CL-UNK-1211: SysGoRAT, Web Shells and Reverse Shells on Government Linux Servers

// HUNT: Web server worker spawns a shell or download tool
// MITRE: T1505.003, T1059.004
// CONF: medium  FP: medium  COST: low | REQUIRES: Linux sensor, ProcessRollup2
// FALSE POSITIVES: apps that shell out by design, Plesk and cPanel helper jobs, PHP queue workers
// TUNING: after a 14-day baseline add !(CommandLine=*your-known-app-script*) exclusions per application
// LOOKBACK: 7d
#event_simpleName=ProcessRollup2 event_platform=Lin
| ParentBaseFileName=/^(php-fpm[0-9.]*|php[0-9.]*-fpm|lsphp[0-9]*|apache2|httpd|nginx)$/i
| FileName=/^(sh|bash|dash|zsh|ash|busybox|nc|ncat|python[0-9.]*|perl|wget|curl)$/i
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.os, tgt.process.cmdline, tgt.process.name, src.process.name

// HUNT: Web server worker spawns a shell or download tool
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1505.003, T1059.004
// CONF: medium | FP: medium
// FALSE POSITIVES: apps that shell out by design, Plesk and cPanel helper jobs, PHP queue workers
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a web server worker as the creator and a shell, netcat, interpreter or download tool as the created process. On a Process Creation event the creator is src.process and the created process is tgt.process, so the CQL parent maps to src.process.name and the CQL child to tgt.process.name.
// REQUIRES: SentinelOne Linux process-creation telemetry (Process Creation events)
// TUNING: After a 14-day baseline exclude known application scripts per application by adding a negated tgt.process.cmdline predicate.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the agent did not observe starting is not captured. The match is on the command line text only; an obfuscated or encoded command line is not decoded.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os = 'linux' src.process.name matches '^(php-fpm[0-9.]*|php[0-9.]*-fpm|lsphp[0-9]*|apache2|httpd|nginx)$' tgt.process.name matches '^(sh|bash|dash|zsh|ash|busybox|nc|ncat|python[0-9.]*|perl|wget|curl)$'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine, FileName, InitiatingProcessFileName
| take 5

// HUNT: Web server worker spawns a shell or download tool
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1505.003, T1059.004
// CONF: medium | FP: medium
// FALSE POSITIVES: apps that shell out by design, Plesk and cPanel helper jobs, PHP queue workers
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the initiating process is a web server worker and the created process is a shell, netcat, interpreter or download tool. The CQL parent is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint on Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: After a 14-day baseline exclude known application scripts per application with a negated ProcessCommandLine predicate.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: DeviceProcessEvents has no platform column, so the query is not limited to Linux hosts; scope it with a Linux device group. A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName matches regex @"(?i)^(php-fpm[0-9.]*|php[0-9.]*-fpm|lsphp[0-9]*|apache2|httpd|nginx)$"
| where FileName matches regex @"(?i)^(sh|bash|dash|zsh|ash|busybox|nc|ncat|python[0-9.]*|perl|wget|curl)$"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Reverse shell command patterns (named pipe, /dev/tcp, Python socket)
// MITRE: T1059.004, T1095
// CONF: high  FP: low  COST: low | REQUIRES: Linux sensor, ProcessRollup2
// FALSE POSITIVES: authorized penetration tests, security training labs
// LOOKBACK: 7d
#event_simpleName=ProcessRollup2 event_platform=Lin
| CommandLine=/(mkfifo\s+\/tmp\/f|\/tmp\/f\s*[|]\s*(\/bin\/)?(ba)?sh|\/dev\/tcp\/[0-9a-z.-]+\/[0-9]+|import\s+socket.{0,200}dup2.{0,200}bash)/i
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.os, tgt.process.cmdline

// HUNT: Reverse shell command patterns (named pipe, /dev/tcp, Python socket)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.004, T1095
// CONF: high | FP: low
// FALSE POSITIVES: authorized penetration tests, security training labs
// EQUIVALENCE: equivalent-with-schema-assumptions - Same four command-line patterns: mkfifo on /tmp/f, a pipe from /tmp/f into a shell, a /dev/tcp redirect, and a Python socket with dup2 into bash. The match is on the created process command line.
// REQUIRES: SentinelOne Linux process-creation telemetry (Process Creation events)
// TUNING: Authorized penetration tests and training labs trigger this; exclude the lab hosts by endpoint.name.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the agent did not observe starting is not captured. The match is on the command line text only; an obfuscated or encoded command line is not decoded.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os = 'linux' tgt.process.cmdline matches 'mkfifo\\s+/tmp/f|/tmp/f\\s*[|]\\s*(/bin/)?(ba)?sh|/dev/tcp/[0-9a-z.-]+/[0-9]+|import\\s+socket.{0,200}dup2.{0,200}bash'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: Reverse shell command patterns (named pipe, /dev/tcp, Python socket)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.004, T1095
// CONF: high | FP: low
// FALSE POSITIVES: authorized penetration tests, security training labs
// EQUIVALENCE: equivalent-with-schema-assumptions - Same four command-line patterns on the created process command line; the (?i) prefix reproduces the CQL /i flag.
// REQUIRES: Defender for Endpoint on Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude authorized penetration test and training hosts by DeviceName.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: DeviceProcessEvents has no platform column, so the query is not limited to Linux hosts; scope it with a Linux device group. A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine matches regex @"(?i)mkfifo\s+/tmp/f|/tmp/f\s*[|]\s*(/bin/)?(ba)?sh|/dev/tcp/[0-9a-z.-]+/[0-9]+|import\s+socket.{0,200}dup2.{0,200}bash"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Interactive bash spawned by a Python process
// MITRE: T1059.006, T1059.004
// CONF: medium  FP: medium  COST: low | REQUIRES: Linux sensor, ProcessRollup2
// FALSE POSITIVES: pexpect or pty-based automation, Ansible helper modules, developer tooling
// TUNING: exclude known automation accounts with !(UserName=svc-automation) and known parent command lines after baselining
// LOOKBACK: 7d
#event_simpleName=ProcessRollup2 event_platform=Lin
| ParentBaseFileName=/^python[0-9.]*$/i
| FileName=/^(bash|sh|dash|zsh)$/i
| CommandLine=/\s-i(\s|$)/
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.os, tgt.process.cmdline, tgt.process.name, src.process.name

// HUNT: Interactive bash spawned by a Python process
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.006, T1059.004
// CONF: medium | FP: medium
// FALSE POSITIVES: pexpect or pty-based automation, Ansible helper modules, developer tooling
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a Python creator, a shell as the created process, and an interactive -i flag in the created command line. The -i test is case-sensitive, as in the CQL, so matches:matchcase is used for it.
// REQUIRES: SentinelOne Linux process-creation telemetry (Process Creation events)
// TUNING: Exclude known automation accounts and automation parents after baselining.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the agent did not observe starting is not captured. The match is on the command line text only; an obfuscated or encoded command line is not decoded.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os = 'linux' src.process.name matches '^python[0-9.]*$' tgt.process.name in:anycase ('bash', 'sh', 'dash', 'zsh') tgt.process.cmdline matches:matchcase '\\s-i(\\s|$)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine, FileName, InitiatingProcessFileName
| take 5

// HUNT: Interactive bash spawned by a Python process
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.006, T1059.004
// CONF: medium | FP: medium
// FALSE POSITIVES: pexpect or pty-based automation, Ansible helper modules, developer tooling
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a Python initiating process, a shell as the created process, and a case-sensitive -i flag in the created command line.
// REQUIRES: Defender for Endpoint on Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude known automation accounts and automation parents after baselining.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: DeviceProcessEvents has no platform column, so the query is not limited to Linux hosts; scope it with a Linux device group. A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName matches regex @"(?i)^python[0-9.]*$"
| where FileName in~ ("bash", "sh", "dash", "zsh")
| where ProcessCommandLine matches regex @"\s-i(\s|$)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Disguised SysGoRAT, hidden root helpers and GSocket staging
// MITRE: T1036.005, T1090, T1548.001
// CONF: high  FP: low  COST: low | REQUIRES: Linux sensor, ProcessRollup2
// FALSE POSITIVES: an admin who legitimately runs gs-netcat; a product that ships a binary called ea_install
// LOOKBACK: 7d
#event_simpleName=ProcessRollup2 event_platform=Lin
| (FileName=/^(sys-control-client|ea_install|\.libpython-helper|\.libsystemd-helper|\.tourch|gs-netcat|gs-dbus)$/i or ImageFileName=/\/dev\/shm\/\.gs-[0-9]+\//)
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData])

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, event.type, endpoint.os, tgt.process.name, tgt.process.image.path

// HUNT: Disguised SysGoRAT, hidden root helpers and GSocket staging
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1036.005, T1090, T1548.001
// CONF: high | FP: low
// FALSE POSITIVES: an admin who legitimately runs gs-netcat; a product that ships a binary called ea_install
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the created process is one of the listed disguised names, or runs from a hidden GSocket directory under /dev/shm. The name test is on tgt.process.name and the path test on tgt.process.image.path.
// REQUIRES: SentinelOne Linux process-creation telemetry (Process Creation events)
// TUNING: An admin who legitimately runs gs-netcat, or a product that ships a binary called ea_install, needs an exclusion by image path.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the agent did not observe starting is not captured. The match is on the command line text only; an obfuscated or encoded command line is not decoded.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os = 'linux' (tgt.process.name matches '^(sys-control-client|ea_install|\\.libpython-helper|\\.libsystemd-helper|\\.tourch|gs-netcat|gs-dbus)$' or tgt.process.image.path matches '/dev/shm/\\.gs-[0-9]+/')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha256
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath
| take 5

// HUNT: Disguised SysGoRAT, hidden root helpers and GSocket staging
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1036.005, T1090, T1548.001
// CONF: high | FP: low
// FALSE POSITIVES: an admin who legitimately runs gs-netcat; a product that ships a binary called ea_install
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the created file name is one of the listed disguised names, or the image path is a hidden GSocket directory under /dev/shm.
// REQUIRES: Defender for Endpoint on Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: An admin who legitimately runs gs-netcat, or a product that ships a binary called ea_install, needs an exclusion by FolderPath.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: DeviceProcessEvents has no platform column, so the query is not limited to Linux hosts; scope it with a Linux device group. A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName matches regex @"(?i)^(sys-control-client|ea_install|\.libpython-helper|\.libsystemd-helper|\.tourch|gs-netcat|gs-dbus)$" or FolderPath matches regex @"/dev/shm/\.gs-[0-9]+/"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Execution from /dev/shm or under a hidden helper name
// MITRE: T1620, T1036.005
// CONF: medium  FP: medium  COST: low | REQUIRES: Linux sensor, ProcessRollup2
// FALSE POSITIVES: installers or runtimes that stage and execute binaries in /dev/shm
// TUNING: exclude known staging processes with !(ParentBaseFileName=your-installer) after a 14-day baseline
// LOOKBACK: 7d
#event_simpleName=ProcessRollup2 event_platform=Lin
| ImageFileName=/(\/dev\/shm\/|\/\.(libpython-helper|libsystemd-helper|tourch)$|\/sys-control-client$)/i
| table([@timestamp, ComputerName, aid, UserName, ImageFileName, CommandLine, SHA256HashData, ParentBaseFileName])

event.type = 'Process Creation' tgt.process.image.path = *
| limit 5
| columns event.time, event.type, endpoint.os, tgt.process.image.path

// HUNT: Execution from /dev/shm or under a hidden helper name
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1620, T1036.005
// CONF: medium | FP: medium
// FALSE POSITIVES: installers or runtimes that stage and execute binaries in /dev/shm
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the created process image path is under /dev/shm or ends in one of the hidden helper names or sys-control-client.
// REQUIRES: SentinelOne Linux process-creation telemetry (Process Creation events)
// TUNING: Exclude known staging parents after a 14-day baseline with a negated src.process.name predicate.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the agent did not observe starting is not captured. The match is on the command line text only; an obfuscated or encoded command line is not decoded. The CQL title says written; the CQL itself, and so this query, tests process execution only.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os = 'linux' tgt.process.image.path matches '(/dev/shm/|/\\.(libpython-helper|libsystemd-helper|tourch)$|/sys-control-client$)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha256
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FolderPath
| take 5

// HUNT: Execution from /dev/shm or under a hidden helper name
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1620, T1036.005
// CONF: medium | FP: medium
// FALSE POSITIVES: installers or runtimes that stage and execute binaries in /dev/shm
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on the created process image path (FolderPath): under /dev/shm or ending in one of the hidden helper names or sys-control-client.
// REQUIRES: Defender for Endpoint on Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude known staging parents after a 14-day baseline with a negated InitiatingProcessFileName predicate.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: DeviceProcessEvents has no platform column, so the query is not limited to Linux hosts; scope it with a Linux device group. A process the sensor did not observe starting is not captured. The CQL title says written; the CQL itself, and so this query, tests process execution only.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FolderPath matches regex @"(?i)(/dev/shm/|/\.(libpython-helper|libsystemd-helper|tourch)$|/sys-control-client$)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FolderPath, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Local privilege escalation: setuid(0) wrapper, LinPEAS, PwnKit, SUID on hidden file
// MITRE: T1068, T1548.001
// CONF: high  FP: low  COST: low | REQUIRES: Linux sensor, ProcessRollup2
// FALSE POSITIVES: authorized penetration tests running LinPEAS
// LOOKBACK: 7d
#event_simpleName=ProcessRollup2 event_platform=Lin
| CommandLine=/(os\.setuid\(0\)|os\.setgid\(0\)|linpeas|pwnkit|CVE-2021-4034|chmod\s+(u\+s|[0-7]?4[0-7]{3})\s+\S*\.(tourch|libsystemd-helper|libpython-helper))/i
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.os, tgt.process.cmdline

// HUNT: Local privilege escalation: setuid(0) wrapper, LinPEAS, PwnKit, SUID on hidden file
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1068, T1548.001
// CONF: high | FP: low
// FALSE POSITIVES: authorized penetration tests running LinPEAS
// EQUIVALENCE: equivalent-with-schema-assumptions - Same five literal markers plus the chmod setuid pattern on the hidden helper names. The literals use contains, which is case-insensitive like the CQL /i flag.
// REQUIRES: SentinelOne Linux process-creation telemetry (Process Creation events)
// TUNING: Authorized penetration tests running LinPEAS need an exclusion by endpoint.name.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the agent did not observe starting is not captured. The match is on the command line text only; an obfuscated or encoded command line is not decoded.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os = 'linux' (tgt.process.cmdline contains ('os.setuid(0)', 'os.setgid(0)', 'linpeas', 'pwnkit', 'CVE-2021-4034') or tgt.process.cmdline matches 'chmod\\s+(u\\+s|[0-7]?4[0-7]{3})\\s+\\S*\\.(tourch|libsystemd-helper|libpython-helper)')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: Local privilege escalation: setuid(0) wrapper, LinPEAS, PwnKit, SUID on hidden file
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1068, T1548.001
// CONF: high | FP: low
// FALSE POSITIVES: authorized penetration tests running LinPEAS
// EQUIVALENCE: equivalent-with-schema-assumptions - Same five literal markers plus the chmod setuid pattern on the hidden helper names; contains is case-insensitive like the CQL /i flag.
// REQUIRES: Defender for Endpoint on Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: Authorized penetration tests running LinPEAS need an exclusion by DeviceName.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: DeviceProcessEvents has no platform column, so the query is not limited to Linux hosts; scope it with a Linux device group. A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine contains "os.setuid(0)" or ProcessCommandLine contains "os.setgid(0)" or ProcessCommandLine contains "linpeas" or ProcessCommandLine contains "pwnkit" or ProcessCommandLine contains "CVE-2021-4034" or ProcessCommandLine matches regex @"(?i)chmod\s+(u\+s|[0-7]?4[0-7]{3})\s+\S*\.(tourch|libsystemd-helper|libpython-helper)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: sudo alias hijack, password log file and planted red-team markers
// MITRE: T1056.001, T1546.004, T1036
// CONF: high  FP: low  COST: low | REQUIRES: Linux sensor, ProcessRollup2
// FALSE POSITIVES: users who alias sudo for convenience (for example alias sudo='sudo -E')
// LOOKBACK: 7d
#event_simpleName=ProcessRollup2 event_platform=Lin
| CommandLine=/(alias\s+sudo\s*=|Solarwinds\.StatusLog|RedTeamOps2025|pentest123|\.bashrc.{0,200}alias\s+sudo|alias\s+sudo.{0,200}\.bashrc)/i
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.os, tgt.process.cmdline

// HUNT: sudo alias hijack, password log file and planted red-team markers
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1056.001, T1546.004, T1036
// CONF: high | FP: low
// FALSE POSITIVES: users who alias sudo for convenience (for example alias sudo='sudo -E')
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the three planted marker strings, plus an alias of sudo defined directly or alongside a .bashrc edit. Literals use contains, which is case-insensitive like the CQL /i flag.
// REQUIRES: SentinelOne Linux process-creation telemetry (Process Creation events)
// TUNING: Users who alias sudo for convenience need an exclusion by src.process.user.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the agent did not observe starting is not captured. The match is on the command line text only; an obfuscated or encoded command line is not decoded.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os = 'linux' (tgt.process.cmdline contains ('Solarwinds.StatusLog', 'RedTeamOps2025', 'pentest123') or tgt.process.cmdline matches 'alias\\s+sudo\\s*=|\\.bashrc.{0,200}alias\\s+sudo|alias\\s+sudo.{0,200}\\.bashrc')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: sudo alias hijack, password log file and planted red-team markers
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1056.001, T1546.004, T1036
// CONF: high | FP: low
// FALSE POSITIVES: users who alias sudo for convenience (for example alias sudo='sudo -E')
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the three planted marker strings, plus an alias of sudo defined directly or alongside a .bashrc edit.
// REQUIRES: Defender for Endpoint on Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: Users who alias sudo for convenience need an exclusion by AccountName.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: DeviceProcessEvents has no platform column, so the query is not limited to Linux hosts; scope it with a Linux device group. A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine contains "Solarwinds.StatusLog" or ProcessCommandLine contains "RedTeamOps2025" or ProcessCommandLine contains "pentest123" or ProcessCommandLine matches regex @"(?i)alias\s+sudo\s*=|\.bashrc.{0,200}alias\s+sudo|alias\s+sudo.{0,200}\.bashrc"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Shell history and log clearing
// MITRE: T1070.002, T1070.003
// CONF: medium  FP: medium  COST: low | REQUIRES: Linux sensor, ProcessRollup2
// FALSE POSITIVES: logrotate and cleanup jobs, golden-image build scripts, admins running history -c
// TUNING: exclude the parent of your log rotation jobs with !(ParentBaseFileName=logrotate) and known maintenance accounts
// LOOKBACK: 7d
#event_simpleName=ProcessRollup2 event_platform=Lin
| CommandLine=/(history\s+-c|unset\s+HISTFILE|HISTFILE=\/dev\/null|HISTSIZE=0|(rm|shred|truncate|unlink)\s.{0,120}(\.bash_history|\.zsh_history|\/var\/log\/(auth\.log|secure|btmp|wtmp|lastlog|maillog|mail\.log|apache2|httpd|nginx)|\/var\/lib\/php\/sessions)|>\s*\/var\/log\/(auth\.log|secure|wtmp|btmp|lastlog))/i
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.os, tgt.process.cmdline

// HUNT: Shell history and log clearing
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1070.002, T1070.003
// CONF: medium | FP: medium
// FALSE POSITIVES: logrotate and cleanup jobs, golden-image build scripts, admins running history -c
// EQUIVALENCE: equivalent-with-schema-assumptions - Same patterns: history clearing, HISTFILE or HISTSIZE disabling, removal of history files, logs and PHP sessions, and a redirect that truncates an auth log.
// REQUIRES: SentinelOne Linux process-creation telemetry (Process Creation events)
// TUNING: Exclude log rotation parents and known maintenance accounts after baselining.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the agent did not observe starting is not captured. The match is on the command line text only; an obfuscated or encoded command line is not decoded.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os = 'linux' tgt.process.cmdline matches 'history\\s+-c|unset\\s+HISTFILE|HISTFILE=/dev/null|HISTSIZE=0|(rm|shred|truncate|unlink)\\s.{0,120}(\\.bash_history|\\.zsh_history|/var/log/(auth\\.log|secure|btmp|wtmp|lastlog|maillog|mail\\.log|apache2|httpd|nginx)|/var/lib/php/sessions)|>\\s*/var/log/(auth\\.log|secure|wtmp|btmp|lastlog)'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: Shell history and log clearing
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1070.002, T1070.003
// CONF: medium | FP: medium
// FALSE POSITIVES: logrotate and cleanup jobs, golden-image build scripts, admins running history -c
// EQUIVALENCE: equivalent-with-schema-assumptions - Same patterns: history clearing, HISTFILE or HISTSIZE disabling, removal of history files, logs and PHP sessions, and a redirect that truncates an auth log.
// REQUIRES: Defender for Endpoint on Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude log rotation parents and known maintenance accounts after baselining.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: DeviceProcessEvents has no platform column, so the query is not limited to Linux hosts; scope it with a Linux device group. A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine matches regex @"(?i)history\s+-c|unset\s+HISTFILE|HISTFILE=/dev/null|HISTSIZE=0|(rm|shred|truncate|unlink)\s.{0,120}(\.bash_history|\.zsh_history|/var/log/(auth\.log|secure|btmp|wtmp|lastlog|maillog|mail\.log|apache2|httpd|nginx)|/var/lib/php/sessions)|>\s*/var/log/(auth\.log|secure|wtmp|btmp|lastlog)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Attempts to kill or stop endpoint security agents
// MITRE: T1562.001
// CONF: medium  FP: medium  COST: low | REQUIRES: Linux sensor, ProcessRollup2
// FALSE POSITIVES: agent upgrade or uninstall jobs, admins restarting services, config management runs
// TUNING: exclude your patching and config-management parents (for example !(ParentBaseFileName=ansible-playbook)) and review pgrep-only hits separately
// LOOKBACK: 7d
#event_simpleName=ProcessRollup2 event_platform=Lin
| CommandLine=/(\b(pkill|killall|pgrep|kill)\b.{0,120}(cortex|cyserver|cytool|falcon-sensor|falcond|sentinelagent|sentinelone|mdatp|wdavdaemon|wazuh|ossec|osqueryd|auditd|clamd|elastic-agent)|systemctl\s+(stop|disable|mask)\s+\S*(cortex|cyserver|falcon-sensor|sentinel|mdatp|wazuh|ossec|osqueryd|auditd|clamd|elastic-agent))/i
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.os, tgt.process.cmdline

// HUNT: Attempts to kill or stop endpoint security agents
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1562.001
// CONF: medium | FP: medium
// FALSE POSITIVES: agent upgrade or uninstall jobs, admins restarting services, config management runs
// EQUIVALENCE: equivalent-with-schema-assumptions - Same patterns: a kill-family tool aimed at a security agent name, or systemctl stop, disable or mask on a security service.
// REQUIRES: SentinelOne Linux process-creation telemetry (Process Creation events)
// TUNING: Exclude patching and configuration-management parents with a negated src.process.name predicate, and review pgrep-only hits separately.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the agent did not observe starting is not captured. The match is on the command line text only; an obfuscated or encoded command line is not decoded.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os = 'linux' tgt.process.cmdline matches '(\\b(pkill|killall|pgrep|kill)\\b.{0,120}(cortex|cyserver|cytool|falcon-sensor|falcond|sentinelagent|sentinelone|mdatp|wdavdaemon|wazuh|ossec|osqueryd|auditd|clamd|elastic-agent)|systemctl\\s+(stop|disable|mask)\\s+\\S*(cortex|cyserver|falcon-sensor|sentinel|mdatp|wazuh|ossec|osqueryd|auditd|clamd|elastic-agent))'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: Attempts to kill or stop endpoint security agents
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1562.001
// CONF: medium | FP: medium
// FALSE POSITIVES: agent upgrade or uninstall jobs, admins restarting services, config management runs
// EQUIVALENCE: equivalent-with-schema-assumptions - Same patterns: a kill-family tool aimed at a security agent name, or systemctl stop, disable or mask on a security service.
// REQUIRES: Defender for Endpoint on Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude patching and configuration-management parents with a negated InitiatingProcessFileName predicate, and review pgrep-only hits separately.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: DeviceProcessEvents has no platform column, so the query is not limited to Linux hosts; scope it with a Linux device group. A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine matches regex @"(?i)(\b(pkill|killall|pgrep|kill)\b.{0,120}(cortex|cyserver|cytool|falcon-sensor|falcond|sentinelagent|sentinelone|mdatp|wdavdaemon|wazuh|ossec|osqueryd|auditd|clamd|elastic-agent)|systemctl\s+(stop|disable|mask)\s+\S*(cortex|cyserver|falcon-sensor|sentinel|mdatp|wazuh|ossec|osqueryd|auditd|clamd|elastic-agent))"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: PHP auto_prepend_file tampering and the plesk_sys_driver.php web shell
// MITRE: T1505.003, T1546
// CONF: high  FP: medium  COST: low | REQUIRES: Linux sensor, ProcessRollup2
// FALSE POSITIVES: WAF or profiler products that use auto_prepend_file, admin audit greps, Ansible template runs
// TUNING: exclude approved prepend files with !(CommandLine=*your-approved-prepend.php*) and your config-management parent
// LOOKBACK: 7d
#event_simpleName=ProcessRollup2 event_platform=Lin
| CommandLine=/(auto_prepend_file|plesk_sys_driver\.php)/i
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.os, tgt.process.cmdline

// HUNT: PHP auto_prepend_file tampering and the plesk_sys_driver.php web shell
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1505.003, T1546
// CONF: high | FP: medium
// FALSE POSITIVES: WAF or profiler products that use auto_prepend_file, admin audit greps, Ansible template runs
// EQUIVALENCE: equivalent-with-schema-assumptions - Same two literals in the created command line; contains is case-insensitive like the CQL /i flag.
// REQUIRES: SentinelOne Linux process-creation telemetry (Process Creation events)
// TUNING: Exclude approved prepend files and the configuration-management parent with a negated tgt.process.cmdline predicate.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the agent did not observe starting is not captured. The match is on the command line text only; an obfuscated or encoded command line is not decoded.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os = 'linux' tgt.process.cmdline contains ('auto_prepend_file', 'plesk_sys_driver.php')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: PHP auto_prepend_file tampering and the plesk_sys_driver.php web shell
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1505.003, T1546
// CONF: high | FP: medium
// FALSE POSITIVES: WAF or profiler products that use auto_prepend_file, admin audit greps, Ansible template runs
// EQUIVALENCE: equivalent-with-schema-assumptions - Same two literals in the created command line; contains is case-insensitive like the CQL /i flag.
// REQUIRES: Defender for Endpoint on Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude approved prepend files and the configuration-management parent with a negated ProcessCommandLine predicate.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: DeviceProcessEvents has no platform column, so the query is not limited to Linux hosts; scope it with a Linux device group. A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine contains "auto_prepend_file" or ProcessCommandLine contains "plesk_sys_driver.php"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Mailbox enumeration, search and archive staging
// MITRE: T1114.001, T1074.001
// CONF: medium  FP: medium  COST: low | REQUIRES: Linux sensor, ProcessRollup2
// FALSE POSITIVES: mail backup agents, mailbox migrations, quota reporting scripts
// TUNING: exclude your backup service account and parent process with !(UserName=svc-mailbackup)
// LOOKBACK: 7d
#event_simpleName=ProcessRollup2 event_platform=Lin
| CommandLine=/(search_social\.php|zip_mails\.sh|\b(find|ls|wc|grep|zip|tar|cat)\b.{0,200}(\/var\/qmail\/mailnames|Maildir\/cur))/i
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.os, tgt.process.cmdline

// HUNT: Mailbox enumeration, search and archive staging
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1114.001, T1074.001
// CONF: medium | FP: medium
// FALSE POSITIVES: mail backup agents, mailbox migrations, quota reporting scripts
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the two helper script names, or a listing, search or archive tool aimed at the Plesk mail store or a Maildir folder.
// REQUIRES: SentinelOne Linux process-creation telemetry (Process Creation events)
// TUNING: Exclude the backup service account and its parent with a negated src.process.user predicate.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the agent did not observe starting is not captured. The match is on the command line text only; an obfuscated or encoded command line is not decoded.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os = 'linux' (tgt.process.cmdline contains ('search_social.php', 'zip_mails.sh') or tgt.process.cmdline matches '\\b(find|ls|wc|grep|zip|tar|cat)\\b.{0,200}(/var/qmail/mailnames|Maildir/cur)')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: Mailbox enumeration, search and archive staging
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1114.001, T1074.001
// CONF: medium | FP: medium
// FALSE POSITIVES: mail backup agents, mailbox migrations, quota reporting scripts
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: the two helper script names, or a listing, search or archive tool aimed at the Plesk mail store or a Maildir folder.
// REQUIRES: Defender for Endpoint on Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude the backup service account and its parent with a negated AccountName predicate.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: DeviceProcessEvents has no platform column, so the query is not limited to Linux hosts; scope it with a Linux device group. A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine contains "search_social.php" or ProcessCommandLine contains "zip_mails.sh" or ProcessCommandLine matches regex @"(?i)\b(find|ls|wc|grep|zip|tar|cat)\b.{0,200}(/var/qmail/mailnames|Maildir/cur)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Database dump staging and exfiltration to file-hosting services or netcat
// MITRE: T1567.002, T1048, T1074.001
// CONF: medium  FP: medium  COST: low | REQUIRES: Linux sensor, ProcessRollup2
// FALSE POSITIVES: staff who share files through public hosting services, support bundles sent with curl
// TUNING: allow-list approved upload destinations or users with !(UserName=jdoe) after a 14-day baseline
// LOOKBACK: 7d
#event_simpleName=ProcessRollup2 event_platform=Lin
| CommandLine=/((curl|wget)\b.{0,300}(transfer\.sh|bashupload\.com|filebin\.net|catbox\.moe)|\bnc\b.{0,60}<\s*\S*_dump\.tar\.gz|tar\s+-czf\s+\/tmp\/\S+_dump\.tar\.gz|dump\.sqlite)/i
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.os, tgt.process.cmdline

// HUNT: Database dump staging and exfiltration to file-hosting services or netcat
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1567.002, T1048, T1074.001
// CONF: medium | FP: medium
// FALSE POSITIVES: staff who share files through public hosting services, support bundles sent with curl
// EQUIVALENCE: equivalent-with-schema-assumptions - Same four patterns: curl or wget aimed at a file-hosting domain, netcat fed from a dump archive, tar writing a dump archive under /tmp, and a dump.sqlite reference.
// REQUIRES: SentinelOne Linux process-creation telemetry (Process Creation events)
// TUNING: Allow-list approved upload destinations or users with a negated predicate after a 14-day baseline.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the agent did not observe starting is not captured. The match is on the command line text only; an obfuscated or encoded command line is not decoded.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os = 'linux' tgt.process.cmdline matches '(curl|wget)\\b.{0,300}(transfer\\.sh|bashupload\\.com|filebin\\.net|catbox\\.moe)|\\bnc\\b.{0,60}<\\s*\\S*_dump\\.tar\\.gz|tar\\s+-czf\\s+/tmp/\\S+_dump\\.tar\\.gz|dump\\.sqlite'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: Database dump staging and exfiltration to file-hosting services or netcat
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1567.002, T1048, T1074.001
// CONF: medium | FP: medium
// FALSE POSITIVES: staff who share files through public hosting services, support bundles sent with curl
// EQUIVALENCE: equivalent-with-schema-assumptions - Same four patterns: curl or wget aimed at a file-hosting domain, netcat fed from a dump archive, tar writing a dump archive under /tmp, and a dump.sqlite reference.
// REQUIRES: Defender for Endpoint on Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: Allow-list approved upload destinations or accounts with a negated predicate after a 14-day baseline.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: DeviceProcessEvents has no platform column, so the query is not limited to Linux hosts; scope it with a Linux device group. A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine matches regex @"(?i)(curl|wget)\b.{0,300}(transfer\.sh|bashupload\.com|filebin\.net|catbox\.moe)|\bnc\b.{0,60}<\s*\S*_dump\.tar\.gz|tar\s+-czf\s+/tmp/\S+_dump\.tar\.gz|dump\.sqlite"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: SysGoRAT persistence artifacts (systemd unit, binary name, Windows updater path)
// MITRE: T1543.002, T1053.003, T1547.001
// CONF: high  FP: low  COST: low | REQUIRES: Linux or Windows sensor, ProcessRollup2
// FALSE POSITIVES: none expected beyond analysts running these names in a lab
// LOOKBACK: 7d
#event_simpleName=ProcessRollup2
| CommandLine=/(sys-update\.service|sys-control-client|Onedrive Update\\Updater\.exe)/i
| table([@timestamp, ComputerName, aid, event_platform, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.cmdline

// HUNT: SysGoRAT persistence artifacts (systemd unit, binary name, Windows updater path)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1543.002, T1053.003, T1547.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected beyond analysts running these names in a lab
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on both Linux and Windows agents: the systemd unit name, the binary name, or the Windows updater path in the created command line. The path separator is matched by a single non-alphanumeric character so the test works for either slash style and needs no backslash escaping.
// REQUIRES: SentinelOne process-creation telemetry on Linux and Windows agents (Process Creation events)
// TUNING: No tuning expected beyond analysts running these names in a lab; exclude those hosts by endpoint.name.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the agent did not observe starting is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.cmdline matches 'sys-update\\.service|sys-control-client|Onedrive Update[^a-z0-9]Updater\\.exe'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: SysGoRAT persistence artifacts (systemd unit, binary name, Windows updater path)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1543.002, T1053.003, T1547.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected beyond analysts running these names in a lab
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on Linux and Windows sensors: the systemd unit name, the binary name, or the Windows updater path in the created command line.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: No tuning expected beyond analysts running these names in a lab; exclude those hosts by DeviceName.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine matches regex @"(?i)(sys-update\.service|sys-control-client|Onedrive Update\\Updater\.exe)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Known campaign hashes executing
// MITRE: T1204, T1105
// CONF: high  FP: low  COST: low | REQUIRES: Linux or Windows sensor, ProcessRollup2
// FALSE POSITIVES: none expected for an exact hash match
// LOOKBACK: 30d
#event_simpleName=ProcessRollup2
| in(SHA256HashData, values=["2bf7992e6260c1a98c709fa98ec766fb9f27692f338b30b43ac821b824fd849e", "27d799ceadb570bfca890d4c2572314afe57eecf14083d30409da15afdfc4704", "d73186cea6cf2cf3d48c09139a9d15521365aab675787b4e7a6f81767331c9fd", "9e45830171eb607cf2c0fc80f5cc9cc3db39bb937032136990383a595f6f151e", "c527b94e3d21824a674face4cd9d862e536b60ccbf54573839e3360f99188343", "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa", "44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879", "1505a3a727f8899b2ad343519f7bf9c438b8b802f8d6b854f5db3b52f857c76a", "76c58fad4f70cf277a15a499b9a2151ac60e7a6b5c7a9ab684843dcc19f0d0a5", "b1e82c6b0caea177e8bb71ad826867f509c65f0a43a651b50253e7c726566eac"])
| table([@timestamp, ComputerName, aid, event_platform, UserName, FileName, ImageFileName, SHA256HashData])

event.type = 'Process Creation' tgt.process.image.sha256 = *
| limit 5
| columns event.time, event.type, tgt.process.image.sha256

// HUNT: Known campaign hashes executing
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204, T1105
// CONF: high | FP: low
// FALSE POSITIVES: none expected for an exact hash match
// EQUIVALENCE: equivalent-with-schema-assumptions - Same ten SHA-256 values matched against the created process image hash on Linux and Windows agents.
// REQUIRES: SentinelOne process-creation telemetry with image SHA-256 populated
// TUNING: No tuning expected for an exact hash match.
// LOOKBACK: 30d on the CQL tab; set the console time range to 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the agent did not observe starting is not captured. The CQL tests process execution only; a hash on a file that is written but never run is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.image.sha256 in:anycase ('2bf7992e6260c1a98c709fa98ec766fb9f27692f338b30b43ac821b824fd849e', '27d799ceadb570bfca890d4c2572314afe57eecf14083d30409da15afdfc4704', 'd73186cea6cf2cf3d48c09139a9d15521365aab675787b4e7a6f81767331c9fd', '9e45830171eb607cf2c0fc80f5cc9cc3db39bb937032136990383a595f6f151e', 'c527b94e3d21824a674face4cd9d862e536b60ccbf54573839e3360f99188343', 'd94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa', '44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879', '1505a3a727f8899b2ad343519f7bf9c438b8b802f8d6b854f5db3b52f857c76a', '76c58fad4f70cf277a15a499b9a2151ac60e7a6b5c7a9ab684843dcc19f0d0a5', 'b1e82c6b0caea177e8bb71ad826867f509c65f0a43a651b50253e7c726566eac')
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.path, tgt.process.image.sha256
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| where isnotempty(SHA256)
| project Timestamp, SHA256
| take 5

// HUNT: Known campaign hashes executing
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204, T1105
// CONF: high | FP: low
// FALSE POSITIVES: none expected for an exact hash match
// EQUIVALENCE: equivalent-with-schema-assumptions - Same ten SHA-256 values matched against the created process hash. The CQL carries SHA-256 only, so there is no SHA1 pivot to fall back on.
// REQUIRES: Defender for Endpoint process-creation telemetry with SHA256 populated
// TUNING: No tuning expected for an exact hash match.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 30d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Microsoft marks SHA256 as usually not populated in this table, so an empty result is not proof of absence. Advanced Hunting keeps 30 days of data, the same window as the CQL. The CQL tests process execution only; a hash on a file that is written but never run is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where SHA256 in~ ("2bf7992e6260c1a98c709fa98ec766fb9f27692f338b30b43ac821b824fd849e", "27d799ceadb570bfca890d4c2572314afe57eecf14083d30409da15afdfc4704", "d73186cea6cf2cf3d48c09139a9d15521365aab675787b4e7a6f81767331c9fd", "9e45830171eb607cf2c0fc80f5cc9cc3db39bb937032136990383a595f6f151e", "c527b94e3d21824a674face4cd9d862e536b60ccbf54573839e3360f99188343", "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa", "44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879", "1505a3a727f8899b2ad343519f7bf9c438b8b802f8d6b854f5db3b52f857c76a", "76c58fad4f70cf277a15a499b9a2151ac60e7a6b5c7a9ab684843dcc19f0d0a5", "b1e82c6b0caea177e8bb71ad826867f509c65f0a43a651b50253e7c726566eac")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, SHA256
| sort by Timestamp desc
| take 200

// HUNT: Outbound connections to the listed campaign IPs
// MITRE: T1071.001, T1095, T1571
// CONF: medium  FP: low  COST: low | REQUIRES: Linux or Windows sensor, NetworkConnectIP4
// FALSE POSITIVES: reuse of the same IP by an unrelated hosting tenant after the campaign ended
// LOOKBACK: 30d
#event_simpleName=NetworkConnectIP4
| in(RemoteAddressIP4, values=["45.88.188.140", "198.23.185.234", "138.68.244.146", "185.21.136.6", "72.61.89.179", "104.194.158.65", "109.224.53.140", "162.243.175.162", "154.93.37.228", "141.164.58.87", "88.80.150.232", "88.119.167.57", "173.212.247.23", "104.248.131.53", "147.182.224.216", "93.93.112.57", "192.210.183.17"])
| table([@timestamp, ComputerName, aid, event_platform, ContextProcessId, RemoteAddressIP4, RemotePort])

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.time, event.type, dst.ip.address

// HUNT: Outbound connections to the listed campaign IPs
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1095, T1571
// CONF: medium | FP: low
// FALSE POSITIVES: reuse of the same IP by an unrelated hosting tenant after the campaign ended
// EQUIVALENCE: equivalent-with-schema-assumptions - Same seventeen remote addresses matched against the destination address of a connection event on Linux and Windows agents. The CQL matches the remote address without a direction test, and so does this query.
// REQUIRES: SentinelOne network telemetry (IP Connect events)
// TUNING: Unrelated tenants may reuse these addresses after the campaign; confirm the process before escalating.
// LOOKBACK: 30d on the CQL tab; set the console time range to 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connections the agent did not record are not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' dst.ip.address in ('45.88.188.140', '198.23.185.234', '138.68.244.146', '185.21.136.6', '72.61.89.179', '104.194.158.65', '109.224.53.140', '162.243.175.162', '154.93.37.228', '141.164.58.87', '88.80.150.232', '88.119.167.57', '173.212.247.23', '104.248.131.53', '147.182.224.216', '93.93.112.57', '192.210.183.17')
| columns event.time, endpoint.name, src.process.name, src.ip.address, dst.ip.address, dst.port.number
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, RemoteIP
| take 5

// HUNT: Outbound connections to the listed campaign IPs
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1095, T1571
// CONF: medium | FP: low
// FALSE POSITIVES: reuse of the same IP by an unrelated hosting tenant after the campaign ended
// EQUIVALENCE: equivalent-with-schema-assumptions - Same seventeen remote addresses matched against RemoteIP. The CQL matches the remote address without a direction test, and so does this query.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Unrelated tenants may reuse these addresses after the campaign; confirm the process before escalating.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 30d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Connections the sensor did not record are not captured. Advanced Hunting keeps 30 days of data, the same window as the CQL.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemoteIP in ("45.88.188.140", "198.23.185.234", "138.68.244.146", "185.21.136.6", "72.61.89.179", "104.194.158.65", "109.224.53.140", "162.243.175.162", "154.93.37.228", "141.164.58.87", "88.80.150.232", "88.119.167.57", "173.212.247.23", "104.248.131.53", "147.182.224.216", "93.93.112.57", "192.210.183.17")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort
| sort by Timestamp desc
| take 200

// HUNT: DNS lookups for the four campaign domains
// MITRE: T1071.004, T1583.001
// CONF: high  FP: low  COST: low | REQUIRES: Linux or Windows sensor, DnsRequest (validate Linux emission in tenant)
// FALSE POSITIVES: researchers or sinkholes resolving the domains
// LOOKBACK: 30d
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(magento\.ink|solidmonpe\.com|wibu-bau-bawang\.online|beraskencur\.site)$/i
| table([@timestamp, ComputerName, aid, event_platform, ContextProcessId, DomainName])

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, event.type, event.dns.request

// HUNT: DNS lookups for the four campaign domains
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.004, T1583.001
// CONF: high | FP: low
// FALSE POSITIVES: researchers or sinkholes resolving the domains
// EQUIVALENCE: equivalent-with-schema-assumptions - Same four domains matched as an exact name or as a parent of the queried name. DNS Resolved events carry the requesting process under src.process.
// REQUIRES: SentinelOne DNS telemetry (DNS Resolved events) on Linux and Windows agents
// TUNING: Researchers or sinkholes resolving the domains are the only expected benign hits.
// LOOKBACK: 30d on the CQL tab; set the console time range to 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The DNS Resolved event on Linux agents has to be confirmed on the tenant; if it is not emitted this query returns nothing. The field is event.dns.request; some schema versions name it dns.request, so the readiness test prints both.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' (event.dns.request in:anycase ('magento.ink', 'solidmonpe.com', 'wibu-bau-bawang.online', 'beraskencur.site') or event.dns.request matches '[.](magento[.]ink|solidmonpe[.]com|wibu-bau-bawang[.]online|beraskencur[.]site)$')
| columns event.time, endpoint.name, src.process.name, event.dns.request
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: DNS lookups for the four campaign domains
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.004, T1583.001
// CONF: high | FP: low
// FALSE POSITIVES: researchers or sinkholes resolving the domains
// EQUIVALENCE: equivalent-with-schema-assumptions - Same four domains matched as an exact name or as a parent of the queried name. There is no endpoint DNS table, so the name is read from AdditionalFields on DnsQueryResponse events.
// REQUIRES: Defender for Endpoint DNS telemetry (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: Researchers or sinkholes resolving the domains are the only expected benign hits.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 30d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: DnsQueryResponse coverage on Linux sensors has to be confirmed on the tenant. Advanced Hunting keeps 30 days of data, the same window as the CQL.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| extend DnsName = tolower(tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"])))
| where DnsName in~ ("magento.ink", "solidmonpe.com", "wibu-bau-bawang.online", "beraskencur.site") or DnsName endswith ".magento.ink" or DnsName endswith ".solidmonpe.com" or DnsName endswith ".wibu-bau-bawang.online" or DnsName endswith ".beraskencur.site"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessFileName, DnsName
| sort by Timestamp desc
| take 200

// HUNT: GSocket relay and file-hosting DNS lookups (hunt only)
// MITRE: T1090, T1567.002
// CONF: low  FP: medium  COST: low | REQUIRES: Linux or Windows sensor, DnsRequest (validate Linux emission in tenant)
// FALSE POSITIVES: staff using public file-hosting services, developers testing GSocket
// TUNING: scope to server host groups only with a ComputerName or host group filter, where outbound web browsing should not occur
// LOOKBACK: 14d
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(gsocket\.io|transfer\.sh|bashupload\.com|filebin\.net|catbox\.moe)$/i
| groupBy([ComputerName, DomainName], function=count(as=lookups))
| sort(lookups, order=desc, limit=200)

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, event.type, event.dns.request, endpoint.name

// HUNT: GSocket relay and file-hosting DNS lookups (hunt only)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1090, T1567.002
// CONF: low | FP: medium
// FALSE POSITIVES: staff using public file-hosting services, developers testing GSocket
// EQUIVALENCE: equivalent-with-schema-assumptions - Same five domains matched as an exact name or as a parent of the queried name, counted per host and name and sorted by count, as in the CQL.
// REQUIRES: SentinelOne DNS telemetry (DNS Resolved events) on Linux and Windows agents
// TUNING: Scope to server host groups where outbound web browsing should not occur, by adding an endpoint.name predicate.
// LOOKBACK: 14d on the CQL tab; set the console time range to 14d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The DNS Resolved event on Linux agents has to be confirmed on the tenant; if it is not emitted this query returns nothing. The field is event.dns.request; some schema versions name it dns.request, so the readiness test prints both.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' (event.dns.request in:anycase ('gsocket.io', 'transfer.sh', 'bashupload.com', 'filebin.net', 'catbox.moe') or event.dns.request matches '[.](gsocket[.]io|transfer[.]sh|bashupload[.]com|filebin[.]net|catbox[.]moe)$')
| group lookups=count() by endpoint.name, event.dns.request
| sort -lookups
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields, DeviceName
| take 5

// HUNT: GSocket relay and file-hosting DNS lookups (hunt only)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1090, T1567.002
// CONF: low | FP: medium
// FALSE POSITIVES: staff using public file-hosting services, developers testing GSocket
// EQUIVALENCE: equivalent-with-schema-assumptions - Same five domains matched as an exact name or as a parent of the queried name, counted per host and name and sorted by count, as in the CQL.
// REQUIRES: Defender for Endpoint DNS telemetry (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: Scope to server device groups where outbound web browsing should not occur, by adding a DeviceName predicate.
// LOOKBACK: 14d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: DnsQueryResponse coverage on Linux sensors has to be confirmed on the tenant.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(14d)
| where ActionType == "DnsQueryResponse"
| extend DnsName = tolower(tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"])))
| where DnsName in~ ("gsocket.io", "transfer.sh", "bashupload.com", "filebin.net", "catbox.moe") or DnsName endswith ".gsocket.io" or DnsName endswith ".transfer.sh" or DnsName endswith ".bashupload.com" or DnsName endswith ".filebin.net" or DnsName endswith ".catbox.moe"
| summarize lookups = count() by DeviceName, DnsName
| sort by lookups desc
| take 200

// HUNT: sshpass lateral movement, SOCKS proxy tools and authorized_keys injection
// MITRE: T1021.004, T1098.004, T1090
// CONF: medium  FP: medium  COST: low | REQUIRES: Linux sensor, ProcessRollup2
// FALSE POSITIVES: legacy automation that uses sshpass, admins appending keys manually
// TUNING: exclude known jump hosts and automation accounts with !(UserName=svc-automation) after baselining
// LOOKBACK: 7d
#event_simpleName=ProcessRollup2 event_platform=Lin
| CommandLine=/(sshpass\s+-p\s.{0,200}StrictHostKeyChecking=no|\b(revsocks|pysoxy)\b|GSOCKET_ARGS=|echo\s.{0,600}>>\s*\S*\.ssh\/authorized_keys)/i
| table([@timestamp, ComputerName, aid, UserName, ParentBaseFileName, FileName, CommandLine])

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, endpoint.os, tgt.process.cmdline

// HUNT: sshpass lateral movement, SOCKS proxy tools and authorized_keys injection
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1021.004, T1098.004, T1090
// CONF: medium | FP: medium
// FALSE POSITIVES: legacy automation that uses sshpass, admins appending keys manually
// EQUIVALENCE: equivalent-with-schema-assumptions - Same four patterns: sshpass with host-key checking off, the revsocks and pysoxy proxy tools, the GSOCKET_ARGS variable, and an echo appended to authorized_keys.
// REQUIRES: SentinelOne Linux process-creation telemetry (Process Creation events)
// TUNING: Exclude known jump hosts and automation accounts with a negated src.process.user predicate after baselining.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A process the agent did not observe starting is not captured. The match is on the command line text only; an obfuscated or encoded command line is not decoded.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' endpoint.os = 'linux' tgt.process.cmdline matches 'sshpass\\s+-p\\s.{0,200}StrictHostKeyChecking=no|\\b(revsocks|pysoxy)\\b|GSOCKET_ARGS=|echo\\s.{0,600}>>\\s*\\S*\\.ssh/authorized_keys'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, ProcessCommandLine
| take 5

// HUNT: sshpass lateral movement, SOCKS proxy tools and authorized_keys injection
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1021.004, T1098.004, T1090
// CONF: medium | FP: medium
// FALSE POSITIVES: legacy automation that uses sshpass, admins appending keys manually
// EQUIVALENCE: equivalent-with-schema-assumptions - Same four patterns: sshpass with host-key checking off, the revsocks and pysoxy proxy tools, the GSOCKET_ARGS variable, and an echo appended to authorized_keys.
// REQUIRES: Defender for Endpoint on Linux process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude known jump hosts and automation accounts with a negated AccountName predicate after baselining.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: DeviceProcessEvents has no platform column, so the query is not limited to Linux hosts; scope it with a Linux device group. A process the sensor did not observe starting is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessCommandLine matches regex @"(?i)sshpass\s+-p\s.{0,200}StrictHostKeyChecking=no|\b(revsocks|pysoxy)\b|GSOCKET_ARGS=|echo\s.{0,600}>>\s*\S*\.ssh/authorized_keys"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200