Settra Ransomware — Double-Extortion Attack Chain

Double-extortion RaaS / data-extortion group — first publicly observed June 2026 — active as of September 2026

Threat

Settra Ransomware (RaaS / Data-Extortion)

Severity

ACTIVE CAMPAIGN

Type

Ransomware — Double Extortion (LOLBins / Red-Team Tooling)

Access

Compromised VPN / Infostealer Credentials (T1078)

Version

v1.0 · 2026-09-10

Author

ai@hutzley.com

Confidence

High (core TTPs, MITRE mapping) / N/A (no public samples, hashes, or C2)

Sources

4 saved snapshots

Queries

9 CQL hunt queries

Executive Summary

Settra is a human-operated ransomware and data-extortion group first publicly observed in June 2026, operating a double-extortion model: exfiltrate data, then encrypt (or simply threaten publication without confirmed encryption), then pressure victims via a Tor leak site and Tox-based negotiation channel. As of September 7–10, 2026, the group has publicly claimed 64 victims across 18–19 countries, concentrated in Technology, Professional Services, and Manufacturing.

Initial access is overwhelmingly credential-based: compromised VPN credentials and infostealer-harvested credentials (roughly 31.8%–50% of known victim domains show infostealer-log correlation, depending on tracker). Settra's operators rely almost entirely on living-off-the-land and dual-use red-team tooling rather than custom malware — NetExec/Netscan for discovery, Procdump/Mimikatz for LSASS credential theft, PAExec/NetExec for lateral movement, a tool named edr_blind plus manual Windows Event Log clearing for defense evasion, and a documented BYOVD (bring-your-own-vulnerable-driver) technique using the vulnerable driver STProcessMonitor_v114.sys for kernel-level privilege escalation and EDR tampering. Persistence and C2 ride on Mesh Agent, a legitimate open-source remote-access tool abused for durable access.

No file hashes, C2 infrastructure, or malware samples are publicly available as of this writing. Encryption mechanics are entirely undocumented — no public malware analysis exists. This pack builds detections exclusively around documented, cited behaviors: LOLBin/red-team tool execution, credential dumping, the named vulnerable driver, defense-evasion actions, and the OSINT-only leak-site/Tox indicators, which are provided for monitoring/context and are not presented as endpoint-detectable atomics.

Source Review & Web Hunter Notes

Every source below was fetched directly during this pipeline run and its verbatim text saved to Settra-Ransomware-Hunt-sources/ for provenance tracing. No fetched content contained instructions directed at the researching agent; all four snapshots were clean of prompt-injection attempts.

#	Tier	Source	Key Finding	Carry Forward
01	Tier 1 — IR vendor, direct case work	MoxFive, "Settra Ransomware: TTPs, Victims, and Defense Guide" (Luke Moran)	Full attack-chain tool list (NetExec, Netscan, Procdump, Mimikatz, PAExec, edr_blind, STProcessMonitor_v114.sys BYOVD, Mesh Agent); defensive checklist	Yes — primary TTP source
02	Tier 1 — DFIR vendor	Proven Data, "SETTRA Ransomware: Emerging Double-Extortion Threat" (Montini/Abdelaziz, Head of DFIR)	MITRE ATT&CK mapping w/ confidence ratings, victimology stats, 31.8% infostealer-log correlation, explicit confirmation no hashes/C2/samples are public, Tor onion + Tox ID	Yes — primary IOC/MITRE source
03	Tier 2 — OSINT leak-site tracker	ransomware.live, group profile "Settra" (live pull 2026-09-10)	Corroborates onion address and Tox ID verbatim; live victim count 64, first/last-seen dates, 50% infostealer-domain correlation, sector/country breakdown, 10 known leak-site mirror locations	Yes — freshness/corroboration
04	Tier 2 — dark-web monitoring vendor	DeXpose, "Settra Ransomware Attack on MedEvolve" (2026-09-04)	Single-victim corroboration of active September 2026 claims; consistent with leak-site posting pattern	Partial — victim corroboration only, no new TTPs

All four sources independently agree on: double-extortion model, Tor + Tox extortion channel, credential-based initial access, and (sources 01/02/03) the specific onion address and Tox contact ID. The BYOVD driver filename STProcessMonitor_v114.sys is sourced to MoxFive (01) only — it is still the single most distinctive, traceable atomic signal in this pack and is treated accordingly (see §4 and §9).

Hunt Brief & Attack Chain

Step	Behavior	Telemetry	Hunt Angle
1. Initial Access	Valid Accounts — compromised VPN credentials and/or infostealer-harvested credentials (T1078)	VPN/IdP auth logs, `UserLogon`	Anomalous VPN logon geography/velocity from accounts recently seen in infostealer-log exposure
2. Discovery	NetExec (nxc) and Netscan used to map network and validate credential reuse	`ProcessRollup2`, `NetworkConnectIP4`	Execution of nxc/netexec/netscan binaries; SMB enumeration sweep pattern from a single host
3. Credential Access	Procdump and Mimikatz used to dump LSASS and harvest additional credentials	`ProcessRollup2`	Procdump invoked against lsass.exe; Mimikatz module strings (`sekurlsa::`, `lsadump::`)
4. Lateral Movement	PAExec (PsExec-like) and NetExec used to move using compromised credentials	`ProcessRollup2`	PAExec service creation / ADMIN$ remote execution pattern
5. Defense Evasion	`edr_blind` disables EDR/security tooling; manual Windows Event Log clearing; BYOVD via `STProcessMonitor_v114.sys` for kernel-level execution	`ProcessRollup2`, `PeFileWritten`, Windows Security Event ID 1102/104	Driver file write/load matching known filename; wevtutil/Clear-EventLog invocations; edr_blind process/command-line string
6. C2 / Persistence	Mesh Agent (legitimate RMM) installed/abused for durable remote access	`ProcessRollup2`, `NetworkConnectIP4`	Unbaselined Mesh Agent install outside approved RMM inventory
7. Exfiltration	Data exfiltrated over alternative protocols (T1048); credentials, employee records, customer PII, internal docs, financial records, audit materials targeted	`ProcessRollup2` (archive utilities), `NetworkConnectIP4`, `DnsRequest`	Pre-exfil archive staging (RAR/7-Zip) followed by high-volume outbound transfer to unfamiliar destinations
8. Extortion / Impact	Double extortion: Tor leak-site posting + Tox negotiation; encryption deployment unconfirmed/undocumented	N/A (endpoint) — OSINT leak-site monitoring only; mass file-write/rename + shadow-copy deletion if encryption occurs	Behavioral: mass `FileRenameInfo`, `vssadmin delete shadows`, backup-console access clustering (see §7 native hunts)

Consolidated IOC Table

Type	Value	Confidence	Nature	Action	Source(s)
Tor leak site	`settra5ldqwgtw5q7z5awbsvlksakyfojuc5slgrz5lvapune4fantqd[.]onion`	High	Atomic — OSINT context only	Leak-site/dark-web monitoring; not endpoint-actionable	01, 02, 03
Tox contact ID	`D288571294F08ADDFE46DF631194745143BE8B40F9F846379040DC40EB39BC2E8CE056B66927`	High	Atomic — OSINT context only	Extortion-negotiation attribution; not endpoint-actionable	02, 03
File (driver)	`STProcessMonitor_v114.sys`	High	Atomic — distinctive signal	Detect/Block — file-write, load, and driver-service-registration hunts (§8 Q1/Q2)	01
Tool	`edr_blind` (custom EDR-disabling tool, no public sample)	Medium	Behavioral — named tool, no binary/hash public	Process/command-line string hunt (§8 Q6)	01
Tool	NetExec / nxc	High	Behavioral — dual-use tool	Execution hunt (§8 Q5)	01
Tool	Netscan	High	Behavioral — dual-use tool	Execution hunt (§8 Q5)	01
Tool	Procdump	High	Behavioral — dual-use tool	LSASS-access hunt (§8 Q3)	01
Tool	Mimikatz	High	Behavioral — offensive tool	LSASS-access hunt (§8 Q3)	01
Tool	PAExec	High	Behavioral — dual-use tool	Lateral-movement hunt (§8 Q4)	01
Tool	Mesh Agent (MeshCentral)	High	Behavioral — legitimate RMM abused	Persistence hunt (§8 Q8)	01
File hash / C2 IP / C2 domain	None published	N/A	—	Explicitly not available — do not fabricate; monitor vendor reporting for future disclosure	02 (explicit statement)

Provenance note: every atomic value above traces to at least one saved snapshot in Settra-Ransomware-Hunt-sources/. No hash, IP, or domain indicator is shipped because none exists in the public record as of 2026-09-10 — fabricating one would violate this pack's defensive-accuracy requirement.

Affected Surfaces & Telemetry Matrix

Platform / Surface	Required Telemetry	Priority	Gap Risk
Windows endpoints & servers	Falcon EDR: ProcessRollup2, PeFileWritten, RegGenericValueUpdate	High	Low — core Falcon sensor coverage
Identity / VPN / IdP	VPN authentication logs, IdP sign-in logs, MFA logs (often outside Falcon — SIEM ingestion required)	High	Medium — depends on VPN log forwarding being wired into LogScale
Windows Event Log pipeline	Security Event ID 1102 (log cleared), 104 (log service cleared) via WEF/Falcon Event Log Collector	High	Medium — requires forwarding configured before the attack, or the evidence is gone
Network (SMB / lateral movement)	NetworkConnectIP4, SMB session telemetry, firewall/segmentation logs	Medium	Low-Medium
Backup infrastructure	Backup console access logs, shadow-copy service events	High	Medium — backup platforms often lack native Falcon coverage; use platform-native audit logs
Encryption/impact telemetry	N/A — no public sample, no known extension/ransom-note artifact	Medium	Gap — cannot build sample-based detection; behavioral mass-file-write hunt is the only mitigant (see §7)

ATT&CK Mapping

Tactic	Technique ID	Technique	Observed Behavior	Confidence
Initial Access	T1078	Valid Accounts	Compromised VPN credentials; infostealer-harvested credentials (~31.8–50% of victim domains)	High
Initial Access	T1566	Phishing	Listed as a low-confidence alternate hypothesis by Proven Data; not directly observed by MoxFive case work	Low
Discovery	T1046 / T1018	Network Service Discovery / Remote System Discovery	NetExec (nxc) and Netscan used to map victim networks and validate credentials	High
Credential Access	T1003.001	OS Credential Dumping: LSASS Memory	Procdump and Mimikatz used against LSASS to pull additional credentials	High
Credential Access	T1555	Credentials from Password Stores	Infostealer-log correlation across known victim domains	Medium
Lateral Movement	T1021.002	Remote Services: SMB/Windows Admin Shares	PAExec (PsExec-like) and NetExec used to move using compromised credentials	High
Defense Evasion	T1562.001	Impair Defenses: Disable or Modify Tools	`edr_blind` tool disables EDR/security tooling; BYOVD driver also used to tamper with security controls	High
Defense Evasion	T1070.001	Indicator Removal: Clear Windows Event Logs	Manual clearing of Windows event logs to cover tracks	High
Privilege Escalation / Defense Evasion	T1068	Exploitation for Privilege Escalation (BYOVD)	Vulnerable driver `STProcessMonitor_v114.sys` loaded for kernel-level execution — observed in at least one case	High
Command and Control / Persistence	T1219	Remote Access Software	Mesh Agent, a legitimate remote-access tool, used to maintain persistent access	High
Collection	T1119	Automated Collection	Low-confidence hypothesis (Proven Data); consistent with bulk document theft but not directly confirmed	Low
Exfiltration	T1048	Exfiltration Over Alternative Protocol	Stated exfiltration channel for stolen credentials, PII, financial/audit records	Medium
Impact	T1486	Data Encrypted for Impact	Encryption is part of the double-extortion model but mechanics are entirely undocumented; no public sample	Medium
Impact	T1657	Financial Theft	Double-extortion ransom demand via Tor leak site + Tox negotiation	High

Native Audit-Log Hunts (Non-CQL)

Checks that rely on native Windows/AD tooling or logs rather than Falcon CQL — useful when Falcon telemetry is unavailable or as corroborating evidence.

Check	How	Why
Event ID 1102 / 104 spike	Query centrally-forwarded Security event logs for Event ID 1102 (audit log cleared) or 104 (log service log cleared) outside scheduled maintenance windows	Directly corresponds to Settra's manual log-clearing defense-evasion step
Driver blocklist / HVCI violation	Review Windows Defender Application Control (WDAC) / Microsoft vulnerable-driver blocklist violation events (CodeIntegrity Event ID 3033/3077)	Catches `STProcessMonitor_v114.sys` load attempts if HVCI/driver blocklisting is enforced
New/unexpected Windows service creation	Review System log Event ID 7045 (service installed) for PAExec-, edr_blind-, or Mesh Agent-named services	Native corroboration for lateral movement and persistence steps
VPN authentication anomalies	Review VPN appliance logs for logons from unexpected geographies, ASN reputation, or accounts flagged in infostealer-log exposure feeds	Directly targets the dominant initial-access vector
Shadow-copy deletion	Review Event ID 7 (VSS) / `vssadmin`, `wbadmin` command-line audit records	Common pre-encryption impact-preparation step across ransomware operators; relevant given Settra's undocumented encryption phase

CrowdStrike LogScale CQL Hunt Queries

Falcon cloud (drives "Open in Falcon"): Pick your tenant's cloud first — every "Open in Falcon" button below uses this selection.

Q1 · BYOVD: STProcessMonitor_v114.sys Vulnerable Driver Staged/Loaded

CONF HIGHFP LOWCOST LOWIOA CANDIDATE

Looks for: staging or loading of the vulnerable driver STProcessMonitor_v114.sys used in Settra's documented BYOVD privilege-escalation/EDR-tamper technique — the single most distinctive atomic signal in this pack.

// HUNT: Settra BYOVD — STProcessMonitor_v114.sys Vulnerable Driver Staged/Loaded
// MITRE: T1068 (Exploitation for Privilege Escalation), T1562.001 (Impair Defenses: Disable or Modify Tools)
// CONF: high
// FP: low
// COST: low
// REQUIRES: PeFileWritten, ProcessRollup2
// FALSE POSITIVES: Legitimate security/monitoring software shipping a similarly-named driver — verify file hash/signer before containment action.
// TUNING: No public hash exists for this driver as of this pack; once your environment observes a confirmed sample, pin SHA256HashData here rather than filename alone.

#event_simpleName=/^PeFileWritten$/i
FileName=/^STProcessMonitor_v114(\.sys)?$/i
| table([timestamp, aid, ComputerName, UserName, FileName, FilePath, SHA256HashData])
| sort(timestamp, order=desc)

Q2 · BYOVD: Kernel Driver Service Registration

CONF MEDIUMFP MEDIUMCOST LOW

Looks for: sc.exe/pnputil.exe invocations referencing the STProcessMonitor_v114 driver name — the kernel-driver-service-registration step of the BYOVD chain. FP: legitimate driver installs (printer/monitoring/VPN) via the same utilities.

// HUNT: Settra BYOVD — Kernel Driver Service Registration
// MITRE: T1068 (Exploitation for Privilege Escalation), T1562.001 (Impair Defenses: Disable or Modify Tools)
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2, RegGenericValueUpdate
// FALSE POSITIVES: Legitimate driver installs (printer, monitoring, VPN client) via sc.exe or pnputil — expected in change-managed environments.
// TUNING: Scope to hosts without an open change ticket, or outside approved driver-install maintenance windows; exclude known IT deployment-tool parent processes.

#event_simpleName=/^ProcessRollup2$/i
ImageFileName=/\\(sc|pnputil)\.exe$/i
CommandLine=/STProcessMonitor_v114/i
| table([timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName])

Q3 · Credential Access: Procdump/Mimikatz LSASS Memory Access

CONF HIGHFP LOWCOST LOWIOA CANDIDATE

Looks for: Procdump or Mimikatz used against LSASS, or Mimikatz module strings in command lines — Settra's documented credential-dumping step.

// HUNT: Settra Credential Access — Procdump/Mimikatz LSASS Memory Access
// MITRE: T1003.001 (OS Credential Dumping: LSASS Memory)
// CONF: high
// FP: low
// COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: Authorized memory-dump troubleshooting by IT/helpdesk using Sysinternals ProcDump against non-LSASS processes; sanctioned internal red-team engagements.
// TUNING: Exclude your organization's approved SOC/red-team AIDs and any change-ticketed ProcDump usage against non-lsass targets.

#event_simpleName=/^ProcessRollup2$/i
(ImageFileName=/\\procdump(64)?\.exe$/i CommandLine=/lsass/i) OR
(ImageFileName=/\\mimikatz\.exe$/i) OR
CommandLine=/sekurlsa::|lsadump::/i
| table([timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine])

Q4 · Lateral Movement: PAExec Remote Service Execution

CONF HIGHFP MEDIUMCOST LOW

Looks for: PAExec-based remote service execution — Settra's lateral-movement tool of choice alongside NetExec. FP: legitimate PAExec/PsExec use by IT operations for remote administration, common in MSP-managed environments.

// HUNT: Settra Lateral Movement — PAExec Remote Service Execution
// MITRE: T1021.002 (Remote Services: SMB/Windows Admin Shares), T1569.002 (System Services: Service Execution)
// CONF: high
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: Legitimate PAExec/PsExec use by IT operations for remote administration — common in MSP-managed environments.
// TUNING: Baseline approved source hosts/accounts for remote-admin tooling; alert only on launches from workstations or non-jump-box hosts.

#event_simpleName=/^ProcessRollup2$/i
(ImageFileName=/\\PAExec(64)?\.exe$/i) OR
(FileName=/^PAExec/i) OR
ServiceImagePath=/paexec/i
| table([timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ServiceImagePath])

Q5 · Discovery: NetExec (nxc) / Netscan Enumeration

CONF HIGHFP MEDIUMCOST MEDIUM

Looks for: execution of NetExec (nxc) or Netscan — Settra's discovery/enumeration tooling used to map the network and validate stolen credentials. FP: authorized vulnerability scanning or internal red-team assessments.

// HUNT: Settra Discovery — NetExec (nxc) / Netscan Enumeration
// MITRE: T1046 (Network Service Discovery), T1018 (Remote System Discovery)
// CONF: high
// FP: medium
// COST: medium
// REQUIRES: ProcessRollup2, NetworkConnectIP4
// FALSE POSITIVES: Authorized vulnerability scanning or internal red-team assessments running NetExec/Netscan against the same subnet.
// TUNING: Exclude scheduled vuln-scan infrastructure source AIDs; alert preferentially on execution from endpoint/user segments rather than scanner appliances.

#event_simpleName=/^ProcessRollup2$/i
(ImageFileName=/\\nxc(\.exe)?$/i) OR
(CommandLine=/netexec|nxc\.exe/i) OR
(ImageFileName=/\\netscan(64)?\.exe$/i)
| table([timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName])

Q6 · Defense Evasion: edr_blind Security Tooling Disruption

CONF MEDIUMFP LOWCOST LOW

Looks for: process or command-line references to edr_blind, Settra's named (no public sample) EDR-disabling tool. FP: legitimate EDR/AV uninstall or reconfiguration performed by IT during migrations — should be rare and change-ticketed.

// HUNT: Settra Defense Evasion — edr_blind Security Tooling Disruption
// MITRE: T1562.001 (Impair Defenses: Disable or Modify Tools)
// CONF: medium
// FP: low
// COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: Legitimate EDR/AV uninstall or reconfiguration performed by IT during migrations — should be rare and change-ticketed.
// TUNING: No public sample of edr_blind exists; this is a best-effort behavioral hunt on the reported tool name/command-line string pending a confirmed binary. Revisit if vendor reporting publishes a hash.

#event_simpleName=/^ProcessRollup2$/i
(ImageFileName=/edr_blind/i) OR
(CommandLine=/edr_blind/i)
| table([timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName])

Q7 · Defense Evasion: Manual Windows Event Log Clearing

CONF HIGHFP LOWCOST LOWIOA CANDIDATE

Looks for: wevtutil or PowerShell-based manual clearing of Windows Event Logs — Settra's documented defense-evasion/anti-forensics step. FP: scheduled log-rotation/maintenance scripts run by IT (rare, should be change-ticketed).

// HUNT: Settra Defense Evasion — Manual Windows Event Log Clearing
// MITRE: T1070.001 (Indicator Removal: Clear Windows Event Logs)
// CONF: high
// FP: low
// COST: low
// REQUIRES: ProcessRollup2, Windows Security Event ID 1102/104 (via WEF or Falcon Event Log forwarding)
// FALSE POSITIVES: Scheduled log-rotation/maintenance scripts run by IT (rare, should be documented and change-ticketed).
// TUNING: Cross-reference against a change-ticket allowlist; alert with highest priority when clearing follows credential-dumping or lateral-movement activity from the same host within the hunt window.

#event_simpleName=/^ProcessRollup2$/i
(ImageFileName=/\\wevtutil\.exe$/i CommandLine=/\bcl\b/i) OR
(ImageFileName=/\\powershell(_ise)?\.exe$/i CommandLine=/Clear-EventLog|wevtutil\s+cl|Remove-EventLog/i)
| table([timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName])

Q8 · Persistence/C2: Unauthorized Mesh Agent Installation

CONF MEDIUMFP HIGHCOST LOW

Looks for: Mesh Agent (MeshCentral) service/process/file installation — the legitimate RMM tool Settra abuses for persistence and C2. FP: Mesh Agent is a legitimate, frequently sanctioned RMM tool at many MSPs — this query WILL be noisy in any environment that already uses it for authorized remote support.

// HUNT: Settra Persistence/C2 — Unauthorized Mesh Agent Installation
// MITRE: T1219 (Remote Access Software), T1543.003 (Create or Modify System Process: Windows Service)
// CONF: medium
// FP: high
// COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: Mesh Agent (MeshCentral) is a legitimate, frequently sanctioned RMM tool at many MSPs — this query WILL be noisy in any environment that already uses Mesh Agent for authorized remote support.
// TUNING: Baseline your organization's approved Mesh Agent server FQDN(s)/tenant ID and alert only on installs referencing unknown/unapproved Mesh server endpoints, or installs on hosts with no prior RMM baseline.

#event_simpleName=/^ProcessRollup2$/i
(ImageFileName=/\\meshagent\.exe$/i) OR
(ServiceImagePath=/meshagent/i) OR
(FileName=/^meshagent(\.exe|\.msh)?$/i)
| table([timestamp, aid, ComputerName, UserName, ImageFileName, ServiceImagePath, FileName, CommandLine])

Q9 · Exfiltration: Pre-Exfil Archive Staging (RAR/7-Zip)

CONF MEDIUMFP MEDIUMCOST MEDIUM

Looks for: RAR/7-Zip archive creation immediately preceding likely exfiltration — Settra's pre-exfil staging pattern. FP: legitimate backup jobs or IT archiving of large file sets.

// HUNT: Settra Exfiltration — Pre-Exfil Archive Staging (RAR/7-Zip)
// MITRE: T1560.001 (Archive Collected Data: Archive via Utility), T1048 (Exfiltration Over Alternative Protocol)
// CONF: medium
// FP: medium
// COST: medium
// REQUIRES: ProcessRollup2, NetworkConnectIP4
// FALSE POSITIVES: Legitimate backup jobs or IT archiving of large file sets — check parent process and destination before escalating.
// TUNING: Correlate with NetworkConnectIP4 to unfamiliar cloud-storage/file-sync ASNs within a short window of archive creation; exclude known backup-agent parent processes.

#event_simpleName=/^ProcessRollup2$/i
(ImageFileName=/\\(rar|winrar|7z|7za)\.exe$/i CommandLine=/\b(a|x)\b/i)
| table([timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName])

CrowdStrike Custom IOA Recommendations

Queries promoted to Custom IOA candidates are high-confidence, low-FP, and stable enough for always-on detection (rather than periodic hunt).

Query	Rationale	Suggested Severity
Q1 — BYOVD driver write/load	Single-purpose filename match, no legitimate reason for this exact vulnerable driver to be staged on an endpoint	High
Q3 — LSASS access via Procdump/Mimikatz	Well-established high-fidelity credential-theft pattern; tune with SOC/red-team exclusions only	High
Q7 — Manual event log clearing	Rare in normal operations; high value as an early-warning IOA especially when correlated with Q3/Q5 firing on the same host	Medium-High

Queries Q2, Q4, Q5, Q6, Q8, and Q9 remain investigate-only hunt queries pending environment-specific tuning (medium/high FP as noted in their comment blocks) rather than always-on IOAs.

Machine-Readable IOC Appendix

OSINT / Extortion-Channel Contextleak-site monitoring

settra5ldqwgtw5q7z5awbsvlksakyfojuc5slgrz5lvapune4fantqd.onion  (Tor leak site - dark-web/leak-site monitoring only, not endpoint-actionable)
D288571294F08ADDFE46DF631194745143BE8B40F9F846379040DC40EB39BC2E8CE056B66927  (Tox negotiation contact ID - extortion-channel attribution only)

Distinctive Atomic Signaldetect/block

STProcessMonitor_v114.sys  (BYOVD vulnerable driver - Detect/Block via Q1/Q2 and Playbook A; single most distinctive traceable signal in this pack)

Behavioral Tool Namesno public hash

edr_blind - custom/named EDR-disabling tool, no public sample (Q6)
NetExec / nxc - discovery & lateral-movement dual-use tool (Q5, Q4)
Netscan - discovery/enumeration tool (Q5)
Procdump - LSASS credential-dumping utility (Q3)
Mimikatz - offensive credential-theft tool (Q3)
PAExec - PsExec-like lateral-movement tool (Q4)
Mesh Agent (MeshCentral) - legitimate RMM abused for persistence/C2 (Q8)

Hardening Verification Checklistquick audit

[ ] Phishing-resistant MFA enforced on all VPN/remote-access gateways (FIDO2/WebAuthn/cert-based only, no SMS/voice fallback) - verified
[ ] STProcessMonitor_v114.sys added to WDAC/HVCI vulnerable-driver blocklist - verified
[ ] LSA Protection (RunAsPPL) enabled - verified (HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL = 1)
[ ] Default-deny allowlist blocking unapproved PAExec/Mesh Agent/NetExec execution - deployed
[ ] Windows Event Log forwarding (WEF/Falcon Event Collector) centralized and protected - verified
[ ] Local administrator group membership restricted; LAPS enforced - verified
[ ] Network segmentation isolating domain controllers/backup consoles/financial systems - verified
[ ] Immutable, offline backup architecture unreachable via domain-joined credentials - verified
[ ] Infostealer-log/credential-exposure monitoring feed integrated into SOC pipeline - verified

JSON (machine-readable)

{
  "threat": "Settra Ransomware",
  "pack_version": "2026-09-10",
  "generated": "2026-09-10",
  "iocs": [
    { "type": "tor_leak_site", "value": "settra5ldqwgtw5q7z5awbsvlksakyfojuc5slgrz5lvapune4fantqd[.]onion", "confidence": "high", "actionable": "osint_context_only", "sources": ["01", "02", "03"] },
    { "type": "tox_id", "value": "D288571294F08ADDFE46DF631194745143BE8B40F9F846379040DC40EB39BC2E8CE056B66927", "confidence": "high", "actionable": "osint_context_only", "sources": ["02", "03"] },
    { "type": "filename", "value": "STProcessMonitor_v114.sys", "confidence": "high", "actionable": "detect_block", "role": "byovd_vulnerable_driver", "sources": ["01"] },
    { "type": "tool_name", "value": "edr_blind", "confidence": "medium", "actionable": "behavioral_hunt", "sources": ["01"] },
    { "type": "tool_name", "value": "NetExec / nxc", "confidence": "high", "actionable": "behavioral_hunt", "sources": ["01"] },
    { "type": "tool_name", "value": "Netscan", "confidence": "high", "actionable": "behavioral_hunt", "sources": ["01"] },
    { "type": "tool_name", "value": "Procdump", "confidence": "high", "actionable": "behavioral_hunt", "sources": ["01"] },
    { "type": "tool_name", "value": "Mimikatz", "confidence": "high", "actionable": "behavioral_hunt", "sources": ["01"] },
    { "type": "tool_name", "value": "PAExec", "confidence": "high", "actionable": "behavioral_hunt", "sources": ["01"] },
    { "type": "tool_name", "value": "Mesh Agent", "confidence": "high", "actionable": "behavioral_hunt", "role": "legitimate_rmm_abused", "sources": ["01"] }
  ],
  "hashes": [],
  "c2_infrastructure": [],
  "note": "No file hashes, C2 IPs, or C2 domains are publicly available as of 2026-09-10. Fields left intentionally empty rather than fabricated."
}

Detection Validation Gates

Gate	Check	Status
Source provenance	Every cited source (4/4) was fetched this run and saved verbatim to `Settra-Ransomware-Hunt-sources/`.	PASS
IOC traceability	Every atomic indicator shipped in §4/§10 traces to at least one saved snapshot; none were invented.	PASS
No fabricated hashes/C2	Hashes and C2 infrastructure fields are explicitly left empty per source 02's confirmation that none are public.	PASS
Prompt-injection screening	All four fetched sources reviewed for embedded instructions directed at the researching agent; none found.	PASS
Field-name sanity pass	CQL queries use standard Falcon event types (ProcessRollup2, PeFileWritten, NetworkConnectIP4, RegGenericValueUpdate) and common fields. Validate against your tenant's schema before production deployment.	PASS
Regex hygiene	Every CQL regex matches basenames via FileName/ImageFileName with escaped backslashes; no unescaped path slash appears inside any /.../ regex delimiter.	PASS
HTML escaping	No bare angle-bracket characters appear unescaped inside any <pre> block in a way that forms an unintended tag.	PASS
Sample-based detection	Not applicable — no malware sample exists publicly for Settra as of 2026-09-10; this gate is marked N/A rather than failed.	N/A

Hardening — Tiered & Deployable

Controls are scoped to the platforms Settra actually touches: Windows/AD endpoints, identity/VPN access, and backup infrastructure. Each control cites a MITRE mitigation plus a platform benchmark/vendor guidance.

Immediate — deploy this week

Control	MITRE Mitigation	Authority	Verify
Enforce phishing-resistant MFA on all VPN/remote-access gateways	M1032 Multi-factor Authentication	CIS Controls v8 §6.5; CISA Phishing-Resistant MFA guidance	`Get-MsolUser` / IdP admin console MFA-method report; confirm FIDO2/WebAuthn/cert-based methods only, no SMS/voice fallback
Add `STProcessMonitor_v114.sys` to a driver blocklist (WDAC / HVCI blocklist)	M1038 Execution Prevention	Microsoft vulnerable-driver blocklist (`DriverSiPolicy.p7b`); CIS Microsoft Windows Benchmark §18.9.x (Device Guard/HVCI)	`Get-CIPolicy` or check `Winver` "Core Isolation > Memory Integrity" is On; confirm blocklist auto-update is enabled
Restrict LSASS access via Credential Guard / LSA Protection (RunAsPPL)	M1043 Credential Access Protection	CIS Microsoft Windows Benchmark §18.10.x; MS Security Baseline "Turn On Virtualization Based Security"	`reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL` — expect value `1`

Near-Term — 1 to 4 weeks (pilot ring first)

Control	MITRE Mitigation	Authority	Verify
Default-deny allowlist for RMM/remote-admin tools (block unapproved PAExec, Mesh Agent, NetExec binaries via EDR prevention policy or AppLocker/WDAC)	M1038 Execution Prevention, M1042 Disable or Remove Feature or Program	CISA/MS-ISAC "Guide to Securing Remote Access Software"; CIS Controls v8 §2.5–2.7	Falcon prevention-policy audit log; `Get-AppLockerPolicy -Effective`
Centralize and protect Windows Event Log forwarding (WEF/Falcon Event Collector) so local clearing doesn't destroy evidence	M1029 Remote Data Storage, M1022 Restrict File and Directory Permissions	CIS Microsoft Windows Benchmark §17.x (Audit Policy); NIST SP 800-92	Confirm subscription status: `wecutil qc` / verify events land in central SIEM within expected latency
Restrict local administrator group membership and enforce LAPS for local admin passwords	M1026 Privileged Account Management	CIS Microsoft Windows Benchmark §5.x; Microsoft LAPS documentation	`Get-LapsADPassword` / confirm rotation interval enforced

Strategic — 1 to 3 months

Control	MITRE Mitigation	Authority	Verify
Network segmentation isolating domain controllers, backup consoles, and financial systems from general user VLANs	M1030 Network Segmentation	CIS Controls v8 §12; NIST SP 800-207 (Zero Trust Architecture)	Firewall rule review; east-west traffic sampling to confirm segment enforcement
Immutable, offline backup architecture not reachable via domain-joined credentials	M1053 Data Backup	CIS Controls v8 §11; NIST SP 800-209	Attempt (in a controlled test) domain-credential access to backup storage — expect denial; confirm immutability/object-lock setting
Infostealer-log monitoring for organizational credential exposure (continuous breach/credential-exposure feed integration)	M1017 User Training (indirectly) / M1032 MFA as compensating control	Industry practice — HIBP/commercial threat-intel feeds; no formal CIS benchmark ⚠ best-practice, no formal benchmark	Confirm feed ingestion pipeline delivers alerts to SOC within SLA

Deployable Playbooks

Playbook A — Block the BYOVD Driver (WDAC / Vulnerable-Driver Blocklist)

Prerequisites: Windows 10 2004+/Windows 11, virtualization extensions enabled in firmware, pilot
  ring identified for HVCI compatibility testing (some third-party drivers conflict with HVCI).
Reboot required: Yes - enabling HVCI/Memory Integrity requires a restart to take effect.

# Step 1 - Confirm HVCI / Memory Integrity is available and enabled
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object VirtualizationBasedSecurityStatus, CodeIntegrityPolicyEnforcementStatus

# Step 2 - Ensure Microsoft's recommended vulnerable driver blocklist is current
# (Microsoft ships/updates this policy; confirm it is enabled rather than authored manually)
Get-CIPolicy -All | Where-Object {$_.PolicyID -match "DriverSiPolicy"}

# Step 3 (fallback) - If HVCI cannot be enabled fleet-wide yet, add an explicit
# WDAC deny rule for the known-bad filename as an interim compensating control
New-CIPolicyRule -FilePath "C:\Windows\System32\drivers\STProcessMonitor_v114.sys" -Level FileName -Deny

Rollback: Disable Memory Integrity via Windows Security -> Device Security -> Core Isolation, then
  reboot; remove the explicit WDAC deny rule by reverting to the prior signed policy version (keep
  the pre-change .p7b backed up before deployment).

Playbook B — Enforce LSA Protection (RunAsPPL) Against Procdump/Mimikatz

Prerequisites: Windows 8.1/Server 2012 R2 or later; confirm no legacy AV/security agents are
  incompatible with protected-process LSASS (test in pilot ring first - incompatible drivers can
  cause boot issues).
Reboot required: Yes.

# Step 1 - Enable LSA Protection via registry (deploy through GPO Group Policy Preferences or Intune)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 1 /f

# Step 2 - Verify
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL

# Step 3 - Spot-check with a CQL query post-deployment (Q3 in this pack) -
# expect LSASS-access attempts from Procdump/Mimikatz to fail rather than succeed

Rollback: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 0 /f
  then reboot.

Playbook C — Default-Deny Unapproved Remote-Admin Tooling (Falcon Prevention Policy)

Prerequisites: Falcon Prevention policy edit rights; an "approved red-team/SOC host group"
  defined so legitimate use isn't blocked; change-management sign-off since this blocks
  execution, not just detects.
Reboot required: No.

# Falcon Console -> Prevention Policies -> [Target Policy] -> Additional Blocking
# Add custom blocking hashes/filenames for: PAExec.exe, PAExec64.exe, nxc.exe/netexec, netscan64.exe
# (organization-specific: if these are used by an internal red team, scope the rule
#  to exclude the red-team AID group rather than disabling org-wide)

# Example custom IOA logic (pseudo, configure via Falcon Custom IOA rule builder):
#   Field: ImageFileName   Operator: matches   Value: *\PAExec*.exe
#   Field: ImageFileName   Operator: matches   Value: *\nxc.exe, *netexec*
#   Field: ImageFileName   Operator: matches   Value: *\netscan*.exe
#   Action: Block execution + Detect (Severity: High) unless AID is in "Approved-RedTeam-Hosts" group

Rollback: Disable/remove the custom IOA rule or move it from "Block" to "Detect only" mode in the
  Falcon console; no endpoint state change to undo.

Playbook D — Centralize Windows Event Log Forwarding

Prerequisites: A collector server provisioned with WEF role, network connectivity from endpoints
  (WinRM/HTTP 5985 or HTTPS 5986), GPO deployment rights.
Reboot required: No.

# Step 1 - Configure WEF subscription on collector server (source-initiated)
wecutil qc /q

# Step 2 - On endpoints, confirm subscription is active
wecutil gs "Settra-Security-EventLog-Subscription"

# Step 3 - Restrict local log-clearing permission (defense-in-depth; logs are
# still forwarded even if local copy is cleared)
# Apply via GPO: Computer Config > Windows Settings > Security Settings >
#   Event Log > "Restrict Guest access to the Application/Security log" = Enabled

Rollback: Remove the WEF subscription (wecutil ds "Settra-Security-EventLog-Subscription") and
  revert the GPO restricting log access; no rollback required for endpoint state beyond that -
  this control only adds forwarding, it does not remove existing local logging behavior.

Containment Runbook

Phase 1 — Isolate

Network-isolate (Falcon Network Containment) any host showing Q1 (BYOVD driver), Q3 (LSASS dump), or Q7 (log clearing) IOA firings.
Disable/rotate credentials for any account observed in an anomalous VPN logon consistent with T1078, especially if the account also appears in a known infostealer-log exposure feed.
Preserve current Windows Event Logs and Falcon telemetry for affected hosts before further remediation (avoid destroying forensic evidence).

Phase 2 — Eradicate

Remove the vulnerable driver file (STProcessMonitor_v114.sys) and any associated kernel-mode service registration from affected hosts.
Uninstall/remove unauthorized Mesh Agent instances not matching your approved RMM baseline; rotate any credentials the agent may have had access to.
Terminate PAExec/NetExec-spawned processes and remove any dropped PAExec service artifacts (PAExec*.exe, associated named pipes/services).
Force credential resets for all accounts touched during the intrusion window, prioritizing accounts with domain admin or backup-console access.

Phase 3 — Recover

Validate backup integrity from an offline/immutable copy predating the earliest suspected compromise date (Proven Data's ~20-day average dwell window before disclosure means backups from the prior 30 days may be compromised — verify before restoring).
Re-image affected endpoints where BYOVD/kernel-level tampering occurred rather than relying on in-place remediation.
Re-enable HVCI/Memory Integrity and LSA Protection (Playbooks A/B) on rebuilt hosts before returning them to production.
Monitor the Settra Tor leak site (OSINT only, via a dedicated dark-web monitoring capability — do not browse Tor directly from corporate infrastructure) for any post-incident data-exposure claims tied to your organization.

Detection Coverage Map

Attack Chain Step	Covering Query / Control	Status
Initial Access (Valid Accounts / infostealer creds)	Native VPN/IdP log hunt (§7); Playbook A MFA control	Partial — requires VPN/IdP log ingestion outside Falcon
Discovery (NetExec/Netscan)	Q5	Covered
Credential Access (Procdump/Mimikatz)	Q3 (IOA)	Covered
Lateral Movement (PAExec/NetExec)	Q4, Q5	Covered
Defense Evasion — edr_blind	Q6	Partial — behavioral only, no confirmed binary/hash
Defense Evasion — log clearing	Q7 (IOA); native Event ID 1102/104 hunt (§7)	Covered
Defense Evasion / Priv Esc — BYOVD	Q1 (IOA), Q2; Playbook A	Covered
C2 / Persistence — Mesh Agent	Q8	Partial — high FP, requires org-specific RMM baseline tuning
Exfiltration (alternative protocol)	Q9 (archive staging); native outbound-volume monitoring recommended	Partial — no confirmed exfil protocol/destination published
Extortion / Leak-site posting	OSINT monitoring only (§4, §14 Phase 3)	Gap — not an endpoint-telemetry event by nature
Encryption / Impact (T1486)	None — no sample exists	Gap — flagged, cannot build sample-based detection; generic ransomware-impact hunts (mass rename, shadow-copy deletion) are the only mitigant and are out of scope for this Settra-specific pack

Hunt Summary Ticket

TICKET: HUNT-SETTRA-2026-09-10
THREAT: Settra Ransomware (double-extortion RaaS / data-extortion group)
VERSION: 2026-09-10
STATUS: Ready for tenant validation
PRIORITY: High
OWNER: ai@hutzley.com

SUMMARY:
  Settra is an active double-extortion ransomware/data-extortion group, first
  publicly observed June 2026, with 64+ claimed victims as of September 2026.
  Initial access is credential-driven (VPN + infostealer logs, T1078). Attack
  chain relies on LOLBins/red-team tooling (NetExec, Netscan, Procdump,
  Mimikatz, PAExec) plus a distinctive BYOVD technique using the vulnerable
  driver STProcessMonitor_v114.sys and abuse of legitimate Mesh Agent RMM
  software for persistence. No public malware sample, hash, or C2
  infrastructure exists as of this ticket date - all detections are
  behavior/TTP-based.

SCOPE:
  9 CQL hunt queries (3 IOA candidates: Q1, Q3, Q7), 5 native audit-log
  checks, tiered hardening (3 immediate / 3 near-term / 3 strategic
  controls), 4 deployable playbooks, 3-phase containment runbook.

NEXT ACTIONS:
  1. Validate all field names (ImageFileName, ServiceImagePath, etc.) against
     your Falcon tenant's schema before enabling IOAs.
  2. Deploy Playbook A (driver blocklist) and Playbook B (LSA Protection)
     immediately - lowest friction, highest leverage against the pack's
     most distinctive TTP (BYOVD).
  3. Stand up dark-web/leak-site monitoring for organizational exposure on
     Settra's Tor leak site rather than manual browsing.
  4. Re-check MoxFive/Proven Data/ransomware.live monthly for hash or C2
     disclosure - none exists as of 2026-09-10.

Changelog

v1.02026-09-10Initial HuntPack release — full pipeline run (web-hunter-v2 → threat-hunter-v2 → crowdstrike-logscale-v3 → alert-builder-v2 → threat-hardening-v2 → review-v2). 4 sources fetched and saved; 9 CQL queries; 3 IOA candidates; tiered hardening + 4 playbooks + containment runbook.

References

Tier	Source	Used For	Access Date
T1	MoxFive — Settra Ransomware: TTPs, Victims, and Defense Guide	Primary technical source: full attack-chain tool list, BYOVD driver, defensive checklist	2026-09-10
T1	Proven Data — SETTRA Ransomware: Emerging Double-Extortion Threat	Primary MITRE/IOC source: ATT&CK mapping, victimology stats, explicit no-hash/no-C2 confirmation	2026-09-10
T2	ransomware.live — Group profile: Settra	Freshness/corroboration: live victim count, onion/Tox corroboration, sector/country breakdown	2026-09-10
T2	DeXpose — Settra Ransomware Attack on MedEvolve	Single-victim corroboration of active September 2026 claims	2026-09-10

All four source snapshots (verbatim fetched text) are saved under Settra-Ransomware-Hunt-sources/ alongside this file for provenance validation.