNT: Application runtime (Node.js, Bun, .NET, Envoy) spawning a shell, downloader or interpreter
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1190, T1059.004, T1059.003, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: npm and yarn scripts, build and CI hosts, process managers, health-check wrappers
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a runtime creator by name and a created shell, downloader or interpreter. The CQL parent is InitiatingProcessFileName and the child is FileName. in~ and the (?i) flag reproduce the CQL case-insensitive intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) on Linux and Windows
// TUNING: Exclude build and CI hosts by DeviceName and developer workstations by AccountName, then allowlist exact ProcessCommandLine values after a 7 day baseline with Q9.
// LOOKBACK: 14d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A child started by a runtime process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where InitiatingProcessFileName in~ ("node", "nodejs", "node.exe", "bun", "bun.exe", "dotnet", "dotnet.exe", "envoy")
| where FileName matches regex @"(?i)^(sh|bash|dash|ash|zsh|ksh|busybox|curl|wget|nc|ncat|socat|python[0-9.]*|perl|ruby|cmd\.exe|powershell\.exe|pwsh\.exe)$"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Runtime PID re-executed as a shell (in-place exec after Node.js or Bun)
// MITRE: T1190, T1059.004 | CONF: medium  FP: medium  COST: medium
// REQUIRES: ProcessRollup2 on Linux with RawProcessId populated
// FALSE POSITIVES: PID reuse after wrap on busy hosts, wrapper scripts that exec a shell after node exits
// TUNING: shorten the gap threshold from one hour to 5 minutes on hosts with high process churn
// TUNING: exclude ComputerName values of build agents; validate with a benign in-place exec test first
// LOOKBACK: 7d (set in the console time picker)
#event_simpleName=/^ProcessRollup2$/
| FileName=/^(node|nodejs|bun|sh|bash|dash|ash|zsh|busybox)$/i
| runtimeTs := if(FileName=/^(node|nodejs|bun)$/i, then=@timestamp, else=0)
| shellTs := if(FileName=/^(sh|bash|dash|ash|zsh|busybox)$/i, then=@timestamp, else=99999999999999)
| groupBy([aid, ComputerName, RawProcessId], function=[max(runtimeTs, as=lastRuntime), min(shellTs, as=firstShell), collect([UserName, ImageFileName, ParentBaseFileName, CommandLine])], limit=max)
| gap := firstShell - lastRuntime
| gap>0
| gap<3600000
| table([ComputerName, aid, RawProcessId, UserName, ImageFileName, ParentBaseFileName, CommandLine, gap])
| sort(gap, order=asc, limit=200)

event.type = 'Process Creation' tgt.process.pid = *
| limit 5
| columns event.time, agent.uuid, tgt.process.pid, tgt.process.name

// HUNT: Runtime PID re-executed as a shell (in-place exec after Node.js or Bun)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1059.004
// CONF: medium | FP: medium
// FALSE POSITIVES: PID reuse after wrap on busy hosts, wrapper scripts that exec a shell after node exits
// EQUIVALENCE: approximate-analytic - Hunts the same behaviour (one PID seen as a runtime and then as a shell) by a different analytic: PowerQuery has no arithmetic or conditional timestamp aggregation here, so the pair is matched on the same PID inside one clock hour instead of a measured gap, and the order of the two events is not checked.
// REQUIRES: SentinelOne process-creation events on Linux with tgt.process.pid populated
// TUNING: Exclude build agents by endpoint.name and validate with a benign in-place exec test first. Narrow the bucket to 5 minutes on hosts with high process churn.
// LOOKBACK: 7d (set in the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL's measured gap below one hour and its runtime-before-shell ordering are not expressed: a pair that straddles a clock-hour boundary is missed and PID reuse inside the hour can pair unrelated processes.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.pid = * tgt.process.name matches '^(node|nodejs|bun|sh|bash|dash|ash|zsh|busybox)$'
| group runtime_events = count(tgt.process.name matches '^(node|nodejs|bun)$'), shell_events = count(tgt.process.name matches '^(sh|bash|dash|ash|zsh|busybox)$'), first_seen = min(event.time), last_seen = max(event.time), user = any(src.process.user), parent = any(src.process.name), cmdline = any(tgt.process.cmdline) by agent.uuid, endpoint.name, tgt.process.pid, bucket = timebucket('1h')
| filter runtime_events > 0 and shell_events > 0
| sort -last_seen
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceId, ProcessId, FileName
| take 5

// HUNT: Runtime PID re-executed as a shell (in-place exec after Node.js or Bun)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1190, T1059.004
// CONF: medium | FP: medium
// FALSE POSITIVES: PID reuse after wrap on busy hosts, wrapper scripts that exec a shell after node exits
// EQUIVALENCE: approximate-analytic - Hunts the same behaviour (one PID seen as a runtime and then as a shell) by a different analytic: rows are grouped by ProcessId per device, both name sets must be present, and the span between first and last row must be under 60 minutes. The order of the two events is not checked.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) on Linux
// TUNING: Exclude build agents by DeviceName and validate with a benign in-place exec test first. Shorten the 60 minute span on hosts with high process churn.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The runtime-before-shell ordering is not checked.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ("node", "nodejs", "bun", "sh", "bash", "dash", "ash", "zsh", "busybox")
| summarize RuntimeEvents = countif(FileName in~ ("node", "nodejs", "bun")), ShellEvents = countif(FileName in~ ("sh", "bash", "dash", "ash", "zsh", "busybox")), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Account = any(AccountName), Parent = any(InitiatingProcessFileName), SampleCmd = any(ProcessCommandLine) by DeviceId, DeviceName, ProcessId
| where RuntimeEvents > 0 and ShellEvents > 0
| extend SpanMinutes = datetime_diff("minute", LastSeen, FirstSeen)
| where SpanMinutes < 60
| project DeviceName, DeviceId, ProcessId, Account, Parent, SampleCmd, RuntimeEvents, ShellEvents, FirstSeen, LastSeen, SpanMinutes
| sort by SpanMinutes asc
| take 200

// HUNT: Repeated starts of the same Node.js or Bun command line on one host (crash-restart loop)
// MITRE: T1190, T1499.004 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 for node and bun on Linux and Windows
// FALSE POSITIVES: watch-mode dev servers, cluster workers started together, rolling deploys, autoscaling
// TUNING: exclude developer hosts by ComputerName; for cluster managers, require the restarts to be
// TUNING: spread over time (spanMin above 2) rather than started within the same few seconds
// LOOKBACK: 1h (set in the console time picker) and re-run on a schedule
#event_simpleName=/^ProcessRollup2$/
| FileName=/^(node|nodejs|node\.exe|bun|bun\.exe)$/i
| groupBy([aid, ComputerName, ImageFileName, CommandLine, ParentBaseFileName], function=[count(as=starts), min(@timestamp, as=firstStart), max(@timestamp, as=lastStart), collect([UserName])], limit=max)
| starts>=5
| spanMin := (lastStart - firstStart) / 60000
| table([ComputerName, aid, ImageFileName, CommandLine, ParentBaseFileName, UserName, starts, spanMin])
| sort(starts, order=desc, limit=100)

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, agent.uuid, tgt.process.name, tgt.process.image.path, tgt.process.cmdline

// HUNT: Repeated starts of the same Node.js or Bun command line on one host (crash-restart loop)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190, T1499.004
// CONF: medium | FP: medium
// FALSE POSITIVES: watch-mode dev servers, cluster workers started together, rolling deploys, autoscaling
// EQUIVALENCE: equivalent-with-schema-assumptions - Same aggregation: process starts of Node.js or Bun grouped by host, image path, command line and creator, kept when there are five or more. The CQL's computed span in minutes is shown as first_seen and last_seen instead.
// REQUIRES: SentinelOne process-creation events for node and bun on Linux and Windows
// TUNING: Exclude developer hosts by endpoint.name. For cluster managers require the restarts to be spread over time by comparing first_seen and last_seen rather than started within the same few seconds.
// LOOKBACK: 1h (set in the console time picker) and re-run on a schedule
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The span in minutes is not computed; read it from first_seen and last_seen.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('node', 'nodejs', 'node.exe', 'bun', 'bun.exe')
| group starts = count(), first_seen = min(event.time), last_seen = max(event.time), user = any(src.process.user) by agent.uuid, endpoint.name, tgt.process.image.path, tgt.process.cmdline, src.process.name
| filter starts >= 5
| sort -starts
| limit 100

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceId, FileName, FolderPath, ProcessCommandLine
| take 5

// HUNT: Repeated starts of the same Node.js or Bun command line on one host (crash-restart loop)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1190, T1499.004
// CONF: medium | FP: medium
// FALSE POSITIVES: watch-mode dev servers, cluster workers started together, rolling deploys, autoscaling
// EQUIVALENCE: equivalent-with-schema-assumptions - Same aggregation: process starts of Node.js or Bun grouped by device, image path, command line and creator, kept when there are five or more. The CQL's span in minutes is computed as SpanMinutes.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) for node and bun
// TUNING: Exclude developer hosts by DeviceName. For cluster managers require SpanMinutes above 2 rather than starts within the same few seconds.
// LOOKBACK: 1h; re-run on a schedule
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A start the sensor did not observe is not counted.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(1h)
| where FileName in~ ("node", "nodejs", "node.exe", "bun", "bun.exe")
| summarize Starts = count(), FirstStart = min(Timestamp), LastStart = max(Timestamp), Account = any(AccountName) by DeviceId, DeviceName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
| where Starts >= 5
| extend SpanMinutes = datetime_diff("minute", LastStart, FirstStart)
| project DeviceName, DeviceId, FolderPath, ProcessCommandLine, InitiatingProcessFileName, Account, Starts, SpanMinutes, FirstStart, LastStart
| sort by Starts desc
| take 100

// HUNT: Node.js or Bun outbound to a public address on a non-web port
// MITRE: T1071, T1095, T1571, T1105 | CONF: medium  FP: medium  COST: medium
// REQUIRES: NetworkConnectIP4 and ProcessRollup2 for the same process
// FALSE POSITIVES: SMTP submission, SaaS databases on custom ports, webhook targets, internal registries
// TUNING: allowlist the RemoteAddressIP4 and RemotePort pairs your applications use, and exclude
// TUNING: 587, 465, 8080 and 8443 only on the host groups that legitimately use them
// LOOKBACK: 7d (set in the console time picker)
#event_simpleName=NetworkConnectIP4
| RemotePort!=443
| RemotePort!=80
| RemotePort!=53
| !cidr(RemoteAddressIP4, subnet="10.0.0.0/8")
| !cidr(RemoteAddressIP4, subnet="172.16.0.0/12")
| !cidr(RemoteAddressIP4, subnet="192.168.0.0/16")
| !cidr(RemoteAddressIP4, subnet="127.0.0.0/8")
| !cidr(RemoteAddressIP4, subnet="169.254.0.0/16")
| rename(field=ContextProcessId_decimal, as=TargetProcessId_decimal)
| join(query={#event_simpleName=ProcessRollup2 | FileName=/^(node|nodejs|node\.exe|bun|bun\.exe)$/i}, field=[aid, TargetProcessId_decimal], include=[FileName, CommandLine, ParentBaseFileName, UserName])
| table([@timestamp, ComputerName, UserName, FileName, CommandLine, RemoteAddressIP4, RemotePort, aid])
| sort(@timestamp, order=desc, limit=200)

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.time, src.process.name, dst.ip.address, dst.port.number

// HUNT: Node.js or Bun outbound to a public address on a non-web port
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071, T1095, T1571, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: SMTP submission, SaaS databases on custom ports, webhook targets, internal registries
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a Node.js or Bun process connecting outbound to a non-private address on a port other than 443, 80 or 53. SentinelOne carries the acting process on the IP Connect event itself, so the CQL's join to the process record is not needed.
// REQUIRES: SentinelOne IP Connect events with the acting process populated
// TUNING: Allowlist the dst.ip.address and dst.port.number pairs your applications use, and exclude 587, 465, 8080 and 8443 only on the host groups that legitimately use them.
// LOOKBACK: 7d (set in the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A connection by a process whose name the sensor reports differently from the CQL's process record is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' src.process.name in:anycase ('node', 'nodejs', 'node.exe', 'bun', 'bun.exe') dst.ip.address = * dst.port.number != 443 dst.port.number != 80 dst.port.number != 53 !(net_ipsubnet(dst.ip.address, '10.0.0.0/8') or net_ipsubnet(dst.ip.address, '172.16.0.0/12') or net_ipsubnet(dst.ip.address, '192.168.0.0/16') or net_ipsubnet(dst.ip.address, '127.0.0.0/8') or net_ipsubnet(dst.ip.address, '169.254.0.0/16'))
| columns event.time, endpoint.name, src.process.user, src.process.name, src.process.cmdline, dst.ip.address, dst.port.number, agent.uuid
| sort -event.time
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, InitiatingProcessFileName, RemoteIP, RemotePort
| take 5

// HUNT: Node.js or Bun outbound to a public address on a non-web port
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071, T1095, T1571, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: SMTP submission, SaaS databases on custom ports, webhook targets, internal registries
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a Node.js or Bun process connecting outbound to a non-private IPv4 address on a port other than 443, 80 or 53. DeviceNetworkEvents carries the initiating process, so the CQL's join to the process record is not needed.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Allowlist the RemoteIP and RemotePort pairs your applications use, and exclude 587, 465, 8080 and 8443 only on the host groups that legitimately use them.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A failed or blocked connection attempt is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where ActionType == "ConnectionSuccess"
| where InitiatingProcessFileName in~ ("node", "nodejs", "node.exe", "bun", "bun.exe")
| where RemotePort !in (443, 80, 53)
| where not(ipv4_is_in_range(RemoteIP, "10.0.0.0/8") or ipv4_is_in_range(RemoteIP, "172.16.0.0/12") or ipv4_is_in_range(RemoteIP, "192.168.0.0/16") or ipv4_is_in_range(RemoteIP, "127.0.0.0/8") or ipv4_is_in_range(RemoteIP, "169.254.0.0/16"))
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort
| sort by Timestamp desc
| take 200

// HUNT: Reverse-shell and shell-over-socket command lines (post-exploitation, any parent)
// MITRE: T1059.004, T1095, T1571 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 with CommandLine
// FALSE POSITIVES: authorised red-team and penetration-test activity
// LOOKBACK: 14d (set in the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/dev.tcp.[0-9]|mkfifo.*(nc|ncat|telnet)|(^|\s)(nc|ncat)\s.*\s-e\s|socat.*exec:|bash\s+-i\s*>&|python[0-9.]*\s.*socket.*(pty|sh|bash)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, tgt.process.cmdline

// HUNT: Reverse-shell and shell-over-socket command lines (post-exploitation, any parent)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.004, T1095, T1571
// CONF: high | FP: low
// FALSE POSITIVES: authorised red-team and penetration-test activity
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the CQL's reverse-shell regex is applied unchanged to the created process's command line on Process Creation events, with any parent. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation events with tgt.process.cmdline populated
// TUNING: Exclude authorised red-team and penetration-test hosts by endpoint.name.
// LOOKBACK: 14d (set in the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A reverse shell started from a process the sensor did not report as a creation event is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.cmdline matches 'dev.tcp.[0-9]|mkfifo.*(nc|ncat|telnet)|(^|\\s)(nc|ncat)\\s.*\\s-e\\s|socat.*exec:|bash\\s+-i\\s*>&|python[0-9.]*\\s.*socket.*(pty|sh|bash)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, agent.uuid
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: Reverse-shell and shell-over-socket command lines (post-exploitation, any parent)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.004, T1095, T1571
// CONF: high | FP: low
// FALSE POSITIVES: authorised red-team and penetration-test activity
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the CQL's reverse-shell regex is applied unchanged to the process command line. The (?i) flag reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude authorised red-team and penetration-test hosts by DeviceName.
// LOOKBACK: 14d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A reverse shell started by a process the sensor did not report is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where ProcessCommandLine matches regex @"(?i)dev.tcp.[0-9]|mkfifo.*(nc|ncat|telnet)|(^|\s)(nc|ncat)\s.*\s-e\s|socat.*exec:|bash\s+-i\s*>&|python[0-9.]*\s.*socket.*(pty|sh|bash)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Discovery and secret-access commands on hosts running Node.js or Bun
// MITRE: T1033, T1082, T1083, T1552.001, T1552.005 | CONF: medium  FP: medium  COST: medium
// REQUIRES: ProcessRollup2 with CommandLine and parent
// FALSE POSITIVES: interactive administrators, configuration management, container health checks
// TUNING: exclude admin jump-host accounts by UserName and your monitoring agent by CommandLine
// TUNING: then rank by rarity: a command seen on one host once is worth more than one seen daily
// LOOKBACK: 7d (set in the console time picker)
#event_simpleName=/^ProcessRollup2$/
| ParentBaseFileName=/^(node|nodejs|bun|sh|bash|dash|ash|busybox)$/i
| FileName=/^(id|whoami|uname|hostname|env|printenv|cat|ifconfig|ip|ps|ss|netstat|curl|wget)$/i
| CommandLine=/(^|\s)(id|whoami|uname|hostname|printenv|env|ifconfig)(\s|$)|environ|169\.254\.169\.254|passwd|shadow|\.aws|credentials|\.kube|\.npmrc|\.ssh/i
| join(query={#event_simpleName=ProcessRollup2 | FileName=/^(node|nodejs|bun)$/i | groupBy([aid], function=count(as=runtimeStarts))}, field=aid, include=[runtimeStarts])
| groupBy([aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], function=[count(as=runs), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)], limit=max)
| sort(runs, order=asc, limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, agent.uuid, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: Discovery and secret-access commands on hosts running Node.js or Bun
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1033, T1082, T1083, T1552.001, T1552.005
// CONF: medium | FP: medium
// FALSE POSITIVES: interactive administrators, configuration management, container health checks
// EQUIVALENCE: approximate-analytic - Hunts the same behaviour (discovery and secret-access commands run by a runtime or a shell) but drops the CQL's join that restricts results to hosts where Node.js or Bun ran, because the offline engine and the shipped fixtures cannot exercise a subquery. The parent, child and command-line predicates and the per-command run counts are unchanged.
// REQUIRES: SentinelOne process-creation events with creator lineage
// TUNING: Exclude admin jump-host accounts by src.process.user and your monitoring agent by tgt.process.cmdline, then rank by rarity: a command seen on one host once is worth more than one seen daily. Restrict to hosts that run node or bun by pivoting from Q1 or Q9.
// LOOKBACK: 7d (set in the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The restriction to hosts where node or bun started is not applied, so hosts without a runtime also appear and the result is noisier than the CQL tab.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name matches '^(node|nodejs|bun|sh|bash|dash|ash|busybox)$' tgt.process.name matches '^(id|whoami|uname|hostname|env|printenv|cat|ifconfig|ip|ps|ss|netstat|curl|wget)$' tgt.process.cmdline matches '(^|\\s)(id|whoami|uname|hostname|printenv|env|ifconfig)(\\s|$)|environ|169\\.254\\.169\\.254|passwd|shadow|\\.aws|credentials|\\.kube|\\.npmrc|\\.ssh'
| group runs = count(), first_seen = min(event.time), last_seen = max(event.time) by agent.uuid, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort +runs
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName, ProcessCommandLine
| take 5

// HUNT: Discovery and secret-access commands on hosts running Node.js or Bun
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1033, T1082, T1083, T1552.001, T1552.005
// CONF: medium | FP: medium
// FALSE POSITIVES: interactive administrators, configuration management, container health checks
// EQUIVALENCE: approximate-analytic - Hunts the same behaviour (discovery and secret-access commands run by a runtime or a shell) but drops the CQL's join that restricts results to hosts where Node.js or Bun ran, since a KQL card here reads one table with no second source. The parent, child and command-line predicates and the per-command run counts are unchanged.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude admin jump-host accounts by AccountName and your monitoring agent by ProcessCommandLine, then rank by rarity. Restrict to hosts that run node or bun by pivoting from Q1 or Q9.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The restriction to hosts where node or bun started is not applied, so hosts without a runtime also appear and the result is noisier than the CQL tab.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName in~ ("node", "nodejs", "bun", "sh", "bash", "dash", "ash", "busybox")
| where FileName in~ ("id", "whoami", "uname", "hostname", "env", "printenv", "cat", "ifconfig", "ip", "ps", "ss", "netstat", "curl", "wget")
| where ProcessCommandLine matches regex @"(?i)(^|\s)(id|whoami|uname|hostname|printenv|env|ifconfig)(\s|$)|environ|169\.254\.169\.254|passwd|shadow|\.aws|credentials|\.kube|\.npmrc|\.ssh"
| summarize Runs = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Runs asc
| take 200

// HUNT: Inventory of Node.js, Bun, .NET and Envoy binaries by hash, path and host count
// MITRE: T1190 | CONF: medium  FP: low  COST: medium
// REQUIRES: ProcessRollup2 with SHA256HashData for runtime binaries that have executed in the window
// FALSE POSITIVES: not a detection; every running runtime is listed by design
// LOOKBACK: 30d (set in the console time picker); only binaries that ran in the window appear
#event_simpleName=/^ProcessRollup2$/
| FileName=/^(node|nodejs|node\.exe|bun|bun\.exe|dotnet|dotnet\.exe|envoy|envoy\.exe)$/i
| groupBy([FileName, SHA256HashData, ImageFileName], function=[count(aid, distinct=true, as=hosts), count(as=starts), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)], limit=max)
| sort(hosts, order=desc, limit=500)

event.type = 'Process Creation' tgt.process.image.sha256 = *
| limit 5
| columns event.time, agent.uuid, tgt.process.name, tgt.process.image.sha256, tgt.process.image.path

// HUNT: Inventory of Node.js, Bun, .NET and Envoy binaries by hash, path and host count
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1190
// CONF: medium | FP: low
// FALSE POSITIVES: not a detection; every running runtime is listed by design
// EQUIVALENCE: equivalent-with-schema-assumptions - Same inventory: runtime binaries that executed in the window, grouped by name, SHA-256 and image path with a host count, a start count and first and last seen. The host count is an estimate where the CQL counts exactly.
// REQUIRES: SentinelOne process-creation events with tgt.process.image.sha256 populated
// TUNING: Not a detection. Compare each hash with the vendor release hashes for your installed runtimes and investigate any hash seen on a single host.
// LOOKBACK: 30d (set in the console time picker); only binaries that ran in the window appear
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A runtime that did not start inside the window is not listed.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('node', 'nodejs', 'node.exe', 'bun', 'bun.exe', 'dotnet', 'dotnet.exe', 'envoy', 'envoy.exe')
| group hosts = estimate_distinct(agent.uuid), starts = count(), first_seen = min(event.time), last_seen = max(event.time) by tgt.process.name, tgt.process.image.sha256, tgt.process.image.path
| sort -hosts
| limit 500

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceId, FileName, FolderPath, SHA1
| take 5

// HUNT: Inventory of Node.js, Bun, .NET and Envoy binaries by hash, path and host count
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1190
// CONF: medium | FP: low
// FALSE POSITIVES: not a detection; every running runtime is listed by design
// EQUIVALENCE: equivalent-with-schema-assumptions - Same inventory: runtime binaries that executed in the window, grouped by name, hash and path with a device count, a start count and first and last seen. SHA1 is added because SHA256 is often unpopulated in DeviceProcessEvents.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Not a detection. Compare each hash with the vendor release hashes for your installed runtimes and investigate any hash seen on a single device.
// LOOKBACK: 30d (Advanced Hunting retention); only binaries that ran in the window appear
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A runtime that did not start inside the window is not listed.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("node", "nodejs", "node.exe", "bun", "bun.exe", "dotnet", "dotnet.exe", "envoy", "envoy.exe")
| summarize Hosts = dcount(DeviceId), Starts = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by FileName, SHA1, SHA256, FolderPath
| sort by Hosts desc
| take 500

// HUNT: Outbound connection to the source address in the 2026-10-26 exploit attempt (ELLIO)
// MITRE: T1071 | CONF: low  FP: low  COST: low
// REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: none expected; this is an atomic indicator sweep
// LOOKBACK: 30d (set in the console time picker)
#event_simpleName=NetworkConnectIP4
| RemoteAddressIP4="94.154.43.7"
| table([@timestamp, ComputerName, aid, RemoteAddressIP4, RemotePort, ContextProcessId_decimal])
| sort(@timestamp, order=desc, limit=200)

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.time, dst.ip.address

// HUNT: Outbound connection to the source address in the 2026-10-26 exploit attempt (ELLIO)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071
// CONF: low | FP: low
// FALSE POSITIVES: none expected; this is an atomic indicator sweep
// EQUIVALENCE: equivalent-with-schema-assumptions - Same atomic sweep: any connection event whose remote address is the published source address. The acting process name and command line replace the CQL's numeric process identifier because SentinelOne carries them on the event.
// REQUIRES: SentinelOne IP Connect events
// TUNING: Atomic indicator sweep; no tuning expected. The address is the source of an observed exploit attempt, so a hit on an outbound connection is unusual and should be triaged.
// LOOKBACK: 30d (set in the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An inbound connection from the address is not distinguished from an outbound one.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' dst.ip.address = '94.154.43.7'
| columns event.time, endpoint.name, src.process.name, src.process.cmdline, dst.ip.address, dst.port.number, agent.uuid
| sort -event.time
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, RemoteIP
| take 5

// HUNT: Outbound connection to the source address in the 2026-10-26 exploit attempt (ELLIO)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071
// CONF: low | FP: low
// FALSE POSITIVES: none expected; this is an atomic indicator sweep
// EQUIVALENCE: equivalent-with-schema-assumptions - Same atomic sweep: any network event whose remote address is the published source address. The initiating process name and command line replace the CQL's numeric process identifier.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Atomic indicator sweep; no tuning expected.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connection direction is not filtered, so an inbound connection from the address also matches.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemoteIP == "94.154.43.7"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort
| sort by Timestamp desc
| take 200

// HUNT: Baseline of child processes launched by Node.js, Bun, .NET and Envoy (rarest first)
// MITRE: T1059.004 | CONF: medium  FP: low  COST: low
// REQUIRES: ProcessRollup2 with parent lineage
// FALSE POSITIVES: not a detection; benign tooling is listed by design
// LOOKBACK: 30d (set in the console time picker)
#event_simpleName=/^ProcessRollup2$/
| ParentBaseFileName=/^(node|nodejs|node\.exe|bun|bun\.exe|dotnet|dotnet\.exe|envoy)$/i
| groupBy([ParentBaseFileName, FileName], function=[count(aid, distinct=true, as=hosts), count(as=execs)], limit=max)
| sort(hosts, order=asc, limit=300)

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns agent.uuid, src.process.name, tgt.process.name

// HUNT: Baseline of child processes launched by Node.js, Bun, .NET and Envoy (rarest first)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.004
// CONF: medium | FP: low
// FALSE POSITIVES: not a detection; benign tooling is listed by design
// EQUIVALENCE: equivalent-with-schema-assumptions - Same baseline: child processes whose creator is a runtime (Node.js, Bun, .NET or Envoy), grouped by creator and child with a host count and an execution count, rarest first. On a Process Creation event the creator is src.process.name and the child is tgt.process.name. The host count is an estimate where the CQL counts exactly.
// REQUIRES: SentinelOne process-creation events with creator lineage
// TUNING: Not a detection. Review the rarest rows first and allowlist the child names your applications legitimately launch before alerting on Q1.
// LOOKBACK: 30d (set in the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Children of a runtime process the sensor did not observe starting are not listed.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name in:anycase ('node', 'nodejs', 'node.exe', 'bun', 'bun.exe', 'dotnet', 'dotnet.exe', 'envoy')
| group hosts = estimate_distinct(agent.uuid), execs = count() by src.process.name, tgt.process.name
| sort +hosts
| limit 300

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceId, InitiatingProcessFileName, FileName
| take 5

// HUNT: Baseline of child processes launched by Node.js, Bun, .NET and Envoy (rarest first)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.004
// CONF: medium | FP: low
// FALSE POSITIVES: not a detection; benign tooling is listed by design
// EQUIVALENCE: equivalent-with-schema-assumptions - Same baseline: child processes whose creator is a runtime, grouped by creator and child with a device count and an execution count, rarest first. The CQL parent is InitiatingProcessFileName and the child is FileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Not a detection. Review the rarest rows first and allowlist the child names your applications legitimately launch before alerting on Q1.
// LOOKBACK: 30d (Advanced Hunting retention)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Children of a runtime process the sensor did not observe starting are not listed.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName in~ ("node", "nodejs", "node.exe", "bun", "bun.exe", "dotnet", "dotnet.exe", "envoy")
| summarize Hosts = dcount(DeviceId), Execs = count() by InitiatingProcessFileName, FileName
| sort by Hosts asc
| take 300