Sirius Backdoor: FedEx Tax-Invoice Fileless Campaign

// HUNT: PDF reader launches PowerShell or a script host
// MITRE: T1204.002, T1059.001, T1566.001
// CONF: high  FP: low  COST: low | REQUIRES: process creation with parent (ProcessRollup2)
// FALSE POSITIVES: rare PDF workflows that call a helper script
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(AcroRd32|Acrobat|AcroCEF|Foxit.*|SumatraPDF|PDFXCview)(\.exe)?$/i
| FileName=/^(powershell|pwsh|cmd|wscript|cscript|mshta)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData, aid])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' src.process.name = * tgt.process.name = *
| limit 5
| columns event.type, event.time, src.process.name, tgt.process.name, tgt.process.cmdline

// HUNT: PDF reader launches PowerShell or a script host
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.002, T1059.001, T1566.001
// CONF: high | FP: low
// FALSE POSITIVES: rare PDF workflows that call a helper script
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a PDF reader as the creator and a shell or script host as the created process. On a Process Creation event the creator is src.process and the new process is tgt.process. Matching is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne endpoint process-creation telemetry
// TUNING: Exclude a sanctioned PDF workflow that calls a helper script, by creator and command line, after a baseline review.
// LOOKBACK: 30d; set the console time picker to match the CQL tab
// CONFIGURATION: No data table or lookup required.
// KNOWN GAPS: A shell started by a process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name matches '^(AcroRd32|Acrobat|AcroCEF|Foxit.*|SumatraPDF|PDFXCview)(\\.exe)?$' tgt.process.name matches '^(powershell|pwsh|cmd|wscript|cscript|mshta)(\\.exe)?$'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.process.image.sha256, agent.uuid
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName, ProcessCommandLine
| take 5

// HUNT: PDF reader launches PowerShell or a script host
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.002, T1059.001, T1566.001
// CONF: high | FP: low
// FALSE POSITIVES: rare PDF workflows that call a helper script
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the creator is InitiatingProcessFileName and the created process is FileName. The regex is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude a sanctioned PDF workflow that calls a helper script, by creator and command line, after a baseline review.
// LOOKBACK: 30d (Advanced Hunting retention; matches the CQL tab)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A shell started by a process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName matches regex @"(?i)^(AcroRd32|Acrobat|AcroCEF|Foxit.*|SumatraPDF|PDFXCview)(\.exe)?$"
| where FileName matches regex @"(?i)^(powershell|pwsh|cmd|wscript|cscript|mshta)(\.exe)?$"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Hidden encoded PowerShell with the stager flag set
// MITRE: T1059.001, T1027, T1140
// CONF: medium  FP: medium  COST: low | REQUIRES: process creation with command line (ProcessRollup2)
// FALSE POSITIVES: management and deployment tools that launch hidden encoded PowerShell
// TUNING: exclude your software-deployment agent parent processes and known signed management scripts by ParentBaseFileName; keep PDF readers, Office and browsers in scope
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(powershell|pwsh)(\.exe)?$/i
| CommandLine=/-w(indowstyle)?\s+h(idden)?\b/i
| CommandLine=/-nop(rofile)?\b/i
| CommandLine=/-noni(nteractive)?\b/i
| CommandLine=/-ep\s+bypass|-executionpolicy\s+bypass/i
| CommandLine=/\s-(e|enc|encodedcommand)\s+[A-Za-z0-9+=]{40,}/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData, aid])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.type, event.time, tgt.process.name, tgt.process.cmdline

// HUNT: Hidden encoded PowerShell with the stager flag set
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.001, T1027, T1140
// CONF: medium | FP: medium
// FALSE POSITIVES: management and deployment tools that launch hidden encoded PowerShell
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: PowerShell created with the hidden window, no-profile, non-interactive and execution-policy-bypass switches, plus an encoded command of 40 or more base64 characters. Each switch is its own condition, as in the CQL. Matching is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne endpoint process-creation telemetry with full command lines
// TUNING: Exclude your software-deployment agent creators and known signed management scripts by creator name; keep PDF readers, Office and browsers in scope.
// LOOKBACK: 30d; set the console time picker to match the CQL tab
// CONFIGURATION: No data table or lookup required.
// KNOWN GAPS: A PowerShell launch whose command line is truncated or hidden from the agent is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name matches '^(powershell|pwsh)(\\.exe)?$' tgt.process.cmdline matches '-w(indowstyle)?\\s+h(idden)?\\b' tgt.process.cmdline matches '-nop(rofile)?\\b' tgt.process.cmdline matches '-noni(nteractive)?\\b' tgt.process.cmdline matches '-ep\\s+bypass|-executionpolicy\\s+bypass' tgt.process.cmdline matches '\\s-(e|enc|encodedcommand)\\s+[A-Za-z0-9+=]{40,}'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.process.image.sha256, agent.uuid
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: Hidden encoded PowerShell with the stager flag set
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.001, T1027, T1140
// CONF: medium | FP: medium
// FALSE POSITIVES: management and deployment tools that launch hidden encoded PowerShell
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: PowerShell created with the hidden window, no-profile, non-interactive and execution-policy-bypass switches, plus an encoded command of 40 or more base64 characters. Each switch is its own regex condition, as in the CQL, and (?i) reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude your software-deployment agent creators and known signed management scripts by InitiatingProcessFileName; keep PDF readers, Office and browsers in scope.
// LOOKBACK: 30d (Advanced Hunting retention; matches the CQL tab)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A PowerShell launch the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName matches regex @"(?i)^(powershell|pwsh)(\.exe)?$"
| where ProcessCommandLine matches regex @"(?i)-w(indowstyle)?\s+h(idden)?\b"
| where ProcessCommandLine matches regex @"(?i)-nop(rofile)?\b"
| where ProcessCommandLine matches regex @"(?i)-noni(nteractive)?\b"
| where ProcessCommandLine matches regex @"(?i)-ep\s+bypass|-executionpolicy\s+bypass"
| where ProcessCommandLine matches regex @"(?i)\s-(e|enc|encodedcommand)\s+[A-Za-z0-9+=]{40,}"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Process-hollowing host with an anomalous parent
// MITRE: T1055.004, T1055.012, T1036.005
// CONF: medium  FP: medium  COST: low | REQUIRES: process creation with parent (ProcessRollup2)
// FALSE POSITIVES: build tooling that legitimately shells msbuild.exe; rare svchost launchers
// TUNING: add parent names that your build servers and developer tooling use for msbuild.exe; for svchost.exe exclude any parent you confirm on a clean host
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=*
| (FileName=/^msbuild(\.exe)?$/i and ParentBaseFileName=/^(powershell|pwsh|cmd|wscript|cscript|mshta|AcroRd32|Acrobat)(\.exe)?$/i) or (FileName=/^svchost(\.exe)?$/i and ParentBaseFileName!=/^services(\.exe)?$/i)
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, aid])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' src.process.name = * tgt.process.name = *
| limit 5
| columns event.type, event.time, src.process.name, tgt.process.name

// HUNT: Process-hollowing host with an anomalous parent
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1055.004, T1055.012, T1036.005
// CONF: medium | FP: medium
// FALSE POSITIVES: build tooling that legitimately shells msbuild.exe; rare svchost launchers
// EQUIVALENCE: equivalent-with-schema-assumptions - Same two branches: msbuild created by a script host or PDF reader, or svchost created by anything other than services. The new process is tgt.process and its creator is src.process on a Process Creation event. Matching is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne endpoint process-creation telemetry
// TUNING: Add the creators your build servers and developer tooling use for msbuild; for svchost exclude any creator you confirm on a clean host.
// LOOKBACK: 30d; set the console time picker to match the CQL tab
// CONFIGURATION: No data table or lookup required.
// KNOWN GAPS: A hollowed host started by a creator the agent did not observe is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name = * ((tgt.process.name matches '^msbuild(\\.exe)?$' and src.process.name matches '^(powershell|pwsh|cmd|wscript|cscript|mshta|AcroRd32|Acrobat)(\\.exe)?$') or (tgt.process.name matches '^svchost(\\.exe)?$' and !(src.process.name matches '^services(\\.exe)?$')))
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, agent.uuid
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName
| take 5

// HUNT: Process-hollowing host with an anomalous parent
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1055.004, T1055.012, T1036.005
// CONF: medium | FP: medium
// FALSE POSITIVES: build tooling that legitimately shells msbuild.exe; rare svchost launchers
// EQUIVALENCE: equivalent-with-schema-assumptions - Same two branches: msbuild created by a script host or PDF reader, or svchost created by anything other than services. The creator is InitiatingProcessFileName. The regex is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Add the creators your build servers and developer tooling use for msbuild; for svchost exclude any creator you confirm on a clean host.
// LOOKBACK: 30d (Advanced Hunting retention; matches the CQL tab)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A hollowed host started by a creator the sensor did not observe is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where isnotempty(InitiatingProcessFileName)
| where (FileName matches regex @"(?i)^msbuild(\.exe)?$" and InitiatingProcessFileName matches regex @"(?i)^(powershell|pwsh|cmd|wscript|cscript|mshta|AcroRd32|Acrobat)(\.exe)?$") or (FileName matches regex @"(?i)^svchost(\.exe)?$" and not(InitiatingProcessFileName matches regex @"(?i)^services(\.exe)?$"))
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: svchost.exe running outside the Windows system directories
// MITRE: T1036.005, T1055
// CONF: high  FP: low  COST: low | REQUIRES: process creation with image path (ProcessRollup2)
// FALSE POSITIVES: none expected; a renamed copy is not legitimate
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^svchost(\.exe)?$/i
| ImageFileName!=/\\Windows\\(System32|SysWOW64|WinSxS)\\/i
| table([@timestamp, ComputerName, UserName, ImageFileName, ParentBaseFileName, CommandLine, SHA256HashData, aid])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.name = * tgt.process.image.path = *
| limit 5
| columns event.type, event.time, tgt.process.name, tgt.process.image.path

// HUNT: svchost.exe running outside the Windows system directories
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1036.005, T1055
// CONF: high | FP: low
// FALSE POSITIVES: none expected; a renamed copy is not legitimate
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a process named svchost whose image path is outside the Windows System32, SysWOW64 and WinSxS directories. The image path is tgt.process on a Process Creation event. Matching is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne endpoint process-creation telemetry with image paths
// TUNING: None expected; a renamed copy is not legitimate.
// LOOKBACK: 30d; set the console time picker to match the CQL tab
// CONFIGURATION: No data table or lookup required.
// KNOWN GAPS: A copy that never starts as a new process is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name matches '^svchost(\\.exe)?$' !(tgt.process.image.path matches '\\\\Windows\\\\(System32|SysWOW64|WinSxS)\\\\')
| columns event.time, endpoint.name, src.process.user, tgt.process.image.path, src.process.name, tgt.process.cmdline, tgt.process.image.sha256, agent.uuid
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath
| take 5

// HUNT: svchost.exe running outside the Windows system directories
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1036.005, T1055
// CONF: high | FP: low
// FALSE POSITIVES: none expected; a renamed copy is not legitimate
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a process named svchost whose path is outside the Windows System32, SysWOW64 and WinSxS directories. The regex is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected; a renamed copy is not legitimate.
// LOOKBACK: 30d (Advanced Hunting retention; matches the CQL tab)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A copy that never starts as a new process is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName matches regex @"(?i)^svchost(\.exe)?$"
| where not(FolderPath matches regex @"(?i)\\Windows\\(System32|SysWOW64|WinSxS)\\")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FolderPath, InitiatingProcessFileName, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Payload drop: svchost.exe outside system paths or user32.dll into System32
// MITRE: T1036.005, T1574.001, T1547
// CONF: high  FP: low  COST: low | REQUIRES: executable file write (CrowdStrike: PeFileWritten, NewExecutableWritten)
// FALSE POSITIVES: servicing writes user32.dll via TrustedInstaller and TiWorker
// TUNING: exclude the Windows servicing writers shown below; do not exclude svchost.exe or msbuild.exe as writers because the hollowed host is the likely writer
// LOOKBACK: 30d
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| (TargetFileName=/\\Windows\\System32\\user32\.dll$/i) or (TargetFileName=/\\svchost\.exe$/i and TargetFileName!=/\\Windows\\(System32|SysWOW64|WinSxS)\\/i)
| ContextBaseFileName!=/^(TiWorker|TrustedInstaller|SetupHost|MoUsoCoreWorker)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData, aid])
| sort(@timestamp, order=desc)

event.type = 'File Creation' tgt.file.path = * src.process.name = *
| limit 5
| columns event.type, event.time, tgt.file.path, src.process.name

// HUNT: Payload drop: svchost.exe outside system paths or user32.dll into System32
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1036.005, T1574.001, T1547
// CONF: high | FP: low
// FALSE POSITIVES: servicing writes user32.dll via TrustedInstaller and TiWorker
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: user32.dll written under Windows System32, or svchost.exe written outside the system directories, by a writer other than the Windows servicing processes. The writer is src.process on a File Creation event. Matching is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne endpoint file-creation telemetry
// TUNING: Exclude the Windows servicing writers already listed; do not exclude svchost or msbuild as writers because the hollowed host is the likely writer.
// LOOKBACK: 30d; set the console time picker to match the CQL tab
// CONFIGURATION: No data table or lookup required.
// KNOWN GAPS: An existing file overwritten in place raises a modification event rather than a creation event and is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'File Creation' ((tgt.file.path matches '\\\\Windows\\\\System32\\\\user32\\.dll$') or (tgt.file.path matches '\\\\svchost\\.exe$' and !(tgt.file.path matches '\\\\Windows\\\\(System32|SysWOW64|WinSxS)\\\\'))) !(src.process.name matches '^(TiWorker|TrustedInstaller|SetupHost|MoUsoCoreWorker)(\\.exe)?$')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.file.path, tgt.file.sha256, agent.uuid
| sort -event.time
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, FileName, FolderPath, InitiatingProcessFileName
| take 5

// HUNT: Payload drop: svchost.exe outside system paths or user32.dll into System32
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1036.005, T1574.001, T1547
// CONF: high | FP: low
// FALSE POSITIVES: servicing writes user32.dll via TrustedInstaller and TiWorker
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: user32.dll written under Windows System32, or svchost.exe written outside the system directories, by a writer other than the Windows servicing processes. The writer is InitiatingProcessFileName. The folder test is a substring match so it works whether the column holds the folder or the full path.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: Exclude the Windows servicing writers already listed; do not exclude svchost or msbuild as writers because the hollowed host is the likely writer.
// LOOKBACK: 30d (Advanced Hunting retention; matches the CQL tab)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An existing file overwritten in place records a modification action rather than a creation and is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where ActionType == "FileCreated"
| where (FileName =~ "user32.dll" and FolderPath contains "\\Windows\\System32") or (FileName =~ "svchost.exe" and FolderPath !contains "\\Windows\\System32" and FolderPath !contains "\\Windows\\SysWOW64" and FolderPath !contains "\\Windows\\WinSxS")
| where not(InitiatingProcessFileName matches regex @"(?i)^(TiWorker|TrustedInstaller|SetupHost|MoUsoCoreWorker)(\.exe)?$")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, FileName, FolderPath, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Sirius registry persistence: UserInit, BootExecute, default-hive, RUNASADMIN
// MITRE: T1547.010, T1547.001, T1548.002, T1112
// CONF: medium  FP: medium  COST: low | REQUIRES: registry value set (CrowdStrike: AsepValueUpdate, RegGenericValueUpdate, RegSystemConfigValueUpdate)
// FALSE POSITIVES: BootExecute servicing, application compatibility settings set by admins
// TUNING: exclude the stock BootExecute value (autocheck autochk *) and RUNASADMIN writes made by your compatibility-management tooling; keep every UserInitMgrLogonScriptName and SURV_DEFAULT hit
// LOOKBACK: 30d
#event_simpleName=/^(AsepValueUpdate|RegGenericValueUpdate|RegSystemConfigValueUpdate)$/
| (RegValueName=/^(UserInitMgrLogonScriptName|BootExecute)$/i) or (RegObjectName=/SURV_DEFAULT/i) or (RegObjectName=/AppCompatFlags\\Layers/i and RegStringValue=/RUNASADMIN/i)
| RegStringValue!=/^autocheck autochk \*$/i
| table([@timestamp, ComputerName, ImageFileName, RegObjectName, RegValueName, RegStringValue, aid])
| sort(@timestamp, order=desc)

event.type = 'Registry Value Modified' registry.keyPath = *
| limit 5
| columns event.type, event.time, registry.valueName, registry.keyPath, registry.value

// HUNT: Sirius registry persistence: UserInit, BootExecute, default-hive, RUNASADMIN
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1547.010, T1547.001, T1548.002, T1112
// CONF: medium | FP: medium
// FALSE POSITIVES: BootExecute servicing, application compatibility settings set by admins
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a registry value named UserInitMgrLogonScriptName or BootExecute, a key path containing SURV_DEFAULT, or an AppCompatFlags Layers value containing RUNASADMIN, excluding the stock autocheck BootExecute value. Matching is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne endpoint registry telemetry
// TUNING: Exclude RUNASADMIN writes made by your compatibility-management tooling; keep every UserInitMgrLogonScriptName and SURV_DEFAULT hit.
// LOOKBACK: 30d; set the console time picker to match the CQL tab
// CONFIGURATION: No data table or lookup required.
// KNOWN GAPS: A key created without a value write is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified' ((registry.valueName matches '^(UserInitMgrLogonScriptName|BootExecute)$') or (registry.keyPath matches 'SURV_DEFAULT') or (registry.keyPath matches 'AppCompatFlags\\\\Layers' and registry.value matches 'RUNASADMIN')) !(registry.value matches '^autocheck autochk [*]$')
| columns event.time, endpoint.name, src.process.image.path, registry.keyPath, registry.valueName, registry.value, agent.uuid
| sort -event.time
| limit 200

DeviceRegistryEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, RegistryKey, RegistryValueName, RegistryValueData
| take 5

// HUNT: Sirius registry persistence: UserInit, BootExecute, default-hive, RUNASADMIN
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1547.010, T1547.001, T1548.002, T1112
// CONF: medium | FP: medium
// FALSE POSITIVES: BootExecute servicing, application compatibility settings set by admins
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a registry value named UserInitMgrLogonScriptName or BootExecute, a key containing SURV_DEFAULT, or an AppCompatFlags Layers value containing RUNASADMIN, excluding the stock autocheck BootExecute value. The contains and in~ operators are case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint registry telemetry (DeviceRegistryEvents)
// TUNING: Exclude RUNASADMIN writes made by your compatibility-management tooling; keep every UserInitMgrLogonScriptName and SURV_DEFAULT hit.
// LOOKBACK: 30d (Advanced Hunting retention; matches the CQL tab)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A key created without a value write is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceRegistryEvents
| where Timestamp >= ago(30d)
| where ActionType == "RegistryValueSet"
| where RegistryValueName in~ ("UserInitMgrLogonScriptName", "BootExecute") or RegistryKey contains "SURV_DEFAULT" or (RegistryKey contains "AppCompatFlags\\Layers" and RegistryValueData contains "RUNASADMIN")
| where RegistryValueData !~ "autocheck autochk *"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData
| sort by Timestamp desc
| take 200

// HUNT: Scheduled task created from XML by a shell or user-writable path
// MITRE: T1053.005, T1059.003
// CONF: medium  FP: medium  COST: low | REQUIRES: process creation with command line (ProcessRollup2)
// FALSE POSITIVES: installers and management agents that register tasks from XML
// TUNING: exclude XML paths under your software-deployment cache and parent processes of your management agent
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^schtasks(\.exe)?$/i
| CommandLine=/\/create/i
| CommandLine=/\/xml/i
| (ParentBaseFileName=/^(svchost|msbuild|powershell|pwsh|wscript|cscript)(\.exe)?$/i) or (CommandLine=/\\(AppData|Temp|ProgramData)\\/i)
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData, aid])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.name = * tgt.process.cmdline = * src.process.name = *
| limit 5
| columns event.type, event.time, tgt.process.name, tgt.process.cmdline, src.process.name

// HUNT: Scheduled task created from XML by a shell or user-writable path
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1053.005, T1059.003
// CONF: medium | FP: medium
// FALSE POSITIVES: installers and management agents that register tasks from XML
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: schtasks creating a task from an XML file, where the creator is svchost, msbuild or a script host, or the command line names an AppData, Temp or ProgramData folder. The creator is src.process on a Process Creation event. Matching is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne endpoint process-creation telemetry with full command lines
// TUNING: Exclude XML paths under your software-deployment cache and the creators of your management agent.
// LOOKBACK: 30d; set the console time picker to match the CQL tab
// CONFIGURATION: No data table or lookup required.
// KNOWN GAPS: A task registered through the Task Scheduler API without schtasks is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name matches '^schtasks(\\.exe)?$' tgt.process.cmdline matches '/create' tgt.process.cmdline matches '/xml' ((src.process.name matches '^(svchost|msbuild|powershell|pwsh|wscript|cscript)(\\.exe)?$') or (tgt.process.cmdline matches '\\\\(AppData|Temp|ProgramData)\\\\'))
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.process.image.sha256, agent.uuid
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine, InitiatingProcessFileName
| take 5

// HUNT: Scheduled task created from XML by a shell or user-writable path
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1053.005, T1059.003
// CONF: medium | FP: medium
// FALSE POSITIVES: installers and management agents that register tasks from XML
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: schtasks creating a task from an XML file, where the creator is svchost, msbuild or a script host, or the command line names an AppData, Temp or ProgramData folder. The creator is InitiatingProcessFileName. contains and (?i) reproduce the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude XML paths under your software-deployment cache and the creators of your management agent.
// LOOKBACK: 30d (Advanced Hunting retention; matches the CQL tab)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A task registered through the Task Scheduler API without schtasks is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName matches regex @"(?i)^schtasks(\.exe)?$"
| where ProcessCommandLine contains "/create" and ProcessCommandLine contains "/xml"
| where InitiatingProcessFileName matches regex @"(?i)^(svchost|msbuild|powershell|pwsh|wscript|cscript)(\.exe)?$" or ProcessCommandLine matches regex @"(?i)\\(AppData|Temp|ProgramData)\\"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Execution of Sirius persistence artifacts by name
// MITRE: T1547.001, T1037.003, T1059.005, T1547
// CONF: medium  FP: medium  COST: low | REQUIRES: process creation with command line (ProcessRollup2)
// FALSE POSITIVES: legitimate SetupComplete.cmd in imaging, legitimate provisioning packages
// TUNING: exclude SetupComplete.cmd and provisioning-package commands on build and imaging hosts or in your Autopilot and provisioning service accounts; updater.vbs and WindowsUpdate.lnk have few benign users
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(updater\.vbs|WindowsUpdate\.lnk|logon\.cmd|SetupComplete\.cmd|SysConfig_[0-9A-Fa-f]{8}\.ppkg|Recovery\\Customizations)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData, aid])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.type, event.time, tgt.process.cmdline

// HUNT: Execution of Sirius persistence artifacts by name
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1547.001, T1037.003, T1059.005, T1547
// CONF: medium | FP: medium
// FALSE POSITIVES: legitimate SetupComplete.cmd in imaging, legitimate provisioning packages
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a command line naming one of the Sirius persistence artifacts (updater.vbs, WindowsUpdate.lnk, logon.cmd, SetupComplete.cmd, a SysConfig provisioning package, or the Recovery Customizations folder). Matching is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne endpoint process-creation telemetry with full command lines
// TUNING: Exclude SetupComplete.cmd and provisioning-package commands on build and imaging hosts or in your provisioning service accounts; updater.vbs and WindowsUpdate.lnk have few benign users.
// LOOKBACK: 30d; set the console time picker to match the CQL tab
// CONFIGURATION: No data table or lookup required.
// KNOWN GAPS: An artifact run without its name on any command line is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.cmdline matches '(updater\\.vbs|WindowsUpdate\\.lnk|logon\\.cmd|SetupComplete\\.cmd|SysConfig_[0-9A-Fa-f]{8}\\.ppkg|Recovery\\\\Customizations)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.process.image.sha256, agent.uuid
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: Execution of Sirius persistence artifacts by name
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1547.001, T1037.003, T1059.005, T1547
// CONF: medium | FP: medium
// FALSE POSITIVES: legitimate SetupComplete.cmd in imaging, legitimate provisioning packages
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a command line naming one of the Sirius persistence artifacts (updater.vbs, WindowsUpdate.lnk, logon.cmd, SetupComplete.cmd, a SysConfig provisioning package, or the Recovery Customizations folder). contains and (?i) reproduce the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude SetupComplete.cmd and provisioning-package commands on build and imaging hosts or in your provisioning service accounts; updater.vbs and WindowsUpdate.lnk have few benign users.
// LOOKBACK: 30d (Advanced Hunting retention; matches the CQL tab)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: An artifact run without its name on any command line is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine contains "updater.vbs" or ProcessCommandLine contains "WindowsUpdate.lnk" or ProcessCommandLine contains "logon.cmd" or ProcessCommandLine contains "SetupComplete.cmd" or ProcessCommandLine matches regex @"(?i)SysConfig_[0-9A-F]{8}\.ppkg" or ProcessCommandLine contains "Recovery\\Customizations"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Defender exclusions and shadow copy deletion
// MITRE: T1562.001, T1490
// CONF: medium  FP: medium  COST: low | REQUIRES: process creation with command line (ProcessRollup2)
// FALSE POSITIVES: backup software, IT automation and security tooling
// TUNING: exclude the parent processes of your backup and IT-automation agents; keep any hit whose parent is powershell, svchost or msbuild started from a user session
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(Add-MpPreference.*-Exclusion(Path|Process|Extension)|Set-MpPreference.*-DisableRealtimeMonitoring|vssadmin(\.exe)?\s+delete\s+shadows|shadowcopy\s+delete)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData, aid])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.type, event.time, tgt.process.cmdline

// HUNT: Defender exclusions and shadow copy deletion
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1562.001, T1490
// CONF: medium | FP: medium
// FALSE POSITIVES: backup software, IT automation and security tooling
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a command line that adds a Defender exclusion, disables real-time monitoring, or deletes shadow copies. Matching is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne endpoint process-creation telemetry with full command lines
// TUNING: Exclude the creators of your backup and IT-automation agents; keep any hit whose creator is powershell, svchost or msbuild started from a user session.
// LOOKBACK: 30d; set the console time picker to match the CQL tab
// CONFIGURATION: No data table or lookup required.
// KNOWN GAPS: Exclusions set through Group Policy, the registry or an API without a command line are not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.cmdline matches '(Add-MpPreference.*-Exclusion(Path|Process|Extension)|Set-MpPreference.*-DisableRealtimeMonitoring|vssadmin(\\.exe)?\\s+delete\\s+shadows|shadowcopy\\s+delete)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.process.image.sha256, agent.uuid
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: Defender exclusions and shadow copy deletion
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1562.001, T1490
// CONF: medium | FP: medium
// FALSE POSITIVES: backup software, IT automation and security tooling
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a command line that adds a Defender exclusion, disables real-time monitoring, or deletes shadow copies. (?i) reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude the creators of your backup and IT-automation agents; keep any hit whose creator is powershell, svchost or msbuild started from a user session.
// LOOKBACK: 30d (Advanced Hunting retention; matches the CQL tab)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Exclusions set through Group Policy, the registry or an API without a command line are not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine matches regex @"(?i)(Add-MpPreference.*-Exclusion(Path|Process|Extension)|Set-MpPreference.*-DisableRealtimeMonitoring|vssadmin(\.exe)?\s+delete\s+shadows|shadowcopy\s+delete)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Sirius C2 address and payload domain
// MITRE: T1071.001, T1095
// CONF: high  FP: low  COST: low | REQUIRES: outbound connection and DNS lookup (CrowdStrike: NetworkConnectIP4, DnsRequest)
// FALSE POSITIVES: none expected for this IP and domain
// LOOKBACK: 30d
#event_simpleName=/^(NetworkConnectIP4|DnsRequest)$/
| (RemoteAddressIP4="185.114.206.45") or (DomainName=/(^|\.)dubaitechnicalservice\.ae$/i)
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, DomainName, RemoteAddressIP4, RemotePort, aid])
| sort(@timestamp, order=desc)

event.category = 'dns'
| limit 5
| columns event.type, event.time, dst.ip.address, event.dns.request

// HUNT: Sirius C2 address and payload domain
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1095
// CONF: high | FP: low
// FALSE POSITIVES: none expected for this IP and domain
// EQUIVALENCE: equivalent-with-schema-assumptions - Same two indicators across the two event populations the CQL reads: an outbound connection to the C2 address, or a DNS lookup of the payload domain. The domain test is a substring match, which also covers its subdomains.
// REQUIRES: SentinelOne endpoint network and DNS telemetry
// TUNING: None expected for this address and domain.
// LOOKBACK: 30d; set the console time picker to match the CQL tab
// CONFIGURATION: No data table or lookup required.
// KNOWN GAPS: If DNS events are not collected on a tenant, only the address half of the hunt returns rows.
// VALIDATION LEVEL: static-reviewed
(event.type = 'IP Connect' dst.ip.address = '185.114.206.45') or (event.type = 'DNS Resolved' event.dns.request contains 'dubaitechnicalservice.ae')
| columns event.time, endpoint.name, src.process.name, event.dns.request, dst.ip.address, dst.port.number, agent.uuid
| sort -event.time
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, RemoteIP, RemoteUrl, RemotePort
| take 5

// HUNT: Sirius C2 address and payload domain
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1095
// CONF: high | FP: low
// FALSE POSITIVES: none expected for this IP and domain
// EQUIVALENCE: approximate-analytic - The address is matched on RemoteIP and the payload domain on RemoteUrl of connections. The CQL also reads name lookups, which have no endpoint table here; a lookup that never led to a connection is not visible.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: None expected for this address and domain.
// LOOKBACK: 30d (Advanced Hunting retention; matches the CQL tab)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A name lookup that never led to a connection is not captured; use the CQL tab for the lookup events.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemoteIP == "185.114.206.45" or RemoteUrl contains "dubaitechnicalservice.ae"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| sort by Timestamp desc
| take 200

// HUNT: msbuild.exe making external connections
// MITRE: T1127.001, T1055.012, T1071.001
// CONF: medium  FP: medium  COST: medium | REQUIRES: outbound connection with process name (CrowdStrike: NetworkConnectIP4)
// FALSE POSITIVES: package restore and build agents reaching public registries
// TUNING: add your known package-feed and build-service destinations by RemoteAddressIP4 range, or scope the query to hosts outside the build-server asset group
// LOOKBACK: 30d
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^msbuild(\.exe)?$/i
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","127.0.0.0/8","169.254.0.0/16"])
| groupBy([aid, ComputerName, RemoteAddressIP4, RemotePort], function=[count(as=Conns), max(@timestamp, as=LastSeen)], limit=500)
| sort(Conns, order=desc, limit=200)

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.type, event.time, src.process.name, dst.ip.address, dst.port.number

// HUNT: msbuild.exe making external connections
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1127.001, T1055.012, T1071.001
// CONF: medium | FP: medium
// FALSE POSITIVES: package restore and build agents reaching public registries
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: msbuild connecting to a non-private, non-loopback, non-link-local address, summarised per host, destination and port. The acting process is src.process on an IP Connect event. Matching is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne endpoint network telemetry with the acting process
// TUNING: Add your known package-feed and build-service destinations, or scope the query to hosts outside the build-server group.
// LOOKBACK: 30d; set the console time picker to match the CQL tab
// CONFIGURATION: No data table or lookup required.
// KNOWN GAPS: The CQL tab's 500 row grouping cap has no equivalent; the output is capped at 200 rows.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' src.process.name matches '^msbuild(\\.exe)?$' dst.ip.address = * !(net_rfc1918(dst.ip.address)) !(net_ipsubnet(dst.ip.address, '127.0.0.0/8')) !(net_ipsubnet(dst.ip.address, '169.254.0.0/16'))
| group connections = count(), last_seen = max(event.time) by agent.uuid, endpoint.name, dst.ip.address, dst.port.number
| sort -connections
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, RemoteIP, RemotePort
| take 5

// HUNT: msbuild.exe making external connections
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1127.001, T1055.012, T1071.001
// CONF: medium | FP: medium
// FALSE POSITIVES: package restore and build agents reaching public registries
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: msbuild connecting to a non-private, non-loopback, non-link-local address, summarised per host, destination and port. The regex is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Add your known package-feed and build-service destinations, or scope the query to hosts outside the build-server group.
// LOOKBACK: 30d (Advanced Hunting retention; matches the CQL tab)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL tab's 500 row grouping cap has no equivalent; the output is capped at 200 rows.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFileName matches regex @"(?i)^msbuild(\.exe)?$"
| where isnotempty(RemoteIP) and not(ipv4_is_private(RemoteIP)) and not(ipv4_is_in_range(RemoteIP, "127.0.0.0/8")) and not(ipv4_is_in_range(RemoteIP, "169.254.0.0/16"))
| summarize Connections = count(), LastSeen = max(Timestamp) by DeviceId, DeviceName, RemoteIP, RemotePort
| sort by Connections desc
| take 200

// HUNT: Known Sirius file hashes
// MITRE: T1204.002, T1055
// CONF: high  FP: low  COST: low | REQUIRES: file hash on process or file write (CrowdStrike: ProcessRollup2, PeFileWritten, NewExecutableWritten, ZipFileWritten)
// FALSE POSITIVES: none expected
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|PeFileWritten|NewExecutableWritten|ZipFileWritten)$/
| in(field=SHA256HashData, values=["87aafaa8bb6444bae4d2ef82e395c46e85daf468a66754169b1e3d762ba04f51", "7ec38100faffb910ece1f379cb93ec09cc2beeb35ee8bdb401d7645469dca105", "6da827caff789c1c33dd9ad380c610541f6dd90678db527c4f5bdf5012e305d4", "899fc5fae0593dd47aef9db4b51ffb5aeae27be9d1b6beb41108411baca7ef05", "eedd60c6abfc4c18578c960ae55b177ea9ff14e8d41634c46f361cc8680df01c", "d6802fce5b918ed247ba85d6aa0545a8120cfbc3734b1c37794c4e381862d4ee"])
| table([@timestamp, ComputerName, UserName, #event_simpleName, FileName, TargetFileName, SHA256HashData, aid])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.image.sha256 = *
| limit 5
| columns event.type, event.time, tgt.process.image.sha256, tgt.file.sha256

// HUNT: Known Sirius file hashes
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.002, T1055
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: equivalent-with-schema-assumptions - Same indicators: the six Sirius SHA-256 values on a created process image or a created file. File Creation covers the executable and archive writes the CQL reads. The list is matched case-insensitively.
// REQUIRES: SentinelOne endpoint process and file telemetry with SHA-256 populated
// TUNING: None expected; these are file hashes of known malicious samples.
// LOOKBACK: 30d; set the console time picker to match the CQL tab
// CONFIGURATION: No data table or lookup required.
// KNOWN GAPS: A sample that is renamed or repacked has a different hash and is not captured.
// VALIDATION LEVEL: static-reviewed
(event.type = 'Process Creation' tgt.process.image.sha256 in:anycase ('87aafaa8bb6444bae4d2ef82e395c46e85daf468a66754169b1e3d762ba04f51', '7ec38100faffb910ece1f379cb93ec09cc2beeb35ee8bdb401d7645469dca105', '6da827caff789c1c33dd9ad380c610541f6dd90678db527c4f5bdf5012e305d4', '899fc5fae0593dd47aef9db4b51ffb5aeae27be9d1b6beb41108411baca7ef05', 'eedd60c6abfc4c18578c960ae55b177ea9ff14e8d41634c46f361cc8680df01c', 'd6802fce5b918ed247ba85d6aa0545a8120cfbc3734b1c37794c4e381862d4ee')) or (event.type = 'File Creation' tgt.file.sha256 in:anycase ('87aafaa8bb6444bae4d2ef82e395c46e85daf468a66754169b1e3d762ba04f51', '7ec38100faffb910ece1f379cb93ec09cc2beeb35ee8bdb401d7645469dca105', '6da827caff789c1c33dd9ad380c610541f6dd90678db527c4f5bdf5012e305d4', '899fc5fae0593dd47aef9db4b51ffb5aeae27be9d1b6beb41108411baca7ef05', 'eedd60c6abfc4c18578c960ae55b177ea9ff14e8d41634c46f361cc8680df01c', 'd6802fce5b918ed247ba85d6aa0545a8120cfbc3734b1c37794c4e381862d4ee'))
| columns event.time, event.type, endpoint.name, src.process.name, tgt.process.name, tgt.file.path, tgt.process.image.sha256, tgt.file.sha256, agent.uuid
| sort -event.time
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, SHA256
| take 5

// HUNT: Known Sirius file hashes
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.002, T1055
// CONF: high | FP: low
// FALSE POSITIVES: none expected
// EQUIVALENCE: approximate-analytic - The six Sirius SHA-256 values are matched on DeviceFileEvents, which sees the file writes. The CQL also matches a process start; one table per query means the process-start half is left to the CQL tab.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents) with SHA256 populated
// TUNING: None expected; these are file hashes of known malicious samples.
// LOOKBACK: 30d (Advanced Hunting retention; matches the CQL tab)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A sample that is started but whose write was not observed is not captured here; the CQL tab also matches process starts. The CQL has no SHA1 or MD5 values, so none are searched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where SHA256 in~ ("87aafaa8bb6444bae4d2ef82e395c46e85daf468a66754169b1e3d762ba04f51", "7ec38100faffb910ece1f379cb93ec09cc2beeb35ee8bdb401d7645469dca105", "6da827caff789c1c33dd9ad380c610541f6dd90678db527c4f5bdf5012e305d4", "899fc5fae0593dd47aef9db4b51ffb5aeae27be9d1b6beb41108411baca7ef05", "eedd60c6abfc4c18578c960ae55b177ea9ff14e8d41634c46f361cc8680df01c", "d6802fce5b918ed247ba85d6aa0545a8120cfbc3734b1c37794c4e381862d4ee")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, FileName, FolderPath, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Lure filename: Fedex_tax_receipt
// MITRE: T1566.001, T1204.002
// CONF: medium  FP: low  COST: low | REQUIRES: process command line and archive write (CrowdStrike: ProcessRollup2, ZipFileWritten)
// FALSE POSITIVES: a genuine file that reuses the name
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|ZipFileWritten)$/
| (CommandLine=/Fedex_tax_receipt\.(pdf|zip)/i) or (TargetFileName=/Fedex_tax_receipt\.(pdf|zip)$/i)
| table([@timestamp, ComputerName, UserName, #event_simpleName, ParentBaseFileName, FileName, CommandLine, TargetFileName, aid])
| sort(@timestamp, order=desc)

event.type = 'File Creation' tgt.file.path = *
| limit 5
| columns event.type, event.time, tgt.process.cmdline, tgt.file.path

// HUNT: Lure filename: Fedex_tax_receipt
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1566.001, T1204.002
// CONF: medium | FP: low
// FALSE POSITIVES: a genuine file that reuses the name
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the lure name Fedex_tax_receipt with a pdf or zip extension, on a process command line or in a created file path. The name is matched as a substring, case-insensitively, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne endpoint process-creation and file-creation telemetry
// TUNING: A genuine file that reuses the name is possible; confirm the sender and the origin before escalating.
// LOOKBACK: 30d; set the console time picker to match the CQL tab
// CONFIGURATION: No data table or lookup required.
// KNOWN GAPS: A lure renamed before it is opened is not captured.
// VALIDATION LEVEL: static-reviewed
(event.type = 'Process Creation' tgt.process.cmdline contains ('Fedex_tax_receipt.pdf', 'Fedex_tax_receipt.zip')) or (event.type = 'File Creation' tgt.file.path contains ('Fedex_tax_receipt.pdf', 'Fedex_tax_receipt.zip'))
| columns event.time, event.type, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.file.path, agent.uuid
| sort -event.time
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath
| take 5

// HUNT: Lure filename: Fedex_tax_receipt
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1566.001, T1204.002
// CONF: medium | FP: low
// FALSE POSITIVES: a genuine file that reuses the name
// EQUIVALENCE: approximate-analytic - The lure name is matched on the file name in DeviceFileEvents. The CQL also reads process command lines; one table per query means that half is left to the CQL tab.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: A genuine file that reuses the name is possible; confirm the sender and the origin before escalating.
// LOOKBACK: 30d (Advanced Hunting retention; matches the CQL tab)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A lure named only on a command line, without a file event, is not captured here; the CQL tab also searches command lines.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("Fedex_tax_receipt.pdf", "Fedex_tax_receipt.zip")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, FileName, FolderPath, SHA1, SHA256
| sort by Timestamp desc
| take 200