Star Blizzard · RedFlick Delivery Technique / CosmicPulse Backdoor

Looks for: conhost.exe spawning a hidden cmd.exe that runs a .bat script (Jan 2026 variant). FP: some RMM/packaging tools follow this same parent/child shape; narrow with a confirmed RMM inventory before excluding.

// HUNT H1: Star Blizzard RedFlick - VHDX/LNK Chain - Hidden BAT Execution via conhost.exe -> cmd.exe
// HYPOTHESIS: If the January 2026 RedFlick VHDX variant is active, conhost.exe (spawned by the
// malicious LNK) launches a hidden cmd.exe that executes a .bat script referencing a decoy PDF
// and a follow-on SSH download.
// MITRE: T1059.003 (Windows Command Shell), T1564 (Hide Artifacts), T1204.002 (User Execution)
// CONF: Medium - behavioral pattern (parent/child + .bat reference), no atomic IOC
// FP: Medium - conhost.exe legitimately spawns cmd.exe constantly; narrowing to a .bat reference
// reduces but does not eliminate legitimate hits from install scripts and some RMM tooling.
// COST: Low - indexed event type + ParentBaseFileName exact match before regex
// GAP NOTE: no Falcon event for VHDX mount/attach is confirmed in the sourced intel; this query
// covers only the conhost->cmd->bat stage.
// LOOKBACK: 7d

#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName = /^conhost\.exe$/i
| FileName = /^cmd\.exe$/i
| CommandLine = /\.bat/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

// TUNING: exclude known-good RMM/packaging tools confirmed in your environment to spawn cmd.exe
// via conhost.exe with a .bat reference; verify against your RMM inventory before excluding, no
// blind FileName-level exclusion is safe to ship.

Looks for: ssh.exe invoked with PermitLocalCommand=yes and a LocalCommand referencing cmd.exe. FP: very few legitimate Windows workflows use this option combination.

// HUNT H2: Star Blizzard RedFlick - SSH Client Abuse for MSI Download (PermitLocalCommand)
// HYPOTHESIS: If the January 2026 RedFlick chain is active, ssh.exe is invoked with
// PermitLocalCommand=yes and a LocalCommand referencing cmd.exe, used to trigger a local
// download of the CosmicPulse MSI installer via the SSH client rather than an SSH session.
// MITRE: T1105 (Ingress Tool Transfer), T1059.003 (Windows Command Shell)
// CONF: High - this exact SSH client option combination on Windows is rarely legitimate
// FP: Low - very few legitimate Windows workflows invoke OpenSSH client with PermitLocalCommand
// COST: Low - indexed event type + FileName exact match before CommandLine regex
// LOOKBACK: 7d

#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^ssh\.exe$/i
| CommandLine = /PermitLocalCommand=yes/i
| CommandLine = /LocalCommand=.*cmd\.exe/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

// TUNING: none required at Low FP. If internal DevOps/sysadmin tooling legitimately uses
// PermitLocalCommand for automation, add an explicit UserName or ComputerName allowlist
// exclusion rather than broadening the CommandLine match.

Looks for: schtasks.exe registering one of the three exact RedFlick task names, used across all three 2026 variants. This is the flagship detection for this pack; see the alert package in Section 16.

// HUNT H3: Star Blizzard RedFlick - Scheduled Task Persistence (Exact Task Names)
// HYPOTHESIS: If RedFlick's persistence mechanism fired, an MSI custom action or the Task
// Scheduler registers one of three exact task names used across all three 2026 delivery
// variants: "Internet Quality Test Connection", "Network Configuration Manager",
// "System Health Monitor".
// MITRE: T1053.005 (Scheduled Task)
// CONF: High - the three task names are highly specific and corroborated across all 4 sources
// FP: Low - these exact task names are not standard Windows or common third-party task names
// COST: Low - FileName exact match before CommandLine regex
// COVERAGE NOTE: detects task registration via schtasks.exe (used by MSI custom actions and
// installers). If your tenant's sensor policy also surfaces a native scheduled-task-registered
// telemetry event with a TaskName field, mirror this filter against it too - confirm the event
// is available in your tenant before relying on it; it is not assumed here.
// LOOKBACK: 7d

#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^schtasks\.exe$/i
| CommandLine = /\/create/i
| CommandLine = /(Internet Quality Test Connection|Network Configuration Manager|System Health Monitor)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

// TUNING: none required - task names are distinctive enough that no baseline exclusion is
// expected. If a false positive appears, verify against your organization's own IT asset
// naming conventions before excluding.

Looks for: control.exe invoking Control_RunDLL against a CPL staged in a user-writable directory. FP: legitimate CPL registration from AppData/Temp/ProgramData is uncommon but not impossible; baseline 7-14 days before promoting.

// HUNT H4: Star Blizzard RedFlick - CosmicPulse CPL Execution via control.exe
// HYPOTHESIS: If CosmicPulse deployment completed, control.exe is invoked with a Control_RunDLL
// call against a CPL (Control Panel applet) DLL staged in a user-writable directory
// (AppData/Temp/ProgramData) rather than a standard system CPL location.
// MITRE: T1218 (System Binary Proxy Execution - Control Panel)
// CONF: Medium - control.exe abuse is a known LOLBin technique; the user-writable-path
// constraint is the distinguishing signal for this campaign
// FP: Medium - legitimate software occasionally registers CPL applets, though rarely from
// AppData/Temp/ProgramData
// COST: Low - FileName exact match before CommandLine regex
// LOOKBACK: 7d

#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^control\.exe$/i
| CommandLine = /Control_RunDLL/i
| CommandLine = /(AppData|\\Temp\\|ProgramData)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

// TUNING: exclude known-good software update/installer tools only if confirmed in your
// environment to legitimately register CPL applets from user-writable paths; verify with a
// 7-14 day Detect-only baseline before promoting.

Looks for: a command line referencing a WebDAV UNC path of the form \\host@SSL\... FP: legitimate enterprise WebDAV-backed file shares (e.g. SharePoint Online) can trigger this; add a domain exclusion once confirmed.

// HUNT H5: Star Blizzard RedFlick - WebDAV-based C2 (April 2026 Three-Task Variant)
// HYPOTHESIS: If the April 2026 three-scheduled-task variant is active, a task action (typically
// via rundll32.exe, cmd.exe or msiexec.exe) accesses a WebDAV UNC path of the form \\host@SSL\...
// to reach the actor's HTTP(S)-based C2 over the WebDAV redirector, avoiding a literal http(s)://
// URL in the command line.
// MITRE: T1071.001 (Web Protocols), T1105 (Ingress Tool Transfer)
// CONF: Medium - the "@SSL" WebDAV UNC marker is a specific and unusual command-line pattern
// FP: Medium - WebDAV UNC access is occasionally legitimate (e.g. SharePoint Online mapped over
// WebDAV) so a positive hit still needs host/destination triage
// COST: Low - event type + CommandLine regex on an anchored literal token
// LOOKBACK: 7d

#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| CommandLine = /\\\\[A-Za-z0-9.\-]+@SSL\\/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

// TUNING: if your organization uses legitimate WebDAV-backed enterprise file shares (e.g. a
// tenant SharePoint Online domain mapped over WebDAV), add an explicit domain exclusion once
// confirmed, rather than dropping the @SSL match entirely.

Looks for: a PowerShell process with the literal "cAB," marker in its command line, the July variant's steganography extraction step.

// HUNT H6: Star Blizzard RedFlick - PDF Steganography Extraction (July 2026 Variant)
// HYPOTHESIS: If the July 2026 RedFlick variant is active, a PowerShell process reads a
// downloaded decoy PDF and searches it for the magic marker "cAB," to locate and extract a
// 208-byte Base64-encoded payload, which is then decoded and executed to retrieve an MSI.
// MITRE: T1059.001 (PowerShell), T1027 (Obfuscated Files or Information)
// CONF: Medium - the literal "cAB," marker in a PowerShell command line is a distinctive
// artifact specific to this campaign's steganography scheme
// FP: Low - "cAB," as a literal string inside PowerShell CommandLine is not expected in
// legitimate administration scripts
// COST: Low - event type + FileName exact match before CommandLine regex
// COVERAGE NOTE: matches the marker in process CommandLine telemetry. If your tenant separately
// ingests PowerShell Script Block Logging as its own event type, mirror this filter there too
// for deeper coverage of in-memory-only invocations.
// LOOKBACK: 7d

#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^powershell(\.exe)?$/i
| CommandLine = /cAB,/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

// TUNING: none required - "cAB," is a low-collision literal string. If paired with heavy
// internal PDF-processing automation that coincidentally uses this byte sequence, narrow with
// a ParentBaseFileName constraint matching the documented conhost.exe/curl.exe parent chain.

Looks for: a registry write to HKCU\Software\Classes\.mollis, the AES-ECB key-staging step used by every CosmicPulse deployment regardless of delivery variant.

// HUNT H7a: Star Blizzard RedFlick - CosmicPulse AES Key Registry Write
// HYPOTHESIS: If CosmicPulse's downloader stage executed, an AES-ECB decryption key is written
// to HKCU\Software\Classes\.mollis ahead of the Python bootstrapper decrypting the payload.
// MITRE: T1027 (Obfuscated Files or Information)
// CONF: High - ".mollis" as a registered Classes subkey name is a highly specific,
// non-standard artifact
// FP: Low - HKCU\Software\Classes\.mollis is not a standard Windows or common third-party key
// COST: Low - event type + RegObjectName regex
// LOOKBACK: 7d

#event_simpleName = /AsepValueUpdate|RegGenericValueUpdate/
| RegObjectName = /Software\\Classes\\\.mollis/i
| table([@timestamp, aid, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue])
| sort(@timestamp, order=desc)

// TUNING: none required - ".mollis" is not a real Windows extension/ProgID; any hit warrants
// investigation.

Looks for: python.exe (Python 3.8 64-bit bootstrapper) executing from AppData/Temp/ProgramData. FP: some legitimate per-user tooling ships an embedded Python interpreter under AppData; correlate with H7a firing on the same host to sharply raise confidence.

// HUNT H7b: Star Blizzard RedFlick - CosmicPulse Python Bootstrap from User-Writable Path
// HYPOTHESIS: Following the H7a registry write, python.exe (the Python 3.8 64-bit bootstrapper)
// executes from a user-writable path to decrypt and run the CosmicPulse (YESROBOT) payload.
// MITRE: T1059 (Command and Scripting Interpreter - Python)
// CONF: Medium alone; High when correlated with H7a firing on the same aid in the same window
// FP: Medium - some legitimate internal tooling ships an embedded Python interpreter under
// AppData (update agents, certain per-user data-science tooling)
// COST: Low - FileName exact match before CommandLine regex
// LOOKBACK: 7d

#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^python(3|38)?(\.exe)?$/i
| CommandLine = /(AppData|\\Temp\\|ProgramData)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

// TUNING: baseline against your known-good Python deployment paths before promoting to a
// higher-severity alert tier. Correlating with H7a firing on the same aid within the lookback
// window sharply raises confidence and is the recommended promotion criterion.

Looks for: DNS resolution of any of the 16 known RedFlick/CosmicPulse C2 domains. Only secure-dns-hub.com is dual-sourced; the other 15 are single-sourced to Microsoft.

// HUNT H8a: Star Blizzard RedFlick - CosmicPulse C2 DNS Beaconing
// HYPOTHESIS: If a compromised endpoint is beaconing to RedFlick/CosmicPulse infrastructure,
// DNS telemetry will show resolution of one of the 16 known C2 domains.
// MITRE: T1071.001 (Web Protocols)
// CONF: High for secure-dns-hub.com (dual-sourced: Microsoft + independent June 2026 Digital
// Security Lab Ukraine report per The Hacker News); Medium for the other 15 domains
// (single-sourced to Microsoft only)
// FP: Low - these are actor-registered domains, not shared/CDN infrastructure
// COST: Low - DNS event type filtered first, then in() lookup on a short static list
// PROVENANCE: all 16 domains verbatim from Microsoft source snapshot 01; secure-dns-hub.com
// additionally corroborated per source snapshot 03 (The Hacker News).
// LOOKBACK: 7d

#event_simpleName = DnsRequest
| in(field=DomainName, values=["etia.ca","groy.cc","gliderrompercycl.com","muvb.net","divekickspolic.org","matjk.click","bpdaersa.click","stuseamandesilt.org","itechx.tel","guach.net","ruten.observer","byveo.org","secure-dns-hub.com","qumel.link","cyrna.top","drasw.club"])
| table([@timestamp, aid, ComputerName, UserName, DomainName, ContextBaseFileName])
| sort(@timestamp, order=desc)

// TUNING: none required - these are actor-registered domains, not shared/CDN infrastructure.
// secure-dns-hub.com carries higher confidence (dual-sourced, confirmed active 2026-09-29); the
// remaining 15 domains are single-sourced to Microsoft only.

Looks for: outbound connections to any of the 6 known RedFlick/CosmicPulse C2 IPs, joined to the originating process for triage. Only 103.160.59.97 is dual-sourced; the other 5 are single-sourced to Microsoft and inherently volatile.

// HUNT H8b: Star Blizzard RedFlick - CosmicPulse C2 Network-Connect Beaconing
// HYPOTHESIS: If a compromised endpoint is beaconing to RedFlick/CosmicPulse infrastructure,
// network-connect telemetry will show traffic to one of the 6 known C2 IPs.
// MITRE: T1071.001 (Web Protocols)
// CONF: High for 103.160.59.97 (dual-sourced); Medium for the other 5 IPs (single-sourced)
// FP: Low - actor-controlled infrastructure, not shared hosting known to this analyst
// COST: Low - network event type + in() lookup, then a join for process context
// LOOKBACK: 7d

#event_simpleName = NetworkConnectIP4
| in(field=RemoteAddressIP4, values=["103.245.231.248","2.57.241.246","89.125.209.168","103.245.231.79","45.84.59.66","103.160.59.97"])
| rename(field=ContextProcessId_decimal, as=TargetProcessId_decimal)
| join(query={#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/}, field=TargetProcessId_decimal)
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, RemoteAddressIP4, RemotePort])
| sort(@timestamp, order=desc)

// TUNING: 103.160.59.97 is dual-sourced (higher confidence); the other 5 IPs are single-sourced
// to Microsoft only, and IPs are inherently volatile - re-validate this list against current
// threat intel before each re-hunt cycle (IP expiry: 30 days per IOC governance).

Looks for: an exact SHA256 match against the five published RedFlick delivery artifacts.

// HUNT H9: Star Blizzard RedFlick - Known CosmicPulse/RedFlick Payload Hashes
// HYPOTHESIS: If any of the five published RedFlick/CosmicPulse delivery artifacts are present
// in the environment, SHA256HashData will match one of the known hashes.
// MITRE: T1204.002 (User Execution: Malicious File), T1027 (Obfuscated/Encrypted File)
// CONF: High - exact SHA256 match against artifacts published by Microsoft's primary research
// FP: Very Low - SHA256 collision with legitimate software is effectively impossible
// COST: Low - in() lookup on an indexed hash field
// PROVENANCE: all five hashes are single-sourced to Microsoft only - ship as detect/hunt, not
// prevent/critical, per the two-source rule.
// LOOKBACK: 7d

#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| in(field=SHA256HashData, values=["9707a8694e954e9ee13e839d6e5905ce626c0837c7c90da6d1025bfbe152866b","1f2096ff906915fbf80778f0636446206197351f7e271af97936eeb6f32c179d","699e92a9e0edf7835879d5697bc67138c0b137117f459caf1a44df357407cad9","24b6e36a09eb2acfc2a95478ca685acb7593b1689be6a4a639fe0d222393cfa7","dd98dbc1a55afe6fd0ed2ed53a79c76f6bde15081a0060422185b74eb1799ee4"])
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, SHA256HashData])
| sort(@timestamp, order=desc)

// TUNING: none required - exact hash match, no exclusions needed.