QuartzLine (CLOUDHAZE): A Working PDF Viewer with the zenith Backdoor

// HUNT: QuartzLine family scheduled tasks registered
// MITRE: T1053.005
// CONF: high  FP: low  COST: low
// REQUIRES: Windows sensor with scheduled task registration telemetry
// FALSE POSITIVES: None expected. The task names are specific to this campaign.
// LOOKBACK: 30d
#event_simpleName=ScheduledTaskRegistered
| TaskName=/(quartzlineupdatecheck|cairaservicecheck|ironbarkupdatecheck|hosthealthcache(check|cleanup)-[0-9a-f]{32})/i
| table([@timestamp, ComputerName, UserName, TaskName, TaskExecutable])
| sort(@timestamp, order=desc, limit=200)

event.type = 'Registry Value Modified' registry.keyPath = *
| limit 5
| columns event.type, event.time, endpoint.name, registry.keyPath

// HUNT: QuartzLine family scheduled tasks registered
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1053.005
// CONF: high | FP: low
// FALSE POSITIVES: None expected. The task names are specific to this campaign.
// EQUIVALENCE: approximate-analytic - SentinelOne has no attested scheduled-task registration event, so the hunt watches the Task Scheduler registry cache instead: a value written under TaskCache\Tree for one of the campaign task names. That fires for any registration method, but it keys on the registry write rather than the task-registration event.
// REQUIRES: SentinelOne Registry Value Modified telemetry for the Task Scheduler cache keys
// TUNING: None needed; the task names are specific to this campaign. Pivot on src.process.name to see what registered the task.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A task registered through a path that does not write the cache key under the monitored hive is not seen. The CQL's task executable field has no equivalent here; read the action from the host after a hit.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified'
registry.keyPath matches '\\\\TaskCache\\\\Tree\\\\.*(quartzlineupdatecheck|cairaservicecheck|ironbarkupdatecheck|hosthealthcache(check|cleanup)-[0-9a-f]{32})'
| columns event.time, endpoint.name, src.process.user, registry.keyPath, registry.valueName, registry.value, src.process.name, agent.uuid
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "ScheduledTaskCreated"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: QuartzLine family scheduled tasks registered
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1053.005
// CONF: high | FP: low
// FALSE POSITIVES: None expected. The task names are specific to this campaign.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a scheduled task creation whose task name matches the campaign pattern. The task name is read from the action's additional fields. matches regex with the (?i) prefix reproduces the CQL /i flag.
// REQUIRES: Defender for Endpoint scheduled-task telemetry (DeviceEvents, ScheduledTaskCreated)
// TUNING: None needed; the task names are specific to this campaign.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Tasks created before the sensor onboarded, or on hosts that do not report this action type, are not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "ScheduledTaskCreated"
| extend TaskName = tostring(parse_json(AdditionalFields)["TaskName"])
| where TaskName matches regex @"(?i)(quartzlineupdatecheck|cairaservicecheck|ironbarkupdatecheck|hosthealthcache(check|cleanup)-[0-9a-f]{32})"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, TaskName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Executables running from the per-user install folders
// MITRE: T1036.005, T1204.002
// CONF: high  FP: medium  COST: low
// REQUIRES: Windows process creation telemetry with image path
// FALSE POSITIVES: A legitimate product that installs into a folder named Quartz, Canvex or PaperLine.
// TUNING: If a folder name belongs to a sanctioned product, drop that name from the group and confirm by SHA256HashData and signer before excluding.
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ImageFileName=/\\AppData\\Local\\(QuartzLine|Quartz|Caira|IronBark|HostHealthCache|DevicePerfCache|PaperLine|Canvex)\\[^\\]+\.exe$/i
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])
| sort(@timestamp, order=desc, limit=200)

event.type = 'Process Creation' tgt.process.image.path = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.process.image.path

// HUNT: Executables running from the per-user install folders
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1036.005, T1204.002
// CONF: high | FP: medium
// FALSE POSITIVES: A legitimate product that installs into a folder named Quartz, Canvex or PaperLine.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a created process whose image sits directly in one of the per-user install folders under AppData Local and ends in .exe. On a Process Creation event the created process is tgt.process.*.
// REQUIRES: SentinelOne Process Creation telemetry with the image path
// TUNING: If a folder name belongs to a sanctioned product, drop that name from the group and confirm by hash and signer before excluding.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.image.path matches '\\\\AppData\\\\Local\\\\(QuartzLine|Quartz|Caira|IronBark|HostHealthCache|DevicePerfCache|PaperLine|Canvex)\\\\[^\\\\]+\\.exe$'
| columns event.time, endpoint.name, src.process.user, tgt.process.image.path, tgt.process.cmdline, src.process.name, tgt.process.image.sha256, agent.uuid
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FolderPath, ProcessCommandLine
| take 5

// HUNT: Executables running from the per-user install folders
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1036.005, T1204.002
// CONF: high | FP: medium
// FALSE POSITIVES: A legitimate product that installs into a folder named Quartz, Canvex or PaperLine.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a created process whose full path sits directly in one of the per-user install folders under AppData Local and ends in .exe. matches regex with the (?i) prefix reproduces the CQL /i flag.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: If a folder name belongs to a sanctioned product, drop that name from the group and confirm by hash and signer before excluding.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FolderPath matches regex @"(?i)\\AppData\\Local\\(QuartzLine|Quartz|Caira|IronBark|HostHealthCache|DevicePerfCache|PaperLine|Canvex)\\[^\\]+\.exe$"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FolderPath, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Scheduled-task launches of the implant (--update-check / --check)
// MITRE: T1053.005
// CONF: high  FP: low  COST: low
// REQUIRES: Windows process creation telemetry with command line
// FALSE POSITIVES: None expected. A product that happens to be called caira.exe with these exact flags would be rare.
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(quartzline|caira|ironbark)\.exe$/i
| CommandLine=/--(update-check|check)\b/i
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])
| sort(@timestamp, order=desc, limit=200)

event.type = 'Process Creation' tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.process.name, tgt.process.cmdline

// HUNT: Scheduled-task launches of the implant (--update-check / --check)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1053.005
// CONF: high | FP: low
// FALSE POSITIVES: None expected. A product that happens to be called caira.exe with these exact flags would be rare.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a created process named quartzline, caira or ironbark whose command line carries the update-check or check flag. On a Process Creation event the created process is tgt.process.*.
// REQUIRES: SentinelOne Process Creation telemetry with the command line
// TUNING: None needed; confirm the hit is not a product that happens to share the name and flags.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name matches '^(quartzline|caira|ironbark)\\.exe$'
tgt.process.cmdline matches '--(update-check|check)\\b'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha256, agent.uuid
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: Scheduled-task launches of the implant (--update-check / --check)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1053.005
// CONF: high | FP: low
// FALSE POSITIVES: None expected. A product that happens to be called caira.exe with these exact flags would be rare.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a created process named quartzline, caira or ironbark whose command line carries the update-check or check flag. matches regex with the (?i) prefix reproduces the CQL /i flag.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None needed; confirm the hit is not a product that happens to share the name and flags.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName matches regex @"(?i)^(quartzline|caira|ironbark)\.exe$"
| where ProcessCommandLine matches regex @"(?i)--(update-check|check)\b"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Known QuartzLine family hashes executed or written
// MITRE: T1204.002, T1105
// CONF: high  FP: low  COST: low
// REQUIRES: Windows process and file-write telemetry with SHA-256
// FALSE POSITIVES: None expected for the hash set. See the IOC table for which hashes are prevent and which are detect.
// LOOKBACK: 90d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| SHA256HashData=/^(7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3|25ea334b75beede8dcab4c4460313c3013c35e55c16cd066231d80ecfe4c0653|069fd1e710b341fbe92337116779e6b50a40408f55f6547252cd2c05fe9c0527|74aaa6b54133bbb2e77b2ae874e9900a907c269058f798a0a1197288ba1f7124|d287a970294d54db5ab3ac5f7e9525c303b9aceac7117b165385c5655717333b|4c073764737e96fecf9d3e28384b2db628446c512c2df3696689d0c5e045b811|3c813ea19ff2e3e2cf566ec69753ba637bb243b4b4e8416dc8ebf68e93016a1d|0fa4082c6fda0c2885eade0e4f63a2abfeaa26581f903e6784682f5fbd9d0d77|f4e255dfdf3d23774b0067797cac0f986f1690abbeec217eb60029dcaa7425f8|835800058050be37366478c662f73d7fcb93a2669e44f98664546fbc8ee6c7ca|8644bb2ba39ddad352e82cc8fc827986940dec126527ed1cb6fa532e002bea86|90ddbf4be95b271de76384f4939eb6f165aa9461f8383a6e6f000f9256b34f97)$/i
| table([@timestamp, #event_simpleName, ComputerName, UserName, FileName, ImageFileName, TargetFileName, SHA256HashData, CommandLine])
| sort(@timestamp, order=desc, limit=200)

event.type = 'File Creation' tgt.file.sha256 = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.process.image.sha256, tgt.file.sha256

// HUNT: Known QuartzLine family hashes executed or written
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.002, T1105
// CONF: high | FP: low
// FALSE POSITIVES: None expected for the hash set. See the IOC table for which hashes are prevent and which are detect.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the SHA-256 of a started process or of a file written to disk is one of the twelve published family hashes. The process half reads the created process hash and the file half reads the written file hash.
// REQUIRES: SentinelOne Process Creation and File Creation telemetry with SHA-256
// TUNING: None needed for the hash set. The IOC table says which hashes are prevent and which are detect.
// LOOKBACK: 30d on this tab; the CQL tab covers 90d. Set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A file modified in place after it was written is not matched by File Creation.
// VALIDATION LEVEL: static-reviewed
(event.type = 'Process Creation' tgt.process.image.sha256 in:anycase ('7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3','25ea334b75beede8dcab4c4460313c3013c35e55c16cd066231d80ecfe4c0653','069fd1e710b341fbe92337116779e6b50a40408f55f6547252cd2c05fe9c0527','74aaa6b54133bbb2e77b2ae874e9900a907c269058f798a0a1197288ba1f7124','d287a970294d54db5ab3ac5f7e9525c303b9aceac7117b165385c5655717333b','4c073764737e96fecf9d3e28384b2db628446c512c2df3696689d0c5e045b811','3c813ea19ff2e3e2cf566ec69753ba637bb243b4b4e8416dc8ebf68e93016a1d','0fa4082c6fda0c2885eade0e4f63a2abfeaa26581f903e6784682f5fbd9d0d77','f4e255dfdf3d23774b0067797cac0f986f1690abbeec217eb60029dcaa7425f8','835800058050be37366478c662f73d7fcb93a2669e44f98664546fbc8ee6c7ca','8644bb2ba39ddad352e82cc8fc827986940dec126527ed1cb6fa532e002bea86','90ddbf4be95b271de76384f4939eb6f165aa9461f8383a6e6f000f9256b34f97')) or (event.type = 'File Creation' tgt.file.sha256 in:anycase ('7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3','25ea334b75beede8dcab4c4460313c3013c35e55c16cd066231d80ecfe4c0653','069fd1e710b341fbe92337116779e6b50a40408f55f6547252cd2c05fe9c0527','74aaa6b54133bbb2e77b2ae874e9900a907c269058f798a0a1197288ba1f7124','d287a970294d54db5ab3ac5f7e9525c303b9aceac7117b165385c5655717333b','4c073764737e96fecf9d3e28384b2db628446c512c2df3696689d0c5e045b811','3c813ea19ff2e3e2cf566ec69753ba637bb243b4b4e8416dc8ebf68e93016a1d','0fa4082c6fda0c2885eade0e4f63a2abfeaa26581f903e6784682f5fbd9d0d77','f4e255dfdf3d23774b0067797cac0f986f1690abbeec217eb60029dcaa7425f8','835800058050be37366478c662f73d7fcb93a2669e44f98664546fbc8ee6c7ca','8644bb2ba39ddad352e82cc8fc827986940dec126527ed1cb6fa532e002bea86','90ddbf4be95b271de76384f4939eb6f165aa9461f8383a6e6f000f9256b34f97'))
| columns event.type, event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.sha256, tgt.file.path, tgt.file.sha256, agent.uuid
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, SHA256, FolderPath
| take 5

// HUNT: Known QuartzLine family hashes executed or written
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.002, T1105
// CONF: high | FP: low
// FALSE POSITIVES: None expected for the hash set. See the IOC table for which hashes are prevent and which are detect.
// EQUIVALENCE: telemetry-gap - Partial pivot: only the file-written half is shown, on DeviceFileEvents. The process-execution half needs a second table and the gate accepts one table per query. SHA256 is often unpopulated, and SHA1 is not in the published indicator set.
// REQUIRES: Defender for Endpoint file-event telemetry (DeviceFileEvents) with SHA256 populated
// TUNING: Run the CQL tab for the process-execution half. Check SHA256 population before trusting an empty result.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A started process whose image was not written inside the window is not matched; the process-execution half is not covered. Advanced Hunting keeps 30 days, so hashes seen between 31 and 90 days ago appear only on the CQL tab. SHA256 is often unpopulated; an empty result is not proof of absence.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where SHA256 in~ ("7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3", "25ea334b75beede8dcab4c4460313c3013c35e55c16cd066231d80ecfe4c0653", "069fd1e710b341fbe92337116779e6b50a40408f55f6547252cd2c05fe9c0527", "74aaa6b54133bbb2e77b2ae874e9900a907c269058f798a0a1197288ba1f7124", "d287a970294d54db5ab3ac5f7e9525c303b9aceac7117b165385c5655717333b", "4c073764737e96fecf9d3e28384b2db628446c512c2df3696689d0c5e045b811", "3c813ea19ff2e3e2cf566ec69753ba637bb243b4b4e8416dc8ebf68e93016a1d", "0fa4082c6fda0c2885eade0e4f63a2abfeaa26581f903e6784682f5fbd9d0d77", "f4e255dfdf3d23774b0067797cac0f986f1690abbeec217eb60029dcaa7425f8", "835800058050be37366478c662f73d7fcb93a2669e44f98664546fbc8ee6c7ca", "8644bb2ba39ddad352e82cc8fc827986940dec126527ed1cb6fa532e002bea86", "90ddbf4be95b271de76384f4939eb6f165aa9461f8383a6e6f000f9256b34f97")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FileName, FolderPath, SHA256
| sort by Timestamp desc
| take 200

// HUNT: DNS lookups for QuartzLine, Caira, IronBark and LeafDesk infrastructure
// MITRE: T1071.001, T1583.008
// CONF: high  FP: low  COST: low
// REQUIRES: Windows DNS request telemetry with requesting process
// FALSE POSITIVES: None expected. A hit from a browser means the user reached the ad chain or a hijacked search page. A hit from quartzline.exe, caira.exe or ironbark.exe means active C2.
// LOOKBACK: 30d
#event_simpleName=DnsRequest
| DomainName=/((^|\.)(westbeavers|motherotters|healskills|topsmagnificentgrade|tabbyottercub|flawlessgradecheered|foxsilk|runnerfrogs|fasterhedgehogs|commonhedgehogs|guessgooseberries|biggerworldclassstandard|beatramiro|softwareslizards|purplepandagroup|royalproductive|pinkexploratorysearch|smallerbestsearch|searchedvictoryresults)\.com$|^thankyou\.(molehawks|charlottedetector)\.com$)/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, DomainName])
| sort(@timestamp, order=desc, limit=200)

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.type, event.time, endpoint.name, event.dns.request, src.process.name

// HUNT: DNS lookups for QuartzLine, Caira, IronBark and LeafDesk infrastructure
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1583.008
// CONF: high | FP: low
// FALSE POSITIVES: None expected. A hit from a browser means the user reached the ad chain or a hijacked search page. A hit from quartzline.exe, caira.exe or ironbark.exe means active C2.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a DNS resolution for one of the campaign second-level domains, or the two thankyou hosts. The acting process on a DNS event is src.process.*.
// REQUIRES: SentinelOne DNS Resolved telemetry with the requesting process
// TUNING: None needed. A browser hit means the user reached the ad chain or a hijacked search page; a hit from quartzline.exe, caira.exe or ironbark.exe means active C2.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: Lookups answered from a cache the agent does not see are not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved'
event.dns.request matches '((^|\\.)(westbeavers|motherotters|healskills|topsmagnificentgrade|tabbyottercub|flawlessgradecheered|foxsilk|runnerfrogs|fasterhedgehogs|commonhedgehogs|guessgooseberries|biggerworldclassstandard|beatramiro|softwareslizards|purplepandagroup|royalproductive|pinkexploratorysearch|smallerbestsearch|searchedvictoryresults)\\.com$|^thankyou\\.(molehawks|charlottedetector)\\.com$)'
| columns event.time, endpoint.name, src.process.user, event.dns.request, src.process.name, src.process.image.path, agent.uuid
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: DNS lookups for QuartzLine, Caira, IronBark and LeafDesk infrastructure
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1583.008
// CONF: high | FP: low
// FALSE POSITIVES: None expected. A hit from a browser means the user reached the ad chain or a hijacked search page. A hit from quartzline.exe, caira.exe or ironbark.exe means active C2.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on the DNS name. Defender has no endpoint DNS table, so the name comes from the DnsQueryResponse action's additional fields. matches regex with the (?i) prefix reproduces the CQL /i flag.
// REQUIRES: Defender for Endpoint DNS response telemetry (DeviceEvents, DnsQueryResponse)
// TUNING: None needed. A browser hit means the user reached the ad chain or a hijacked search page; a hit from quartzline.exe, caira.exe or ironbark.exe means active C2.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Hosts that do not report DnsQueryResponse show nothing; an empty result is not proof of absence.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| extend QueryName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where QueryName matches regex @"(?i)((^|\.)(westbeavers|motherotters|healskills|topsmagnificentgrade|tabbyottercub|flawlessgradecheered|foxsilk|runnerfrogs|fasterhedgehogs|commonhedgehogs|guessgooseberries|biggerworldclassstandard|beatramiro|softwareslizards|purplepandagroup|royalproductive|pinkexploratorysearch|smallerbestsearch|searchedvictoryresults)\.com$|^thankyou\.(molehawks|charlottedetector)\.com$)"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, QueryName, InitiatingProcessFileName, InitiatingProcessFolderPath
| sort by Timestamp desc
| take 200

// HUNT: DNS lookups for the campaign S3 buckets (exact bucket hosts only)
// MITRE: T1105, T1567.002
// CONF: medium  FP: low  COST: low
// REQUIRES: Windows DNS request telemetry with requesting process
// FALSE POSITIVES: A bucket name could be reused by an unrelated owner after takedown. Do not block amazonaws.com or S3 broadly.
// LOOKBACK: 30d
#event_simpleName=DnsRequest
| DomainName=/^(duskhollow|chrome-history-backup|alberfine|tidefern|leolin15)\.s3\.us-east-2\.amazonaws\.com$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, DomainName])
| sort(@timestamp, order=desc, limit=200)

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.type, event.time, endpoint.name, event.dns.request, src.process.name

// HUNT: DNS lookups for the campaign S3 buckets (exact bucket hosts only)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1105, T1567.002
// CONF: medium | FP: low
// FALSE POSITIVES: A bucket name could be reused by an unrelated owner after takedown. Do not block amazonaws.com or S3 broadly.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a DNS resolution for one of the five exact S3 bucket hosts in us-east-2. The acting process on a DNS event is src.process.*.
// REQUIRES: SentinelOne DNS Resolved telemetry with the requesting process
// TUNING: Do not widen this to amazonaws.com or S3 broadly. A bucket name can be reused by an unrelated owner after takedown, so confirm the requesting process.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A bucket in another region, or a path-style URL on the shared S3 host, is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved'
event.dns.request matches '^(duskhollow|chrome-history-backup|alberfine|tidefern|leolin15)\\.s3\\.us-east-2\\.amazonaws\\.com$'
| columns event.time, endpoint.name, src.process.user, event.dns.request, src.process.name, src.process.image.path, agent.uuid
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: DNS lookups for the campaign S3 buckets (exact bucket hosts only)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1105, T1567.002
// CONF: medium | FP: low
// FALSE POSITIVES: A bucket name could be reused by an unrelated owner after takedown. Do not block amazonaws.com or S3 broadly.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on the DNS name. Defender has no endpoint DNS table, so the name comes from the DnsQueryResponse action's additional fields. matches regex with the (?i) prefix reproduces the CQL /i flag.
// REQUIRES: Defender for Endpoint DNS response telemetry (DeviceEvents, DnsQueryResponse)
// TUNING: Do not widen this to amazonaws.com or S3 broadly. A bucket name can be reused by an unrelated owner after takedown, so confirm the requesting process.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Hosts that do not report DnsQueryResponse show nothing; an empty result is not proof of absence.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| extend QueryName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where QueryName matches regex @"(?i)^(duskhollow|chrome-history-backup|alberfine|tidefern|leolin15)\.s3\.us-east-2\.amazonaws\.com$"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, QueryName, InitiatingProcessFileName, InitiatingProcessFolderPath
| sort by Timestamp desc
| take 200

// HUNT: Viewer or implant spawning shells and admin tools
// MITRE: T1059.003, T1059.001, T1053.005, T1033
// CONF: high  FP: low  COST: low
// REQUIRES: Windows process creation telemetry with parent name
// FALSE POSITIVES: None expected. A PDF viewer has no reason to start cmd, PowerShell, schtasks, findstr, taskkill or whoami.
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(quartzline|paperline|fielddesk|pagestone|leafdesk|caira|ironbark)\.exe$/i
| FileName=/^(cmd|powershell|schtasks|findstr|taskkill|whoami)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=200)

event.type = 'Process Creation' src.process.name = * tgt.process.name = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, tgt.process.name

// HUNT: Viewer or implant spawning shells and admin tools
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.003, T1059.001, T1053.005, T1033
// CONF: high | FP: low
// FALSE POSITIVES: None expected. A PDF viewer has no reason to start cmd, PowerShell, schtasks, findstr, taskkill or whoami.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a viewer or implant process creating a shell or admin tool. On a Process Creation event the creator is src.process.* and the created process is tgt.process.*, so the CQL's parent field maps to src.process.name.
// REQUIRES: SentinelOne Process Creation telemetry with the creating process
// TUNING: None needed; a PDF viewer has no reason to start these tools.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A shell started by a process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
src.process.name matches '^(quartzline|paperline|fielddesk|pagestone|leafdesk|caira|ironbark)\\.exe$'
tgt.process.name matches '^(cmd|powershell|schtasks|findstr|taskkill|whoami)\\.exe$'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, agent.uuid
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, InitiatingProcessFileName
| take 5

// HUNT: Viewer or implant spawning shells and admin tools
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.003, T1059.001, T1053.005, T1033
// CONF: high | FP: low
// FALSE POSITIVES: None expected. A PDF viewer has no reason to start cmd, PowerShell, schtasks, findstr, taskkill or whoami.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a viewer or implant process creating a shell or admin tool. The creator is InitiatingProcessFileName and the created process is FileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None needed; a PDF viewer has no reason to start these tools.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A shell started by a process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName in~ ("quartzline.exe", "paperline.exe", "fielddesk.exe", "pagestone.exe", "leafdesk.exe", "caira.exe", "ironbark.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "schtasks.exe", "findstr.exe", "taskkill.exe", "whoami.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Chrome relaunched with the crash-restore bubble hidden by a non-shell parent
// MITRE: T1176, T1539
// CONF: high  FP: medium  COST: low
// REQUIRES: Windows process creation telemetry with command line and parent name
// FALSE POSITIVES: Browser management or kiosk tools that restore sessions with the same flags.
// TUNING: Exclude parent names of sanctioned browser-management tools after confirming them. A parent of quartzline.exe, caira.exe or ironbark.exe is never benign.
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^chrome\.exe$/i
| CommandLine=/--hide-crash-restore-bubble/i
| CommandLine=/--restore-last-session/i
| ParentBaseFileName!=/^(explorer|chrome|msedge)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine])
| sort(@timestamp, order=desc, limit=200)

event.type = 'Process Creation' tgt.process.name = * tgt.process.cmdline = * src.process.name = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: Chrome relaunched with the crash-restore bubble hidden by a non-shell parent
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1176, T1539
// CONF: high | FP: medium
// FALSE POSITIVES: Browser management or kiosk tools that restore sessions with the same flags.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: chrome.exe created with both the crash-bubble and restore-session flags by a creator that is not explorer, chrome or msedge. The creator is src.process.* and the created process is tgt.process.*.
// REQUIRES: SentinelOne Process Creation telemetry with the command line and creating process
// TUNING: Exclude creators of sanctioned browser-management tools after confirming them. A creator of quartzline.exe, caira.exe or ironbark.exe is never benign.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A Chrome launch the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name matches '^chrome\\.exe$'
tgt.process.cmdline contains '--hide-crash-restore-bubble'
tgt.process.cmdline contains '--restore-last-session'
!(src.process.name matches '^(explorer|chrome|msedge)\\.exe$')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.cmdline, agent.uuid
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine, InitiatingProcessFileName
| take 5

// HUNT: Chrome relaunched with the crash-restore bubble hidden by a non-shell parent
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1176, T1539
// CONF: high | FP: medium
// FALSE POSITIVES: Browser management or kiosk tools that restore sessions with the same flags.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: chrome.exe created with both flags by a creator that is not explorer, chrome or msedge. The creator is InitiatingProcessFileName. contains is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude creators of sanctioned browser-management tools after confirming them. A creator of quartzline.exe, caira.exe or ironbark.exe is never benign.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A Chrome launch the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName =~ "chrome.exe"
| where ProcessCommandLine contains "--hide-crash-restore-bubble"
| where ProcessCommandLine contains "--restore-last-session"
| where InitiatingProcessFileName !in~ ("explorer.exe", "chrome.exe", "msedge.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: taskkill used against Chrome by a shell
// MITRE: T1059.003
// CONF: medium  FP: medium  COST: low
// REQUIRES: Windows process creation telemetry with command line and parent name
// FALSE POSITIVES: Help desk scripts and software updaters that close Chrome before patching.
// TUNING: Exclude known patching and help-desk parents. Keep any event within minutes of a Q2, Q3 or Q7 hit on the same ComputerName.
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^taskkill\.exe$/i
| CommandLine=/chrome\.exe/i
| ParentBaseFileName=/^(cmd|powershell)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine])
| sort(@timestamp, order=desc, limit=200)

event.type = 'Process Creation' tgt.process.name = * tgt.process.cmdline = * src.process.name = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: taskkill used against Chrome by a shell
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.003
// CONF: medium | FP: medium
// FALSE POSITIVES: Help desk scripts and software updaters that close Chrome before patching.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: taskkill.exe whose command line names chrome.exe, started by cmd or powershell. The creator is src.process.* and the created process is tgt.process.*.
// REQUIRES: SentinelOne Process Creation telemetry with the command line and creating process
// TUNING: Exclude known patching and help-desk creators. Keep any event within minutes of a Q2, Q3 or Q7 hit on the same host.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: taskkill started by a creator other than cmd or powershell is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name matches '^taskkill\\.exe$'
tgt.process.cmdline matches 'chrome\\.exe'
src.process.name matches '^(cmd|powershell)\\.exe$'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.cmdline, agent.uuid
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine, InitiatingProcessFileName
| take 5

// HUNT: taskkill used against Chrome by a shell
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.003
// CONF: medium | FP: medium
// FALSE POSITIVES: Help desk scripts and software updaters that close Chrome before patching.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: taskkill.exe whose command line names chrome.exe, started by cmd or powershell. The creator is InitiatingProcessFileName. contains is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude known patching and help-desk creators. Keep any event within minutes of a Q2, Q3 or Q7 hit on the same host.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: taskkill started by a creator other than cmd or powershell is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName =~ "taskkill.exe"
| where ProcessCommandLine contains "chrome.exe"
| where InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Installer, self-update and history-tool staging by command line
// MITRE: T1105, T1059.001, T1070.004, T1217
// CONF: high  FP: medium  COST: low
// REQUIRES: Windows process creation telemetry with command line
// FALSE POSITIVES: An internal deployment script that is also called replaceInPlace.ps1.
// TUNING: For replaceInPlace.ps1 keep only hits whose command line also names quartzline_new.exe, or whose host shows a Q1 to Q3 hit. Exclude your own software-distribution parents.
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(quartzline_new\.exe|replaceInPlace\.ps1|chrome-history-summarizer|quartzline_takeover_carrier|\\Caira\\deployment-[0-9a-f-]+\\deployApp\.ps1)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=200)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.process.cmdline

// HUNT: Installer, self-update and history-tool staging by command line
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1105, T1059.001, T1070.004, T1217
// CONF: high | FP: medium
// FALSE POSITIVES: An internal deployment script that is also called replaceInPlace.ps1.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a created process whose command line names one of the installer, self-update or history-tool staging artefacts. On a Process Creation event the created process is tgt.process.*.
// REQUIRES: SentinelOne Process Creation telemetry with the command line
// TUNING: For replaceInPlace.ps1 keep only hits whose command line also names quartzline_new.exe, or whose host shows a Q1 to Q3 hit. Exclude your own software-distribution creators.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A script started by a process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.cmdline matches '(quartzline_new\\.exe|replaceInPlace\\.ps1|chrome-history-summarizer|quartzline_takeover_carrier|\\\\Caira\\\\deployment-[0-9a-f-]+\\\\deployApp\\.ps1)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, agent.uuid
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: Installer, self-update and history-tool staging by command line
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1105, T1059.001, T1070.004, T1217
// CONF: high | FP: medium
// FALSE POSITIVES: An internal deployment script that is also called replaceInPlace.ps1.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a created process whose command line names one of the installer, self-update or history-tool staging artefacts. matches regex with the (?i) prefix reproduces the CQL /i flag.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: For replaceInPlace.ps1 keep only hits whose command line also names quartzline_new.exe, or whose host shows a Q1 to Q3 hit. Exclude your own software-distribution creators.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A script started by a process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine matches regex @"(?i)(quartzline_new\.exe|replaceInPlace\.ps1|chrome-history-summarizer|quartzline_takeover_carrier|\\Caira\\deployment-[0-9a-f-]+\\deployApp\.ps1)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Executables written to the install folders, installer names and staging names
// MITRE: T1105, T1036.005
// CONF: high  FP: medium  COST: low
// REQUIRES: Windows file-write telemetry for executables
// FALSE POSITIVES: A sanctioned product using a folder named Quartz, Canvex or PaperLine.
// TUNING: Exclude a folder name only after confirming the product by SHA256HashData and signer. The installer-name and staging-name branches have no known benign users.
// LOOKBACK: 30d
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| TargetFileName=/(\\AppData\\Local\\(QuartzLine|Quartz|Caira|IronBark|HostHealthCache|DevicePerfCache|PaperLine|Canvex)\\|\\(QuartzLine|IronBark|Caira)_[0-9]+(\.[0-9]+)+\.exe$|\\(chrome-history-summarizer[^\\]*|quartzline_takeover_carrier|quartzline_new|hosthealth|updater-helper)\.exe$)/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData])
| sort(@timestamp, order=desc, limit=200)

event.type = 'File Creation' tgt.file.path = *
| limit 5
| columns event.type, event.time, endpoint.name, tgt.file.path

// HUNT: Executables written to the install folders, installer names and staging names
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1105, T1036.005
// CONF: high | FP: medium
// FALSE POSITIVES: A sanctioned product using a folder named Quartz, Canvex or PaperLine.
// EQUIVALENCE: approximate-analytic - Same intent: a file written into an install folder, a versioned installer name, or a staging name. The CQL reads executable-written events only; SentinelOne File Creation cannot filter to executables, so any file written to those paths matches.
// REQUIRES: SentinelOne File Creation telemetry with the target path
// TUNING: Exclude a folder name only after confirming the product by hash and signer. The installer-name and staging-name branches have no known benign users.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: The install-folder branch matches non-executable files too, because File Creation has no executable filter. A file modified in place after it was written is not matched by File Creation.
// VALIDATION LEVEL: static-reviewed
event.type = 'File Creation'
tgt.file.path matches '(\\\\AppData\\\\Local\\\\(QuartzLine|Quartz|Caira|IronBark|HostHealthCache|DevicePerfCache|PaperLine|Canvex)\\\\|\\\\(QuartzLine|IronBark|Caira)_[0-9]+(\\.[0-9]+)+\\.exe$|\\\\(chrome-history-summarizer[^\\\\]*|quartzline_takeover_carrier|quartzline_new|hosthealth|updater-helper)\\.exe$)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.file.path, tgt.file.sha256, agent.uuid
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| where ActionType == "FileCreated"
| project Timestamp, ActionType, FolderPath
| take 5

// HUNT: Executables written to the install folders, installer names and staging names
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1105, T1036.005
// CONF: high | FP: medium
// FALSE POSITIVES: A sanctioned product using a folder named Quartz, Canvex or PaperLine.
// EQUIVALENCE: approximate-analytic - Same intent: a file created in an install folder, with a versioned installer name, or with a staging name. The CQL reads executable-written events only; DeviceFileEvents cannot filter to executables, so any file created at those paths matches.
// REQUIRES: Defender for Endpoint file-event telemetry (DeviceFileEvents)
// TUNING: Exclude a folder name only after confirming the product by hash and signer. The installer-name and staging-name branches have no known benign users.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The install-folder branch matches non-executable files too, because DeviceFileEvents has no executable filter. A file modified in place after it was created is not matched by FileCreated.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where ActionType == "FileCreated"
| where FolderPath matches regex @"(?i)(\\AppData\\Local\\(QuartzLine|Quartz|Caira|IronBark|HostHealthCache|DevicePerfCache|PaperLine|Canvex)\\|\\(QuartzLine|IronBark|Caira)_[0-9]+(\.[0-9]+)+\.exe$|\\(chrome-history-summarizer[^\\]*|quartzline_takeover_carrier|quartzline_new|hosthealth|updater-helper)\.exe$)"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FileName, FolderPath, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Outbound connections from implant processes (scope the C2 reach)
// MITRE: T1071.001, T1041
// CONF: medium  FP: low  COST: low
// REQUIRES: Windows network connection telemetry with initiating process
// FALSE POSITIVES: None expected for these process names. C2 sits behind a shared CDN, so the addresses are context only. Do not block them.
// LOOKBACK: 30d
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^(quartzline|paperline|fielddesk|pagestone|leafdesk|caira|ironbark)\.exe$/i
| groupBy([ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], function=count(as=Connections), limit=1000)
| sort(Connections, order=desc, limit=200)

event.type = 'IP Connect' src.process.name = * dst.ip.address = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, dst.ip.address, dst.port.number

// HUNT: Outbound connections from implant processes (scope the C2 reach)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1041
// CONF: medium | FP: low
// FALSE POSITIVES: None expected for these process names. C2 sits behind a shared CDN, so the addresses are context only. Do not block them.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an outbound connection from an implant-named process, counted per host, process, remote address and port. The acting process on an IP Connect event is src.process.*.
// REQUIRES: SentinelOne IP Connect telemetry with the acting process
// TUNING: C2 sits behind a shared CDN, so the addresses are context only. Do not block them.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: Connections made through a process the agent attributes to a different name are not counted.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect'
src.process.name matches '^(quartzline|paperline|fielddesk|pagestone|leafdesk|caira|ironbark)\\.exe$'
| group connections = count(), first_seen = min(event.time), last_seen = max(event.time) by endpoint.name, src.process.name, dst.ip.address, dst.port.number
| sort -connections
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, RemoteIP, RemotePort
| take 5

// HUNT: Outbound connections from implant processes (scope the C2 reach)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1041
// CONF: medium | FP: low
// FALSE POSITIVES: None expected for these process names. C2 sits behind a shared CDN, so the addresses are context only. Do not block them.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an outbound connection from an implant-named process, counted per host, process, remote address and port. The acting process is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: C2 sits behind a shared CDN, so the addresses are context only. Do not block them.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connection attempts that never completed are recorded under other action types and are not separated here.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName in~ ("quartzline.exe", "paperline.exe", "fielddesk.exe", "pagestone.exe", "leafdesk.exe", "caira.exe", "ironbark.exe")
| summarize Connections = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| sort by Connections desc
| take 200

// HUNT: Executable run by PowerShell with a backup argument and a pre-signed link
// MITRE: T1567.002, T1560.001
// CONF: medium  FP: low  COST: low
// REQUIRES: Windows process creation telemetry with command line and parent name
// FALSE POSITIVES: Rare. A backup utility run from PowerShell with a URL argument would match.
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^powershell\.exe$/i
| FileName=/\.exe$/i
| CommandLine=/\sbackup\s+https?:/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, SHA256HashData])
| sort(@timestamp, order=desc, limit=200)

event.type = 'Process Creation' src.process.name = * tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.type, event.time, endpoint.name, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: Executable run by PowerShell with a backup argument and a pre-signed link
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1567.002, T1560.001
// CONF: medium | FP: low
// FALSE POSITIVES: Rare. A backup utility run from PowerShell with a URL argument would match.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an executable created by powershell whose command line carries a backup argument followed by an http or https link. The creator is src.process.* and the created process is tgt.process.*.
// REQUIRES: SentinelOne Process Creation telemetry with the command line and creating process
// TUNING: Rare. Confirm whether a sanctioned backup utility is run from PowerShell with a URL argument before alerting.
// LOOKBACK: 30d; set the console time range or the query window to cover the exposure period
// CONFIGURATION: No lookup tables or custom detection objects required; paste the query into Event Search or a scheduled PowerQuery rule.
// KNOWN GAPS: A run launched through a creator other than powershell.exe is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
src.process.name matches '^powershell\\.exe$'
tgt.process.name matches '\\.exe$'
tgt.process.cmdline matches '\\sbackup\\s+https?:'
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha256, agent.uuid
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine, InitiatingProcessFileName
| take 5

// HUNT: Executable run by PowerShell with a backup argument and a pre-signed link
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1567.002, T1560.001
// CONF: medium | FP: low
// FALSE POSITIVES: Rare. A backup utility run from PowerShell with a URL argument would match.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an executable created by powershell whose command line carries a backup argument followed by an http or https link. The creator is InitiatingProcessFileName. matches regex with the (?i) prefix reproduces the CQL /i flag.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Rare. Confirm whether a sanctioned backup utility is run from PowerShell with a URL argument before alerting.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A run launched through a creator other than powershell.exe is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName =~ "powershell.exe"
| where FileName endswith ".exe"
| where ProcessCommandLine matches regex @"(?i)\sbackup\s+https?:"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200