SafePay Ransomware: Closed-Group Double Extortion Against Windows Estates

// HUNT: SafePay encryptor launch flags (-pass= with -path/-enc/-network/-uac)
// MITRE: T1486, T1218.010, T1218.011
// CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 with CommandLine
// LOOKBACK: 7d (set with the console time picker)
// FALSE POSITIVES: none known. -pass= alone is common in unrelated tools, so a second SafePay flag is required.
// NOTE: regsvr32.exe and rundll32.exe are legitimate Windows binaries. This matches the argument pattern, never the binary name. Alert only, do not block the binaries.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/\s-pass=\S+/i
| CommandLine=/\s-(path=|enc=|network\b|netdrive\b|uac\b|selfdelete\b)/i
| table([@timestamp, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine, SHA256HashData], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = * | limit 5 | columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline

// HUNT: SafePay encryptor launch flags (-pass= with -path/-enc/-network/-uac)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1486, T1218.010, T1218.011
// CONF: high | FP: low
// FALSE POSITIVES: none known. -pass= alone is common in unrelated tools, so a second SafePay flag is required.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: two regex tests on the command line (a -pass= argument plus a second SafePay flag). Command-line regexes match case-insensitively by default, as the CQL /i flags do.
// REQUIRES: SentinelOne endpoint Process Creation events with command line
// TUNING: None required. -pass= alone is common in unrelated tools, so the second SafePay flag stays mandatory.
// LOOKBACK: 7d
// CONFIGURATION: No custom detection rule or lookup table required; run in the Singularity Data Lake PowerQuery editor with the console time picker set to 7d.
// KNOWN GAPS: The CQL SHA256 column is not projected in this tab; the image path is shown instead.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.cmdline matches '\\s-pass=\\S+'
tgt.process.cmdline matches '\\s-(path=|enc=|network\\b|netdrive\\b|uac\\b|selfdelete\\b)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.process.image.path
| limit 200

// HUNT: regsvr32 / rundll32 proxy execution of a DLL in a writable path
// MITRE: T1218.010, T1218.011, T1202
// CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 with CommandLine
// LOOKBACK: 7d (set with the console time picker)
// FALSE POSITIVES: installers and legacy COM registration run from Temp
// TUNING: exclude known installer parents (msiexec.exe, vendor setup executables) and signed vendor DLL paths after a 7 day baseline
// NOTE: regsvr32.exe and rundll32.exe are legitimate Windows binaries. Hunt the argument and path context only. Never block the binaries.
#event_simpleName=ProcessRollup2
| FileName=/^(regsvr32|rundll32)\.exe$/i
| CommandLine=/\\(ProgramData|Temp|Users\\Public|PerfLogs)\\\S*\.dll/i
| CommandLine=/(\s.n\s|\s.i:|DllRegisterServer)/i
| table([@timestamp, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine, SHA256HashData], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = * | limit 5 | columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline

// HUNT: regsvr32 / rundll32 proxy execution of a DLL in a writable path
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1218.010, T1218.011, T1202
// CONF: medium | FP: medium
// FALSE POSITIVES: installers and legacy COM registration run from Temp
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: regsvr32 or rundll32 created with a DLL path under ProgramData, Temp, Users\Public or PerfLogs and a register/install/entry-point argument. Binary names match case-insensitively through in:anycase.
// REQUIRES: SentinelOne endpoint Process Creation events with command line
// TUNING: Exclude known installer parents (src.process.name msiexec.exe, vendor setup executables) and signed vendor DLL paths after a 7 day baseline. Never block regsvr32.exe or rundll32.exe.
// LOOKBACK: 7d
// CONFIGURATION: No custom detection rule or lookup table required; run in the PowerQuery editor with the console time picker set to 7d.
// KNOWN GAPS: The CQL SHA256 column is not projected in this tab.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name in:anycase ('regsvr32.exe', 'rundll32.exe')
tgt.process.cmdline matches '\\\\(ProgramData|Temp|Users\\\\Public|PerfLogs)\\\\\\S*\\.dll'
tgt.process.cmdline matches '(\\s.n\\s|\\s.i:|DllRegisterServer)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.process.image.path
| limit 200

// HUNT: Shadow copy deletion and boot recovery disabled (SafePay impact stage)
// MITRE: T1490
// CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2 with CommandLine
// LOOKBACK: 7d (set with the console time picker)
// FALSE POSITIVES: backup agents and imaging jobs pruning shadow copies; admins running bcdedit during repair
// TUNING: exclude the backup service account and build/imaging hosts. Do not exclude by binary name.
// NOTE: vssadmin.exe, wmic.exe and bcdedit.exe are legitimate Windows tools. Detect the arguments, never block the binaries.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(vssadmin|wmic|bcdedit|powershell|pwsh)\.exe$/i
| CommandLine=/(delete\s+shadows|shadowcopy\s+delete|recoveryenabled\s+no|bootstatuspolicy\s+ignoreallfailures|win32_shadowcopy.*delete)/i
| table([@timestamp, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = * | limit 5 | columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: Shadow copy deletion and boot recovery disabled (SafePay impact stage)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1490
// CONF: high | FP: medium
// FALSE POSITIVES: backup agents and imaging jobs pruning shadow copies; admins running bcdedit during repair
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: vssadmin, wmic, bcdedit or PowerShell created with a shadow copy deletion or boot recovery disabling argument.
// REQUIRES: SentinelOne endpoint Process Creation events with command line
// TUNING: Exclude the backup service account and build or imaging hosts. Do not exclude by binary name. Alert only, never block vssadmin.exe, wmic.exe or bcdedit.exe.
// LOOKBACK: 7d
// CONFIGURATION: No custom detection rule or lookup table required; run in the PowerQuery editor with the console time picker set to 7d.
// KNOWN GAPS: Shadow copy deletion performed through an API call inside a process that never spawns these binaries is not visible in process-creation telemetry.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name in:anycase ('vssadmin.exe', 'wmic.exe', 'bcdedit.exe', 'powershell.exe', 'pwsh.exe')
tgt.process.cmdline matches '(delete\\s+shadows|shadowcopy\\s+delete|recoveryenabled\\s+no|bootstatuspolicy\\s+ignoreallfailures|win32_shadowcopy.*delete)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

// HUNT: Defender protections disabled through SystemSettingsAdminFlows / Set-MpPreference
// MITRE: T1562.001
// CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 with CommandLine
// LOOKBACK: 7d (set with the console time picker)
// FALSE POSITIVES: admin troubleshooting; lab and build hosts
// TUNING: exclude named lab hosts and the endpoint-management service account. Keep alerting on server and DC hosts.
#event_simpleName=ProcessRollup2
| (FileName=/^SystemSettingsAdminFlows\.exe$/i or CommandLine=/(Set-MpPreference\s.*-Disable\w+\s+(\$true|1)|advfirewall\s+set\s+\w+\s+state\s+off)/i)
| table([@timestamp, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = * | limit 5 | columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: Defender protections disabled through SystemSettingsAdminFlows / Set-MpPreference
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1562.001
// CONF: medium | FP: medium
// FALSE POSITIVES: admin troubleshooting; lab and build hosts
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the SystemSettingsAdminFlows binary, or a command line that disables a Defender protection through Set-MpPreference or turns a firewall profile off.
// REQUIRES: SentinelOne endpoint Process Creation events with command line
// TUNING: Exclude named lab hosts and the endpoint-management service account. Keep alerting on server and domain controller hosts.
// LOOKBACK: 7d
// CONFIGURATION: No custom detection rule or lookup table required; run in the PowerQuery editor with the console time picker set to 7d.
// KNOWN GAPS: Defender changes made through registry writes or Group Policy rather than a process are not seen here.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
(tgt.process.name in:anycase ('SystemSettingsAdminFlows.exe') or tgt.process.cmdline matches 'Set-MpPreference\\s.*-Disable\\w+\\s+([$]true|1)|advfirewall\\s+set\\s+\\w+\\s+state\\s+off')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

// HUNT: Windows event log clearing (anti-forensics)
// MITRE: T1070.001, T1562.002
// CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 with CommandLine
// LOOKBACK: 7d (set with the console time picker)
// FALSE POSITIVES: image build pipelines, scheduled log-rotation scripts
// TUNING: exclude build hosts and the sanctioned log-maintenance account
// NOTE: wevtutil.exe is a legitimate Windows tool. Detect the clear verb, never block the binary.
#event_simpleName=ProcessRollup2
| (FileName=/^wevtutil\.exe$/i CommandLine=/\s(cl|clear-log)\s+\S+/i) or (FileName=/^(powershell|pwsh)\.exe$/i CommandLine=/(Clear-EventLog|Remove-EventLog|ClearLog\()/i)
| table([@timestamp, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = * | limit 5 | columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: Windows event log clearing (anti-forensics)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1070.001, T1562.002
// CONF: medium | FP: medium
// FALSE POSITIVES: image build pipelines, scheduled log-rotation scripts
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: wevtutil with a clear verb, or PowerShell with a log-clearing cmdlet or method.
// REQUIRES: SentinelOne endpoint Process Creation events with command line
// TUNING: Exclude build hosts and the sanctioned log-maintenance account. Alert only, never block wevtutil.exe.
// LOOKBACK: 7d
// CONFIGURATION: No custom detection rule or lookup table required; run in the PowerQuery editor with the console time picker set to 7d.
// KNOWN GAPS: Log clearing through the Event Log API from an arbitrary process, or Windows event 1102 itself, is not covered by this process-creation hunt.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
((tgt.process.name in:anycase ('wevtutil.exe') tgt.process.cmdline matches '\\s(cl|clear-log)\\s+\\S+') or (tgt.process.name in:anycase ('powershell.exe', 'pwsh.exe') tgt.process.cmdline matches 'Clear-EventLog|Remove-EventLog|ClearLog\\('))
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

// HUNT: dllhost.exe parent spawning shells or proxy-execution binaries (COM UAC bypass)
// MITRE: T1548.002
// CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 (ParentBaseFileName)
// LOOKBACK: 7d (set with the console time picker)
// FALSE POSITIVES: management agents that elevate through COM surrogates
// TUNING: baseline the child binaries per environment and exclude signed management-agent children
// NOTE: the CMSTPLUA CLSID is not published in the cited sources, so this keys on the parent-child relationship only.
#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^dllhost\.exe$/i
| FileName=/^(cmd|powershell|pwsh|wscript|cscript|mshta|regsvr32|rundll32)\.exe$/i
| table([@timestamp, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine, SHA256HashData], limit=200)

event.type = 'Process Creation' src.process.name = * | limit 5 | columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.process.image.path

// HUNT: dllhost.exe parent spawning shells or proxy-execution binaries (COM UAC bypass)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1548.002
// CONF: medium | FP: medium
// FALSE POSITIVES: management agents that elevate through COM surrogates
// EQUIVALENCE: equivalent-with-schema-assumptions - Same parent-child predicate. On a Process Creation event the creator is src.process.* and the new process is tgt.process.*, so the parent process name maps to src.process.name and the child process name to tgt.process.name.
// REQUIRES: SentinelOne endpoint Process Creation events with the creating process name
// TUNING: Baseline the child binaries per environment and exclude signed management-agent children. The CMSTPLUA CLSID is not published in the cited sources, so this keys on the parent-child relationship only.
// LOOKBACK: 7d
// CONFIGURATION: No custom detection rule or lookup table required; run in the PowerQuery editor with the console time picker set to 7d.
// KNOWN GAPS: The query cannot tell a CMSTPLUA elevation from other COM surrogate children; it relies on the baseline exclusions in the tuning note.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
src.process.name in:anycase ('dllhost.exe')
tgt.process.name in:anycase ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe', 'regsvr32.exe', 'rundll32.exe')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.process.image.path
| limit 200

// HUNT: ShareFinder.ps1 / Invoke-ShareFinder share discovery
// MITRE: T1135, T1059.001
// CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 with CommandLine
// LOOKBACK: 7d (set with the console time picker)
// FALSE POSITIVES: red-team and pentest exercises using PowerView
// TUNING: exclude the authorised assessment hosts and accounts for the test window
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(invoke-sharefinder|sharefinder\.ps1)/i
| table([@timestamp, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = * | limit 5 | columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: ShareFinder.ps1 / Invoke-ShareFinder share discovery
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1135, T1059.001
// CONF: high | FP: low
// FALSE POSITIVES: red-team and pentest exercises using PowerView
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: ShareFinder or Invoke-ShareFinder named in a process command line.
// REQUIRES: SentinelOne endpoint Process Creation events with command line
// TUNING: Exclude the authorised assessment hosts and accounts for the test window.
// LOOKBACK: 7d
// CONFIGURATION: No custom detection rule or lookup table required; run in the PowerQuery editor with the console time picker set to 7d.
// KNOWN GAPS: ShareFinder loaded in memory from a script block, with no mention on any command line, is not seen here.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.cmdline matches 'invoke-sharefinder|sharefinder\\.ps1'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

// HUNT: WinRAR / 7-Zip split-volume archive staging (pre-exfiltration)
// MITRE: T1560.001
// CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 with CommandLine
// LOOKBACK: 7d (set with the console time picker)
// FALSE POSITIVES: sanctioned archiving jobs, backup tooling
// TUNING: exclude the backup service account and known archive hosts. Raise priority when the command line contains a UNC path to an admin share.
#event_simpleName=ProcessRollup2
| FileName=/^(winrar|rar|7z|7za|7zg)\.exe$/i
| CommandLine=/\sa\s+(\S+\s+)*-v[0-9]+[kmg]\b/i
| table([@timestamp, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)

event.type = 'Process Creation' tgt.process.name = * tgt.process.cmdline = * | limit 5 | columns event.time, endpoint.name, tgt.process.name, tgt.process.cmdline

// HUNT: WinRAR / 7-Zip split-volume archive staging (pre-exfiltration)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1560.001
// CONF: medium | FP: medium
// FALSE POSITIVES: sanctioned archiving jobs, backup tooling
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate as the corrected CQL: an archiver binary (WinRAR, rar, 7-Zip) run with the add verb and a split-volume switch such as -v100m or -v5g, with or without other switches in between. Command-line regexes match case-insensitively by default, as the CQL /i flag does.
// REQUIRES: SentinelOne endpoint Process Creation events with command line
// TUNING: Exclude the backup service account and known archive hosts. Raise priority when the command line contains a UNC path to an admin share.
// LOOKBACK: 7d
// CONFIGURATION: No custom detection rule or lookup table required; run in the Singularity Data Lake PowerQuery editor with the console time picker set to 7d.
// KNOWN GAPS: Archivers renamed to a different binary name, and archive tools not in the list, are not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name matches '^(winrar|rar|7z|7za|7zg)\\.exe$'
tgt.process.cmdline matches '\\sa\\s+(\\S+\\s+)*-v[0-9]+[kmg]\\b'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

// HUNT: Rclone / FileZilla execution for data exfiltration
// MITRE: T1048, T1567.002
// CONF: medium  FP: high  COST: low
// REQUIRES: ProcessRollup2 with CommandLine
// LOOKBACK: 7d (set with the console time picker)
// FALSE POSITIVES: sanctioned cloud sync, SFTP admin workflows
// TUNING: scope to server hosts and domain controllers first, then exclude named sanctioned transfer hosts and service accounts
#event_simpleName=ProcessRollup2
| (FileName=/^(rclone|filezilla|fzsftp)\.exe$/i or CommandLine=/rclone(\.exe)?"?\s+(copy|sync|move|copyto)\b/i)
| table([@timestamp, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = * | limit 5 | columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: Rclone / FileZilla execution for data exfiltration
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1048, T1567.002
// CONF: medium | FP: high
// FALSE POSITIVES: sanctioned cloud sync, SFTP admin workflows
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: Rclone, FileZilla or fzsftp binaries, or an rclone transfer verb on the command line.
// REQUIRES: SentinelOne endpoint Process Creation events with command line
// TUNING: Scope to server hosts and domain controllers first, then exclude named sanctioned transfer hosts and service accounts.
// LOOKBACK: 7d
// CONFIGURATION: No custom detection rule or lookup table required; run in the PowerQuery editor with the console time picker set to 7d.
// KNOWN GAPS: A renamed rclone binary run with a verb other than copy, sync, move or copyto is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
(tgt.process.name in:anycase ('rclone.exe', 'filezilla.exe', 'fzsftp.exe') or tgt.process.cmdline matches 'rclone(\\.exe)?"?\\s+(copy|sync|move|copyto)\\b')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

// HUNT: Remote-access tool execution inventory (Quick Assist / ScreenConnect / AnyDesk)
// MITRE: T1219, T1133
// CONF: low  FP: high  COST: low
// REQUIRES: ProcessRollup2
// LOOKBACK: 7d (set with the console time picker)
// FALSE POSITIVES: sanctioned RMM, help-desk sessions
// TUNING: exclude the sanctioned RMM vendor and fleet. Investigate first-seen tools on servers and any use following a burst of inbound email or an external Teams call.
// NOTE: these are legitimate products. Hunt, never block on the binary name.
#event_simpleName=ProcessRollup2
| FileName=/^(quickassist|anydesk|screenconnect\.clientservice|screenconnect\.windowsclient)\.exe$/i
| groupBy([ComputerName, UserName, FileName], function=[count(as=Execs), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=20000)
| sort(FirstSeen, order=desc, limit=200)

event.type = 'Process Creation' tgt.process.name = * | limit 5 | columns event.time, endpoint.name, src.process.user, tgt.process.name

// HUNT: Remote-access tool execution inventory (Quick Assist / ScreenConnect / AnyDesk)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1219, T1133
// CONF: low | FP: high
// FALSE POSITIVES: sanctioned RMM, help-desk sessions
// EQUIVALENCE: equivalent-with-schema-assumptions - Same inventory: executions of Quick Assist, AnyDesk and ScreenConnect binaries grouped per host, user and binary with first and last seen times.
// REQUIRES: SentinelOne endpoint Process Creation events
// TUNING: Exclude the sanctioned RMM vendor and fleet. Investigate first-seen tools on servers and any use following a burst of inbound email or an external Teams call. These are legitimate products: hunt, never block on the binary name.
// LOOKBACK: 7d
// CONFIGURATION: No custom detection rule or lookup table required; run in the PowerQuery editor with the console time picker set to 7d.
// KNOWN GAPS: Remote-access tools renamed or run from a different binary name are not inventoried.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name in:anycase ('quickassist.exe', 'anydesk.exe', 'screenconnect.clientservice.exe', 'screenconnect.windowsclient.exe')
| group runs = count(), first_run = min(event.time), last_run = max(event.time) by endpoint.name, src.process.user, tgt.process.name
| sort -first_run
| limit 200

// HUNT: Stop or disable of backup, database and security services (pre-encryption)
// MITRE: T1489, T1562.001
// CONF: medium  FP: high  COST: low
// REQUIRES: ProcessRollup2 with CommandLine
// LOOKBACK: 7d (set with the console time picker)
// FALSE POSITIVES: patch windows, backup jobs, maintenance scripts
// TUNING: exclude change-window hosts and the patching/backup service accounts. Prioritise matches that touch several of these services within minutes.
#event_simpleName=ProcessRollup2
| FileName=/^(net|net1|sc|powershell|pwsh)\.exe$/i
| CommandLine=/(\sstop\s|stop-service|start=\s*disabled)/i
| CommandLine=/(vss|sophos|veeam|backup|gxvss|sqlsvc|msexchange|mssql|sense|windefend|csagent)/i
| table([@timestamp, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)

event.type = 'Process Creation' tgt.process.cmdline = * | limit 5 | columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: Stop or disable of backup, database and security services (pre-encryption)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1489, T1562.001
// CONF: medium | FP: high
// FALSE POSITIVES: patch windows, backup jobs, maintenance scripts
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: net, net1, sc or PowerShell with a stop or disable-start verb, and a backup, database or security service name on the command line.
// REQUIRES: SentinelOne endpoint Process Creation events with command line
// TUNING: Exclude change-window hosts and the patching and backup service accounts. Prioritise matches that touch several of these services within minutes.
// LOOKBACK: 7d
// CONFIGURATION: No custom detection rule or lookup table required; run in the PowerQuery editor with the console time picker set to 7d.
// KNOWN GAPS: Service stops issued through the Service Control Manager API or WMI without spawning these binaries are not visible.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name in:anycase ('net.exe', 'net1.exe', 'sc.exe', 'powershell.exe', 'pwsh.exe')
tgt.process.cmdline matches '(\\sstop\\s|stop-service|start=\\s*disabled)'
tgt.process.cmdline matches '(vss|sophos|veeam|backup|gxvss|sqlsvc|msexchange|mssql|sense|windefend|csagent)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

// HUNT: One account RDP logon to many distinct hosts
// MITRE: T1021.001, T1078
// CONF: medium  FP: medium  COST: medium
// REQUIRES: UserLogon (LogonType 10)
// LOOKBACK: 24h (set with the console time picker)
// FALSE POSITIVES: sanctioned admins, jump hosts, monitoring accounts
// TUNING: exclude named admin accounts and PAM jump hosts, then raise the DistinctHosts threshold to fit your baseline
#event_simpleName=UserLogon
| LogonType=10
| UserName!=/\$$/
| groupBy([UserName], function=[count(aid, distinct=true, as=DistinctHosts), count(as=Logons), collect(RemoteAddressIP4, limit=10), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=20000)
| DistinctHosts >= 4
| sort(DistinctHosts, order=desc, limit=200)

event.type = 'Login' event.login.type = * | limit 5 | columns event.time, agent.uuid, event.login.type, event.login.loginIsSuccessful, event.login.userName

// HUNT: One account RDP logon to many distinct hosts
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1021.001, T1078
// CONF: medium | FP: medium
// FALSE POSITIVES: sanctioned admins, jump hosts, monitoring accounts
// EQUIVALENCE: approximate-analytic - Same fan-out analytic (one account, successful RDP-type logons, four or more distinct hosts counted exactly by a two-stage group) on SentinelOne Login events. The numeric LogonType 10 becomes the REMOTE_INTERACTIVE logon type word, and the CQL RemoteAddressIP4 collection is not carried over.
// REQUIRES: SentinelOne Login events with logon type and success flag
// TUNING: Exclude named admin accounts and PAM jump hosts, then raise the host_count threshold to fit your baseline.
// LOOKBACK: 24h
// CONFIGURATION: No custom detection rule or lookup table required; run in the PowerQuery editor with the console time picker set to 24h.
// KNOWN GAPS: Source IP addresses are not collected: src.endpoint.ip.address is documented but unattested. CACHED_REMOTE_INTERACTIVE logons are not counted.
// VALIDATION LEVEL: static-reviewed
event.type = 'Login' event.login.type = 'REMOTE_INTERACTIVE' event.login.loginIsSuccessful = true
!(event.login.userName matches '\\$$')
| group logon_count = count(), first_logon = min(event.time), last_logon = max(event.time) by event.login.userName, agent.uuid
| group host_count = count(), logon_total = sum(logon_count), first_logon = min(first_logon), last_logon = max(last_logon) by event.login.userName
| filter host_count >= 4
| sort -host_count
| limit 200

// HUNT: Outbound connections to reported SafePay infrastructure
// MITRE: T1071.001, T1041
// CONF: high  FP: low  COST: low
// REQUIRES: NetworkConnectIP4
// LOOKBACK: 30d (set with the console time picker)
// FALSE POSITIVES: IP reassignment by hosting providers over time
// TUNING: confirm the initiating process and timing before escalating. Expire stale hits after 6 months.
#event_simpleName=NetworkConnectIP4
| in(field=RemoteAddressIP4, values=["45.91.201.247", "77.37.49.40", "80.78.28.63", "88.119.167.239"])
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort], limit=200)

event.type = 'IP Connect' dst.ip.address = * | limit 5 | columns event.time, endpoint.name, src.process.user, src.process.name, dst.ip.address, dst.port.number

// HUNT: Outbound connections to reported SafePay infrastructure
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1041
// CONF: high | FP: low
// FALSE POSITIVES: IP reassignment by hosting providers over time
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: outbound IP connections to the four reported SafePay addresses.
// REQUIRES: SentinelOne endpoint IP Connect events
// TUNING: Confirm the initiating process and timing before escalating. Expire stale hits after 6 months.
// LOOKBACK: 30d
// CONFIGURATION: No custom detection rule or lookup table required; run in the PowerQuery editor with the console time picker set to 30d.
// KNOWN GAPS: Retention of IP Connect events in the data lake may be shorter than 30d on some tenants.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect'
dst.ip.address in ('45.91.201.247', '77.37.49.40', '80.78.28.63', '88.119.167.239')
| columns event.time, endpoint.name, src.process.user, src.process.name, dst.ip.address, dst.port.number
| limit 200

// HUNT: SafePay published SHA256 hashes
// MITRE: T1486, T1204.002
// CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / PeFileWritten / NewExecutableWritten
// LOOKBACK: 90d (set with the console time picker)
// FALSE POSITIVES: none expected for exact SHA256 matches
// TUNING: none required. A miss is not clearance because hashes change per build.
#event_simpleName=/^(ProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| in(field=SHA256HashData, values=["a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526", "327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917", "fd509df74a8d6a9e96762337efd46280ebf8d154c6c5dfbac7b3e8f7bb61f191", "625abbf876f256662f33a88c122bf787edf74b882c35adbd61562b5bd1b2ac27", "921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae", "22df7d07369d206f8d5d02cf6d365e39dd9f3b5c454a8833d0017f4cf9c35177", "12139246b8c5232d6d074df37acddc20f0bc233e42ed8eb00dfe2af5d3de3275", "241c3b02a8e7d5a2b9c99574c28200df2a0f8c8bd7ba4d262e6aa8ed1211ba1f", "654c11935448b3229434ec7d9d165a5f135ae4735d35700cffcb3b84f6a0fbc3", "961346470d15d7795c5e35bc90c17d293fba7a8b811f8f5c26a3dc7c971cdc4e", "6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a", "e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346"])
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, SHA256HashData], limit=200)

event.type = 'File Creation' tgt.file.sha256 = * | limit 5 | columns event.time, endpoint.name, event.type, tgt.file.path, tgt.file.sha256, module.sha256

// HUNT: SafePay published SHA256 hashes
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1486, T1204.002
// CONF: high | FP: low
// FALSE POSITIVES: none expected for exact SHA256 matches
// EQUIVALENCE: telemetry-gap - Partial pivot only: hashes are matched on files written (tgt.file.sha256) and on module loads (module.sha256). The CQL also matched the hash of every started process; that arm (tgt.process.image.sha256 on Process Creation) is not included in this tab, so executables that ran without being written or loaded in the window are not covered.
// REQUIRES: SentinelOne endpoint File Creation, File Modification and Module Load events with SHA256
// TUNING: None required. A miss is not clearance because hashes change per build.
// LOOKBACK: 90d
// CONFIGURATION: No custom detection rule or lookup table required; run in the PowerQuery editor with the console time picker set to 90d where retention allows.
// KNOWN GAPS: Process-creation image hashes are not matched in this tab, so a SafePay binary that ran without a file write or module load event in the window is missed. Hunt it on the CQL tab, or use the SentinelOne threat and hash-reputation views.
// VALIDATION LEVEL: static-reviewed
(event.type in ('File Creation', 'File Modification') tgt.file.sha256 in ('a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526', '327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917', 'fd509df74a8d6a9e96762337efd46280ebf8d154c6c5dfbac7b3e8f7bb61f191', '625abbf876f256662f33a88c122bf787edf74b882c35adbd61562b5bd1b2ac27', '921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae', '22df7d07369d206f8d5d02cf6d365e39dd9f3b5c454a8833d0017f4cf9c35177', '12139246b8c5232d6d074df37acddc20f0bc233e42ed8eb00dfe2af5d3de3275', '241c3b02a8e7d5a2b9c99574c28200df2a0f8c8bd7ba4d262e6aa8ed1211ba1f', '654c11935448b3229434ec7d9d165a5f135ae4735d35700cffcb3b84f6a0fbc3', '961346470d15d7795c5e35bc90c17d293fba7a8b811f8f5c26a3dc7c971cdc4e', '6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a', 'e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346')) or (event.type = 'Module Load' module.sha256 in ('a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526', '327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917', 'fd509df74a8d6a9e96762337efd46280ebf8d154c6c5dfbac7b3e8f7bb61f191', '625abbf876f256662f33a88c122bf787edf74b882c35adbd61562b5bd1b2ac27', '921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae', '22df7d07369d206f8d5d02cf6d365e39dd9f3b5c454a8833d0017f4cf9c35177', '12139246b8c5232d6d074df37acddc20f0bc233e42ed8eb00dfe2af5d3de3275', '241c3b02a8e7d5a2b9c99574c28200df2a0f8c8bd7ba4d262e6aa8ed1211ba1f', '654c11935448b3229434ec7d9d165a5f135ae4735d35700cffcb3b84f6a0fbc3', '961346470d15d7795c5e35bc90c17d293fba7a8b811f8f5c26a3dc7c971cdc4e', '6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a', 'e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346'))
| columns event.time, endpoint.name, event.type, src.process.name, tgt.file.path, tgt.file.sha256, module.path, module.sha256
| limit 200