OVHcloud CLI Release-Asset Backdoor (v0.11.0 to v0.15.0)

// HUNT: OVHcloud CLI replaced release binaries by hash
// MITRE: T1195.002, T1204.002
// CONF: high
// FP: low
// COST: low
// REQUIRES: Falcon sensor process and Windows file-write telemetry with MD5HashData/SHA256HashData
// FALSE POSITIVES: none expected, hashes belong to the replaced files
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| (MD5HashData=/^(6f2f086239f3d88eb2750e871901927d|347e65eb7f2d78d1c6872690272a6cc3|01f57206d37c28cf711677f612052913|301bff0b51980b9e76c93633e7cfd3bd|6a3cf153338c416169cda2fe704c8848)$/i or SHA256HashData=/^(e9c31dca232cdaa8058cb59eadf425c182a23afb6ddb057eb92eda13b850dff4|3c10bd782cd0dc5f720a33570af4651814cb82917e54d27ffce3849a3c5cef2a|3cbe1ac592beeca7ce0ad0ba945349a9ef33ef0f1324935c3a115f30b1d0c927|25c68c5e9ae23883aebda59f4b6a7df78e1ce8aae5e4b4ba636419497d54bbec|f97284530343b3903ffd19bbe70ab6f62e36f04eb7e5f885934bd21d10899e8a|3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb)$/i)
| table([@timestamp, #event_simpleName, aid, ComputerName, UserName, FileName, ImageFileName, MD5HashData, SHA256HashData, ParentBaseFileName, CommandLine])
| sort(@timestamp, order=desc)

event.type in ('Process Creation', 'File Creation') and (tgt.process.image.sha256 = * or tgt.file.sha256 = *)
| limit 5
| columns event.type, tgt.process.image.md5, tgt.process.image.sha256, tgt.file.md5, tgt.file.sha256

// HUNT: OVHcloud CLI replaced release binaries by hash
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1195.002, T1204.002
// CONF: high | FP: low
// FALSE POSITIVES: none expected, hashes belong to the replaced files
// EQUIVALENCE: equivalent-with-schema-assumptions - Same hash pivot over the process-start and file-write populations: the MD5 and SHA256 lists are matched on Process Creation and File Creation events. in:anycase reproduces the case-insensitive intent. The CQL's four sensor event names collapse to two PowerQuery event types.
// REQUIRES: SentinelOne process and file telemetry with hash fields populated
// TUNING: None expected; extend the hash lists if the advisory adds more.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A file event the sensor did not hash is missed; the hash fields can be empty for large or in-flight files.
// VALIDATION LEVEL: static-reviewed
event.type in ('Process Creation', 'File Creation') and (tgt.process.image.md5 in:anycase ('6f2f086239f3d88eb2750e871901927d', '347e65eb7f2d78d1c6872690272a6cc3', '01f57206d37c28cf711677f612052913', '301bff0b51980b9e76c93633e7cfd3bd', '6a3cf153338c416169cda2fe704c8848') or tgt.process.image.sha256 in:anycase ('e9c31dca232cdaa8058cb59eadf425c182a23afb6ddb057eb92eda13b850dff4', '3c10bd782cd0dc5f720a33570af4651814cb82917e54d27ffce3849a3c5cef2a', '3cbe1ac592beeca7ce0ad0ba945349a9ef33ef0f1324935c3a115f30b1d0c927', '25c68c5e9ae23883aebda59f4b6a7df78e1ce8aae5e4b4ba636419497d54bbec', 'f97284530343b3903ffd19bbe70ab6f62e36f04eb7e5f885934bd21d10899e8a', '3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb') or tgt.file.md5 in:anycase ('6f2f086239f3d88eb2750e871901927d', '347e65eb7f2d78d1c6872690272a6cc3', '01f57206d37c28cf711677f612052913', '301bff0b51980b9e76c93633e7cfd3bd', '6a3cf153338c416169cda2fe704c8848') or tgt.file.sha256 in:anycase ('e9c31dca232cdaa8058cb59eadf425c182a23afb6ddb057eb92eda13b850dff4', '3c10bd782cd0dc5f720a33570af4651814cb82917e54d27ffce3849a3c5cef2a', '3cbe1ac592beeca7ce0ad0ba945349a9ef33ef0f1324935c3a115f30b1d0c927', '25c68c5e9ae23883aebda59f4b6a7df78e1ce8aae5e4b4ba636419497d54bbec', 'f97284530343b3903ffd19bbe70ab6f62e36f04eb7e5f885934bd21d10899e8a', '3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb'))
| columns event.time, endpoint.name, src.process.user, event.type, tgt.process.name, tgt.process.image.path, tgt.process.image.md5, tgt.process.image.sha256, tgt.file.path, tgt.file.md5, tgt.file.sha256, src.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, MD5, SHA256
| take 5

// HUNT: OVHcloud CLI replaced release binaries by hash
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1195.002, T1204.002
// CONF: high | FP: low
// FALSE POSITIVES: none expected, hashes belong to the replaced files
// EQUIVALENCE: telemetry-gap - Partial pivot: the same MD5 and SHA256 lists are matched on process-creation rows only. The file-write half of the CQL is not covered because the card allows one table.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected; extend the hash lists if the advisory adds more.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Files written to disk but never executed are not covered; run the same hash lists against DeviceFileEvents.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where MD5 in~ ("6f2f086239f3d88eb2750e871901927d", "347e65eb7f2d78d1c6872690272a6cc3", "01f57206d37c28cf711677f612052913", "301bff0b51980b9e76c93633e7cfd3bd", "6a3cf153338c416169cda2fe704c8848") or SHA256 in~ ("e9c31dca232cdaa8058cb59eadf425c182a23afb6ddb057eb92eda13b850dff4", "3c10bd782cd0dc5f720a33570af4651814cb82917e54d27ffce3849a3c5cef2a", "3cbe1ac592beeca7ce0ad0ba945349a9ef33ef0f1324935c3a115f30b1d0c927", "25c68c5e9ae23883aebda59f4b6a7df78e1ce8aae5e4b4ba636419497d54bbec", "f97284530343b3903ffd19bbe70ab6f62e36f04eb7e5f885934bd21d10899e8a", "3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, MD5, SHA256, InitiatingProcessFileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Outbound connection to the OVHcloud CLI stealer upload address
// MITRE: T1041
// CONF: high
// FP: low
// COST: low
// REQUIRES: Falcon sensor network telemetry
// FALSE POSITIVES: none expected
// LOOKBACK: 7d
#event_simpleName=NetworkConnectIP4
| RemoteAddressIP4="45.32.148.174"
| table([@timestamp, aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort, LocalAddressIP4])
| sort(@timestamp, order=desc)

event.type = 'IP Connect' and dst.ip.address = *
| limit 5
| columns event.type, dst.ip.address

// HUNT: Outbound connection to the OVHcloud CLI stealer upload address
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1041
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an outbound IP connection whose destination is the stealer upload address. The connecting process is src.process.name on IP Connect events.
// REQUIRES: SentinelOne network (IP Connect) telemetry
// TUNING: None expected.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connections made before the sensor was installed, or by a host without network telemetry, are not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' and dst.ip.address = '45.32.148.174'
| columns event.time, endpoint.name, agent.uuid, src.process.name, src.ip.address, dst.ip.address, dst.port.number
| sort -event.time
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, RemoteIP
| take 5

// HUNT: Outbound connection to the OVHcloud CLI stealer upload address
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1041
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a network event whose remote address is the stealer upload address. The connecting process is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: None expected.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connections the sensor did not record are not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where RemoteIP == "45.32.148.174"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, LocalIP
| sort by Timestamp desc
| take 200

// HUNT: ovhcloud process resolving Solana RPC hostnames
// MITRE: T1102, T1041
// CONF: high
// FP: low
// COST: low
// REQUIRES: Falcon sensor DNS telemetry with process context (⚠ validate in tenant: ContextBaseFileName on DnsRequest)
// FALSE POSITIVES: none expected
// LOOKBACK: 7d
#event_simpleName=DnsRequest
| ContextBaseFileName=/^ovhcloud(\.exe)?$/i
| DomainName=/^(solana\.drpc\.org|solana\-rpc\.publicnode\.com|solana\.api\.pocket\.network|api\.mainnet\-beta\.solana\.com|solana\.api\.onfinality\.io)$/i
| table([@timestamp, aid, ComputerName, ContextBaseFileName, DomainName])
| sort(@timestamp, order=desc)

event.type = 'DNS Resolved' and event.dns.request = *
| limit 5
| columns event.type, src.process.name, event.dns.request

// HUNT: ovhcloud process resolving Solana RPC hostnames
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1102, T1041
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a DNS resolution of one of the five Solana RPC hostnames by a process named ovhcloud. The resolving process is src.process.name on DNS events, and matches is case-insensitive, which reproduces the CQL intent.
// REQUIRES: SentinelOne DNS telemetry with process context
// TUNING: None expected.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A resolution made through a proxy or a DNS-over-HTTPS client is not recorded as a DNS Resolved event.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' and src.process.name matches '^ovhcloud(\\.exe)?$' and event.dns.request matches '^(solana\\.drpc\\.org|solana[-]rpc\\.publicnode\\.com|solana\\.api\\.pocket\\.network|api\\.mainnet[-]beta\\.solana\\.com|solana\\.api\\.onfinality\\.io)$'
| columns event.time, endpoint.name, agent.uuid, src.process.name, event.dns.request
| sort -event.time
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields, InitiatingProcessFileName
| take 5

// HUNT: ovhcloud process resolving Solana RPC hostnames
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1102, T1041
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on the DNS query action in DeviceEvents: the queried name is one of the five hostnames and the initiating process is ovhcloud. The name is read from AdditionalFields because there is no endpoint DNS table.
// REQUIRES: Defender for Endpoint DNS query events (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: None expected.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Tenants that do not record DnsQueryResponse return nothing here, which reads as a clean estate.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "DnsQueryResponse"
| where InitiatingProcessFileName in~ ("ovhcloud", "ovhcloud.exe")
| extend QueryName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where QueryName matches regex @"(?i)^(solana\.drpc\.org|solana[-]rpc\.publicnode\.com|solana\.api\.pocket\.network|api\.mainnet[-]beta\.solana\.com|solana\.api\.onfinality\.io)$"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, QueryName
| sort by Timestamp desc
| take 200

// HUNT: Solana RPC hostname lookups by any process
// MITRE: T1102
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Falcon sensor DNS telemetry
// FALSE POSITIVES: crypto wallets, blockchain developer tooling, Solana node or explorer apps
// TUNING: exclude known wallet/dev hosts with a lookup table of ComputerName or aid; alert only on hosts with no blockchain role (build runners, servers, CI agents)
// LOOKBACK: 7d
#event_simpleName=DnsRequest
| DomainName=/^(solana\.drpc\.org|solana\-rpc\.publicnode\.com|solana\.api\.pocket\.network|api\.mainnet\-beta\.solana\.com|solana\.api\.onfinality\.io)$/i
| groupBy([ComputerName, aid, ContextBaseFileName, DomainName], function=[count(as=lookups), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)], limit=1000)
| sort(lookups, order=desc)
| table([ComputerName, aid, ContextBaseFileName, DomainName, lookups, first_seen, last_seen])

event.type = 'DNS Resolved' and event.dns.request = *
| limit 5
| columns event.time, endpoint.name, event.type, event.dns.request

// HUNT: Solana RPC hostname lookups by any process
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1102
// CONF: medium | FP: medium
// FALSE POSITIVES: crypto wallets, blockchain developer tooling, Solana node or explorer apps
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate and aggregation: DNS lookups of the five Solana RPC hostnames by any process, counted per host, process and name with first and last seen.
// REQUIRES: SentinelOne DNS telemetry
// TUNING: Exclude known wallet and developer hosts with a lookup table of endpoint names; alert only on hosts with no blockchain role (build runners, servers, CI agents).
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A resolution made through a proxy or a DNS-over-HTTPS client is not recorded as a DNS Resolved event.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' and event.dns.request matches '^(solana\\.drpc\\.org|solana[-]rpc\\.publicnode\\.com|solana\\.api\\.pocket\\.network|api\\.mainnet[-]beta\\.solana\\.com|solana\\.api\\.onfinality\\.io)$'
| group lookups=count(), first_seen=min(event.time), last_seen=max(event.time) by endpoint.name, agent.uuid, src.process.name, event.dns.request
| sort -lookups
| columns endpoint.name, agent.uuid, src.process.name, event.dns.request, lookups, first_seen, last_seen
| limit 1000

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, DeviceName, ActionType, AdditionalFields
| take 5

// HUNT: Solana RPC hostname lookups by any process
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1102
// CONF: medium | FP: medium
// FALSE POSITIVES: crypto wallets, blockchain developer tooling, Solana node or explorer apps
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate and aggregation on the DNS query action in DeviceEvents, with the name read from AdditionalFields because there is no endpoint DNS table.
// REQUIRES: Defender for Endpoint DNS query events (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: Exclude known wallet and developer hosts by DeviceName; alert only on hosts with no blockchain role.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Tenants that do not record DnsQueryResponse return nothing here, which reads as a clean estate.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "DnsQueryResponse"
| extend QueryName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where QueryName matches regex @"(?i)^(solana\.drpc\.org|solana[-]rpc\.publicnode\.com|solana\.api\.pocket\.network|api\.mainnet[-]beta\.solana\.com|solana\.api\.onfinality\.io)$"
| summarize lookups = count(), first_seen = min(Timestamp), last_seen = max(Timestamp) by DeviceName, DeviceId, InitiatingProcessFileName, QueryName
| sort by lookups desc
| take 1000

// HUNT: ovhcloud spawning shell or credential-collection children
// MITRE: T1119, T1552.001, T1059
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Falcon sensor process telemetry with parent process
// FALSE POSITIVES: CLI subcommands that shell out (ssh helpers, browser launchers), wrapper scripts
// TUNING: exclude parent command lines of sanctioned wrapper scripts after a 14-day baseline; keep the shell and archiver children
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^ovhcloud(\.exe)?$/i
| FileName=/^(sh|bash|zsh|dash|cmd|powershell|pwsh|security|aws|gcloud|az|doctl|kubectl|docker|git|npm|terraform|tar|zip|curl|wget|sqlite3|osascript|7z|7za)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' and tgt.process.name = *
| limit 5
| columns event.type, src.process.name, tgt.process.name

// HUNT: ovhcloud spawning shell or credential-collection children
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1119, T1552.001, T1059
// CONF: medium | FP: medium
// FALSE POSITIVES: CLI subcommands that shell out (ssh helpers, browser launchers), wrapper scripts
// EQUIVALENCE: equivalent-with-schema-assumptions - Same lineage predicate: a process named ovhcloud is the creator and the created process is a shell, archiver, cloud CLI or credential tool. On Process Creation the creator is src.process.name and the new process is tgt.process.name. matches is case-insensitive, which reproduces the CQL intent.
// REQUIRES: SentinelOne process-creation telemetry with creator process
// TUNING: Exclude creator command lines of sanctioned wrapper scripts after a 14-day baseline; keep the shell and archiver children.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A child launched through a process that is not named ovhcloud, such as a renamed copy, is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and src.process.name matches '^ovhcloud(\\.exe)?$' and tgt.process.name matches '^(sh|bash|zsh|dash|cmd|powershell|pwsh|security|aws|gcloud|az|doctl|kubectl|docker|git|npm|terraform|tar|zip|curl|wget|sqlite3|osascript|7z|7za)(\\.exe)?$'
| columns event.time, endpoint.name, agent.uuid, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName
| take 5

// HUNT: ovhcloud spawning shell or credential-collection children
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1119, T1552.001, T1059
// CONF: medium | FP: medium
// FALSE POSITIVES: CLI subcommands that shell out (ssh helpers, browser launchers), wrapper scripts
// EQUIVALENCE: equivalent-with-schema-assumptions - Same lineage predicate: the initiating process is named ovhcloud and the created process is a shell, archiver, cloud CLI or credential tool. The CQL's parent field is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude initiating command lines of sanctioned wrapper scripts after a 14-day baseline; keep the shell and archiver children.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A child launched through a process that is not named ovhcloud is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName matches regex @"(?i)^ovhcloud(\.exe)?$"
| where FileName matches regex @"(?i)^(sh|bash|zsh|dash|cmd|powershell|pwsh|security|aws|gcloud|az|doctl|kubectl|docker|git|npm|terraform|tar|zip|curl|wget|sqlite3|osascript|7z|7za)(\.exe)?$"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Command line referencing an envchecker-NNNNNNNNN folder
// MITRE: T1119, T1560
// CONF: low
// FP: low
// COST: low
// REQUIRES: Falcon sensor process telemetry
// FALSE POSITIVES: none expected
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/envchecker-[0-9]{9,10}/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' and tgt.process.cmdline = *
| limit 5
| columns event.type, tgt.process.cmdline

// HUNT: Command line referencing an envchecker-NNNNNNNNN folder
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1119, T1560
// CONF: low | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a process-creation command line containing envchecker- followed by nine or ten digits. matches is case-insensitive, which reproduces the CQL intent.
// REQUIRES: SentinelOne process-creation telemetry with command lines
// TUNING: None expected.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The folder name is only seen when it appears on a created process's command line; file activity inside it is not covered.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and tgt.process.cmdline matches 'envchecker-[0-9]{9,10}'
| columns event.time, endpoint.name, agent.uuid, src.process.user, tgt.process.name, src.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: Command line referencing an envchecker-NNNNNNNNN folder
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1119, T1560
// CONF: low | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a created process whose command line contains envchecker- followed by nine or ten digits. The (?i) prefix reproduces the CQL case-insensitive intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The folder name is only seen on a created process's command line; file activity inside it is not covered.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine matches regex @"(?i)envchecker-[0-9]{9,10}"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, InitiatingProcessFileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: ovhcloud execution inventory with hashes
// MITRE: T1195.002, T1204.002
// CONF: high
// FP: low
// COST: low
// REQUIRES: Falcon sensor process telemetry
// FALSE POSITIVES: none, inventory query
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^ovhcloud(\.exe)?$/i
| groupBy([ComputerName, aid, ImageFileName, MD5HashData, SHA256HashData], function=[count(as=runs), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)], limit=1000)
| sort(last_seen, order=desc)
| table([ComputerName, aid, ImageFileName, MD5HashData, SHA256HashData, runs, first_seen, last_seen])

event.type = 'Process Creation' and tgt.process.name = *
| limit 5
| columns event.time, endpoint.name, event.type, tgt.process.name, tgt.process.image.sha256

// HUNT: ovhcloud execution inventory with hashes
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1195.002, T1204.002
// CONF: high | FP: low
// FALSE POSITIVES: none, inventory query
// EQUIVALENCE: equivalent-with-schema-assumptions - Same inventory: process starts of a binary named ovhcloud, counted per host and image with its hashes and first and last seen. The new process is tgt.process.* on Process Creation.
// REQUIRES: SentinelOne process-creation telemetry with image hashes
// TUNING: Compare each hash with the replaced-binary list on Q1; any other hash is a different build.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A copy of the CLI renamed to something else is not inventoried.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and tgt.process.name matches '^ovhcloud(\\.exe)?$'
| group runs=count(), first_seen=min(event.time), last_seen=max(event.time) by endpoint.name, agent.uuid, tgt.process.image.path, tgt.process.image.md5, tgt.process.image.sha256
| sort -last_seen
| columns endpoint.name, agent.uuid, tgt.process.image.path, tgt.process.image.md5, tgt.process.image.sha256, runs, first_seen, last_seen
| limit 1000

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceName, FileName, FolderPath, MD5
| take 5

// HUNT: ovhcloud execution inventory with hashes
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1195.002, T1204.002
// CONF: high | FP: low
// FALSE POSITIVES: none, inventory query
// EQUIVALENCE: equivalent-with-schema-assumptions - Same inventory: process starts of a binary named ovhcloud, counted per host and image with its hashes and first and last seen.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Compare each hash with the replaced-binary list on Q1; any other hash is a different build.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A copy of the CLI renamed to something else is not inventoried.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName matches regex @"(?i)^ovhcloud(\.exe)?$"
| summarize runs = count(), first_seen = min(Timestamp), last_seen = max(Timestamp) by DeviceName, DeviceId, FolderPath, MD5, SHA256
| sort by last_seen desc
| take 1000

// HUNT: OVHcloud CLI release archive download or install.sh run
// MITRE: T1195.002, T1105
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Falcon sensor process telemetry
// FALSE POSITIVES: legitimate installs and CI jobs outside 2026-10-19 12:47-14:21 UTC
// TUNING: restrict the time picker to 2026-10-19 12:47 to 14:21 UTC for exposure scoping; outside that window these are normal installs
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/ovhcloud-cli/i
| CommandLine=/(releases.download|install\.sh|ovh.tap.ovhcloud-cli|ovhcloud-cli_(Linux|Darwin|Windows)_(x86_64|arm64)\.(tar\.gz|zip))/i
| FileName=/^(curl|wget|sh|bash|zsh|dash|brew|powershell|pwsh|python3?|ruby|ovhcloud)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' and tgt.process.cmdline = *
| limit 5
| columns event.type, tgt.process.name, tgt.process.cmdline

// HUNT: OVHcloud CLI release archive download or install.sh run
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1195.002, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: legitimate installs and CI jobs outside 2026-10-19 12:47-14:21 UTC
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a created process from a downloader, shell, interpreter or the CLI itself whose command line names ovhcloud-cli and a release download, install script, tap or release archive. Both regexes are kept as written; matches is case-insensitive, which reproduces the CQL intent.
// REQUIRES: SentinelOne process-creation telemetry with command lines
// TUNING: Restrict the time picker to 2026-10-19 12:47 to 14:21 UTC for exposure scoping; outside that window these are normal installs.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A download made by a process outside the listed names, such as a browser, is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' and tgt.process.name matches '^(curl|wget|sh|bash|zsh|dash|brew|powershell|pwsh|python3?|ruby|ovhcloud)(\\.exe)?$' and tgt.process.cmdline matches 'ovhcloud-cli' and tgt.process.cmdline matches '(releases.download|install\\.sh|ovh.tap.ovhcloud-cli|ovhcloud-cli_(Linux|Darwin|Windows)_(x86_64|arm64)\\.(tar\\.gz|zip))'
| columns event.time, endpoint.name, agent.uuid, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: OVHcloud CLI release archive download or install.sh run
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1195.002, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: legitimate installs and CI jobs outside 2026-10-19 12:47-14:21 UTC
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a created process from a downloader, shell, interpreter or the CLI itself whose command line names ovhcloud-cli and a release download, install script, tap or release archive. The (?i) prefix reproduces the CQL case-insensitive intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Restrict the time range to 2026-10-19 12:47 to 14:21 UTC for exposure scoping; outside that window these are normal installs.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A download made by a process outside the listed names, such as a browser, is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName matches regex @"(?i)^(curl|wget|sh|bash|zsh|dash|brew|powershell|pwsh|python3?|ruby|ovhcloud)(\.exe)?$"
| where ProcessCommandLine contains "ovhcloud-cli"
| where ProcessCommandLine matches regex @"(?i)(releases.download|install\.sh|ovh.tap.ovhcloud-cli|ovhcloud-cli_(Linux|Darwin|Windows)_(x86_64|arm64)\.(tar\.gz|zip))"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Public destinations contacted by ovhcloud
// MITRE: T1041, T1071.001
// CONF: low
// FP: medium
// COST: low
// REQUIRES: Falcon sensor network telemetry with process name
// FALSE POSITIVES: OVHcloud API endpoints, proxies, CDN addresses used by the real CLI
// TUNING: baseline 14 days of ovhcloud egress, then exclude the stable OVHcloud API addresses and your proxy; review what is left
// LOOKBACK: 7d
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^ovhcloud(\.exe)?$/i
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","127.0.0.0/8"])
| groupBy([ComputerName, aid, RemoteAddressIP4, RemotePort], function=[count(as=conns), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)], limit=1000)
| sort(conns, order=desc)
| table([ComputerName, aid, RemoteAddressIP4, RemotePort, conns, first_seen, last_seen])

event.type = 'IP Connect' and dst.ip.address = *
| limit 5
| columns event.time, endpoint.name, event.type, src.process.name, dst.ip.address

// HUNT: Public destinations contacted by ovhcloud
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1041, T1071.001
// CONF: low | FP: medium
// FALSE POSITIVES: OVHcloud API endpoints, proxies, CDN addresses used by the real CLI
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate and aggregation: IP connections by a process named ovhcloud to destinations outside 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 and 127.0.0.0/8, counted per host, address and port. The connecting process is src.process.name on IP Connect events.
// REQUIRES: SentinelOne network (IP Connect) telemetry with process name
// TUNING: Baseline 14 days of ovhcloud egress, then exclude the stable OVHcloud API addresses and your proxy; review what is left.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connections through a proxy appear as the proxy address only.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' and src.process.name matches '^ovhcloud(\\.exe)?$' and !(net_ipsubnet(dst.ip.address, '10.0.0.0/8') or net_ipsubnet(dst.ip.address, '172.16.0.0/12') or net_ipsubnet(dst.ip.address, '192.168.0.0/16') or net_ipsubnet(dst.ip.address, '127.0.0.0/8'))
| group conns=count(), first_seen=min(event.time), last_seen=max(event.time) by endpoint.name, agent.uuid, dst.ip.address, dst.port.number
| sort -conns
| columns endpoint.name, agent.uuid, dst.ip.address, dst.port.number, conns, first_seen, last_seen
| limit 1000

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP
| take 5

// HUNT: Public destinations contacted by ovhcloud
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1041, T1071.001
// CONF: low | FP: medium
// FALSE POSITIVES: OVHcloud API endpoints, proxies, CDN addresses used by the real CLI
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate and aggregation: network events by a process named ovhcloud to remote addresses outside 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 and 127.0.0.0/8, counted per host, address and port.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Baseline 14 days of ovhcloud egress, then exclude the stable OVHcloud API addresses and your proxy; review what is left.
// LOOKBACK: 7d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connections through a proxy appear as the proxy address only.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName matches regex @"(?i)^ovhcloud(\.exe)?$"
| where not(ipv4_is_in_range(RemoteIP, "10.0.0.0/8") or ipv4_is_in_range(RemoteIP, "172.16.0.0/12") or ipv4_is_in_range(RemoteIP, "192.168.0.0/16") or ipv4_is_in_range(RemoteIP, "127.0.0.0/8"))
| summarize conns = count(), first_seen = min(Timestamp), last_seen = max(Timestamp) by DeviceName, DeviceId, RemoteIP, RemotePort
| sort by conns desc
| take 1000