The Gentlemen — Ransomware Hunt & Hardening Pack

Looks for: built-in AD enumeration (privileged groups, DCs, trusts) post-compromise. FP: sysadmin scripts, helpdesk, AD health checks from PAW/JIT — allow-list known admin AIDs.

// HUNT: The Gentlemen — AD discovery (T1087.002/T1069.002/T1482/T1018)
// CONF: medium  FP: medium  COST: low | TIMEFRAME: last 7d
// FP NOTES: net.exe by admins from PAW/JIT; nltest in AD health scripts; documented dsquery modules
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| in(field=FileName, values=["net.exe","net1.exe","nltest.exe","dsquery.exe","whoami.exe","adfind.exe"], ignoreCase=true)
| CommandLine = /(group\s+"?Domain Admins"?|group\s+"?Enterprise Admins"?|\/domain\b|\/dclist|\/domain_trusts|\/groups|\/all|enterprise admins|domain admins)/i
| groupBy([aid, ComputerName, UserName], function=[count(), collect([ImageFileName, CommandLine], limit=20)])
| sort(_count, order=desc)

Looks for: SharpHound/Invoke-BloodHound AD-path mapping — tool-specific strings are high-fidelity. FP: authorized red-team — allow-list operator AIDs.

// HUNT: The Gentlemen — SharpHound/BloodHound (T1482, S0521)
// CONF: high  FP: low  COST: low | TIMEFRAME: last 14d
// FP NOTES: authorized internal red-team / pentest (allow-list operator AIDs)
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| (ImageFileName = /\\sharphound(\.exe|\.ps1)?$/i
   or CommandLine = /(Invoke-BloodHound|SharpHound\s|-CollectionMethod\s+(All|Default|DCOnly|LoggedOn|Session|ACL|Trusts)|-ZipFileName|-OutputDirectory\s+.*bloodhound)/i)
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName], limit=200)
| sort(@timestamp, order=desc)

Looks for: canonical SharpHound JSON/ZIP output names — diagnostic even when the binary is renamed. FP: authorized red-team only.

// HUNT: The Gentlemen — BloodHound output artifacts (T1213, T1482)
// CONF: high  FP: very low  COST: low | TIMEFRAME: last 14d
// FP NOTES: authorized red-team only
#event_simpleName = /NewExecutableWritten|PeFileWritten|NewScriptWritten/
| TargetFileName = /(_computers\.json|_groups\.json|_users\.json|_domains\.json|_gpos\.json|_ous\.json|_sessions\.json|_containers\.json|BloodHound\.zip|\d{14}_BloodHound\.zip)$/i
| table([@timestamp, aid, ComputerName, UserName, TargetFileName, ContextBaseFileName], limit=200)
| sort(@timestamp, order=desc)

Looks for: commodity RMM agents used as persistence redundant to G-BOT/SystemBC/Velociraptor C2. FP: legitimate IT/MSP tooling — edit the allow-list for your sanctioned RMM and vendor support AIDs.

// HUNT: The Gentlemen — Unauthorized RMM (T1219)
// CONF: medium  FP: high  COST: low | TIMEFRAME: last 30d
// FP NOTES: allow-list sanctioned RMM (NinjaOne, Kaseya, ConnectWise) + vendor support
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| in(field=FileName, values=[
    "AnyDesk.exe","ScreenConnect.ClientService.exe","ScreenConnect.WindowsClient.exe",
    "AteraAgent.exe","Splashtop-streamer.exe","SRService.exe","TeamViewer.exe",
    "TeamViewer_Service.exe","rustdesk.exe","Action1_agent.exe","PulsewayMonitor.exe",
    "FleetDeskAgent.exe","SyncroService.exe","ZA_Connect.exe","ITarian_Service.exe",
    "AeroAdmin.exe","ammyy.exe","Supremo.exe","LogMeIn.exe","GoToAssist.exe",
    "rport.exe","MeshAgent.exe","ngrok.exe","TacticalRMM.exe","RemotePCService.exe",
    "DWAgent.exe","DWRCS.exe","Quasar.exe","Optitune.exe"
  ], ignoreCase=true)
| groupBy([aid, ComputerName, FileName, UserName], function=[count(), selectFromMin(field=@timestamp, include=[CommandLine, ParentBaseFileName, ImageFileName])])
| sort(_count, order=desc)

Looks for: a Type-10 logon from a VPN-pool IP followed within 60 min by AD enumeration on the same aid — the earliest Gentlemen chain. Correlation cuts FPs 10–50× vs. either signal alone. FP: legitimate remote admin — allow-list jump hosts.

// HUNT: The Gentlemen — VPN-pool logon then AD recon (T1078 + T1087.002)
// CONF: high  FP: medium  COST: medium | TIMEFRAME: last 7d
// FP NOTES: legit remote admin; REPLACE the CIDRs with your VPN client pool(s); allow-list jump hosts
#event_simpleName = UserLogon
| LogonType = 10
| cidr(RemoteAddressIP4, subnet=["10.200.0.0/16","172.16.50.0/24"])
| logonTime := @timestamp
| logonHost := ComputerName
| logonUser := UserName
| logonSrc  := RemoteAddressIP4
| join(query={
    #event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
    | in(field=FileName, values=["net.exe","net1.exe","nltest.exe","whoami.exe","dsquery.exe","adfind.exe"], ignoreCase=true)
    | CommandLine = /(Domain Admins|Enterprise Admins|\/dclist|\/domain_trusts|\/groups|\/all)/i
    | reconTime := @timestamp
    | reconCmd  := CommandLine
    | reconFile := FileName
  }, field=[aid], include=[reconTime, reconCmd, reconFile])
| test((reconTime - logonTime) <= 3600000)
| test((reconTime - logonTime) >= 0)
| table([logonTime, logonHost, logonUser, logonSrc, reconFile, reconCmd, reconTime], limit=200)
| sort(logonTime, order=desc)

Looks for: pre-encryption recovery destruction — VSS/backup/catalog deletion, recovery disable, and the encryptor's own --wipe flag. FP: some backup tools call vssadmin — allow-list backup-server AIDs.

// HUNT: The Gentlemen — Inhibit System Recovery (T1490)
// CONF: high  FP: low  COST: low | TIMEFRAME: last 30d
// FP NOTES: some backup tools call vssadmin (allow-list backup-server AIDs)
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| (CommandLine = /vssadmin(\.exe)?\s+delete\s+shadows/i
   or CommandLine = /wmic\s+shadowcopy\s+delete/i
   or CommandLine = /wbadmin\s+delete\s+(catalog|systemstatebackup|backup)/i
   or CommandLine = /bcdedit.*\/set.*(recoveryenabled\s+no|bootstatuspolicy\s+ignoreallfailures)/i
   or CommandLine = /Diskshadow.*delete\s+shadows/i
   or CommandLine = /\s--wipe\b/i)
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName], limit=200)
| sort(@timestamp, order=desc)

Looks for: Defender disable / broad exclusions, AV/EDR service stop, and host weakening — SMB1 re-enable, LSA anonymous loosening, firewall off — that precedes spread/encryption. FP: authorized AV change windows, SCCM/Intune scripts — allow-list management hosts.

// HUNT: The Gentlemen — Disable tools + weaken host (T1562.001/.004/.010)
// CONF: medium-high  FP: medium  COST: low | TIMEFRAME: last 14d
// FP NOTES: authorized AV change windows; SCCM/Intune compliance scripts (allow-list mgmt AIDs)
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| (CommandLine = /Set-MpPreference\s+-DisableRealtimeMonitoring\s+\$?(true|1)/i
   or CommandLine = /Add-MpPreference\s+-ExclusionPath/i
   or CommandLine = /Set-MpPreference\s+-(DisableIOAVProtection|DisableScriptScanning|DisableBehaviorMonitoring|MAPSReporting\s+0)/i
   or CommandLine = /sc(\.exe)?\s+(stop|delete|config).*(WinDefend|Sense|MsSecFlt|wuauserv|BITS|CSFalconService|SentinelAgent|elastic-agent|XAgentSvc)/i
   or CommandLine = /taskkill.*\/IM\s+(MsMpEng|CSFalconService|SentinelAgent|Cyserver|elastic-agent|XAgent)\.exe/i
   or CommandLine = /reg\s+(add|delete).*DisableAntiSpyware/i
   or CommandLine = /netsh\s+advfirewall\s+set\s+(allprofiles|currentprofile)\s+state\s+off/i
   or CommandLine = /(Enable-WindowsOptionalFeature.*SMB1|sc(\.exe)?\s+config\s+(mrxsmb10|lanmanserver).*SMB1|reg\s+add.*LanmanServer\\Parameters.*SMB1.*\/d\s+1)/i
   or CommandLine = /reg\s+add.*\\Lsa\b.*(RestrictAnonymous|everyoneincludesanonymous|LimitBlankPasswordUse)/i)
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName], limit=200)
| sort(@timestamp, order=desc)

Looks for: the encryptor's published artifacts — .i8p14s extension, README-GENTLEMEN.txt, gentlemen.bmp. Campaign-specific, so high confidence (no longer a tripwire). FP: mass-write thresholds may match backup/archive tools — allow-list those AIDs.

// HUNT: The Gentlemen — Encryption artifacts (.i8p14s + note) (T1486)
// CONF: high  FP: low  COST: low | TIMEFRAME: rolling 24h
// FP NOTES: note/wallpaper names are campaign-specific; backup tools bulk-write other extensions
#event_simpleName = /NewExecutableWritten|PeFileWritten|NewScriptWritten/
| (TargetFileName = /\.i8p14s$/i
   or TargetFileName = /\\README-GENTLEMEN\.txt$/i
   or TargetFileName = /\\gentlemen\.bmp$/i)
| groupBy([aid, ComputerName, ContextBaseFileName], function=[count(), selectFromMin(field=@timestamp, include=[TargetFileName, UserName])])
| sort(_count, order=desc)

Looks for: the Go encryptor authenticating with harvested creds and copying itself to remote ADMIN$/C$ over SMB, then executing remotely — plus the explicit --spread worm flag. FP: software-deployment tooling (PsExec/SCCM) copies to admin shares — allow-list deploy-server AIDs.

// HUNT: The Gentlemen — Self-propagation over SMB (T1021.002 / T1570)
// CONF: medium-high  FP: medium  COST: medium | TIMEFRAME: last 7d
// FP NOTES: SCCM / PDQ Deploy / PsExec admin tooling (allow-list deploy AIDs)
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| (CommandLine = /(copy|xcopy|robocopy|cmd\s+\/c\s+copy).*\\\\[^\\]+\\(admin\$|c\$|ipc\$)/i
   or CommandLine = /net\s+use\s+\\\\[^\\]+\\(admin\$|c\$|ipc\$)/i
   or CommandLine = /(psexec|paexec|psexesvc).*\\\\[^\\]+/i
   or CommandLine = /wmic\s+\/node:.*process\s+call\s+create/i
   or CommandLine = /\\\\[^\\]+\\(admin\$|c\$)\\.*\.exe/i
   or CommandLine = /\s--spread\b/i)
| groupBy([aid, ComputerName, UserName], function=[count(), collect([CommandLine, ImageFileName, ParentBaseFileName], limit=25)])
| sort(_count, order=desc)

Looks for: the custom kill tool (All.exe) + vulnerable driver (ThrottleBlood.sys) and the group's named evasion utilities (EDRStartupHinder, gfreeze, glinker), plus a .sys service launched from a user-writable path. FP: very low — legit drivers install to System32\drivers via signed installers.

// HUNT: The Gentlemen — BYOVD EDR-kill (T1562.001 / T1068 / T1543.003)
// CONF: high  FP: low  COST: low | TIMEFRAME: last 30d
// FP NOTES: a .sys service from TEMP/ProgramData/user path is almost always malicious
// Branch A — named tooling / driver as process or in command line
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| (FileName = /^(All|EDRStartupHinder|gfreeze|glinker)\.exe$/i
   or CommandLine = /(ThrottleBlood\.sys|\\All\.exe)/i
   or CommandLine = /sc(\.exe)?\s+create.*binPath=.*\\(temp|programdata|users|appdata)\\.*\.sys/i
   or CommandLine = /(fltMC|sc(\.exe)?\s+stop).*(CSAgent|CSFalcon|SentinelAgent|WdFilter|elastic)/i)
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName], limit=200)
| sort(@timestamp, order=desc)

// Branch B (run separately) — driver written outside the standard driver store
// #event_simpleName = /NewExecutableWritten|PeFileWritten/
// | TargetFileName = /\.sys$/i
// | TargetFileName != /\\Windows\\System32\\drivers\\/i
// | TargetFileName != /\\Windows\\System32\\DriverStore\\/i
// | table([@timestamp, aid, ComputerName, TargetFileName, ContextBaseFileName], limit=200)

Looks for: wevtutil cl, Clear-EventLog, or WMI event-log clears — confirmed Gentlemen cleanup. FP: rare in production; allow-list imaging/provisioning AIDs.

// HUNT: The Gentlemen — Clear Windows Event Logs (T1070.001)
// CONF: high  FP: low  COST: low | TIMEFRAME: last 14d
// FP NOTES: golden-image / provisioning pipelines may clear logs (allow-list)
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| (CommandLine = /wevtutil\s+(cl|clear-log)\b/i
   or CommandLine = /Clear-EventLog\b/i
   or CommandLine = /wmic\s+nteventlog.*ClearEventlog/i
   or CommandLine = /(Get-WinEvent|Get-EventLog).*\|\s*.*Clear/i)
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName], limit=200)
| sort(@timestamp, order=desc)

Looks for: comsvcs.dll MiniDump of LSASS and commodity browser stealers (Phemedrone, LummaC2, XenAllPasswordPro, DumpBrowserSecrets). FP: rare IT diagnostics dump processes — pair with Falcon native CredentialDumping detections.

// HUNT: The Gentlemen — Cred access LSASS + browsers (T1003.001 / T1555.003)
// CONF: medium-high  FP: medium  COST: low | TIMEFRAME: last 14d
// FP NOTES: comsvcs MiniDump rarely legit; stealer names = high TP; pair with Falcon native
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| (CommandLine = /comsvcs\.dll.*MiniDump/i
   or CommandLine = /rundll32.*comsvcs.*\s+\d+\s+.*\.dmp/i
   or CommandLine = /(procdump(64)?\.exe).*lsass/i
   or CommandLine = /lsass.*\.dmp/i
   or FileName = /^(Phemedrone|XenAllPasswordPro|DumpBrowserSecrets|ChromeAppBound|LummaC2|mimikatz|nanodump)\.exe$/i)
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName], limit=200)
| sort(@timestamp, order=desc)

Looks for: a msimg32.dll written anywhere outside System32/SysWOW64 — search-order hijack IOC. FP: a few apps ship their own copy — verify the writing process and signer.

// HUNT: The Gentlemen — msimg32.dll DLL sideloading (T1574.002)
// CONF: high  FP: low  COST: low | TIMEFRAME: last 30d
// FP NOTES: verify writing process and DLL signature before escalating
#event_simpleName = /NewExecutableWritten|PeFileWritten/
| TargetFileName = /\\msimg32\.dll$/i
| TargetFileName != /\\Windows\\System32\\/i
| TargetFileName != /\\Windows\\SysWOW64\\/i
| TargetFileName != /\\Windows\\WinSxS\\/i
| table([@timestamp, aid, ComputerName, UserName, TargetFileName, ContextBaseFileName], limit=200)
| sort(@timestamp, order=desc)

Looks for: rclone command-line flags and MEGA remotes used to stage double-extortion theft — diagnostic even if the binary is renamed. FP: some IT uses rclone for cloud sync — allow-list sanctioned backup jobs.

// HUNT: The Gentlemen — Exfil via rclone to MEGA (T1567.002 / T1048)
// CONF: medium-high  FP: medium  COST: low | TIMEFRAME: last 14d
// FP NOTES: allow-list sanctioned backup jobs/AIDs; mega remote + copy/sync = high TP
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| (FileName = /^rclone\.exe$/i
   or CommandLine = /rclone\s+(copy|sync|move|lsd|config)/i
   or CommandLine = /(mega\.nz|mega:|--config\s+.*rclone\.conf)/i
   or CommandLine = /\b(copy|sync)\b.*\b(mega|b2|s3|gdrive|dropbox|onedrive):/i)
| groupBy([aid, ComputerName, UserName], function=[count(), collect([CommandLine, ImageFileName, ParentBaseFileName], limit=20)])
| sort(_count, order=desc)

Looks for: direct match on the published encryptor hash and the Proton66 C2 IP. Indicators rotate, so absence is inconclusive — keep refreshing from §4/§8. FP: hash is definitive; the IP may be reassigned — corroborate context.

// HUNT: The Gentlemen — indicator sweep (hash + historic C2 IP)
// CONF: high  FP: very low (hash) / low (IP) | TIMEFRAME: last 30-90d
// Branch A — encryptor hash
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| SHA256HashData = "22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67"
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, SHA256HashData], limit=200)

// Branch B (run separately) — Proton66 C2 IP
// #event_simpleName = NetworkConnectIP4
// | RemoteAddressIP4 = "176.120.22.127"
// | table([@timestamp, aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], limit=200)

Looks for: the group's named utilities — recon/cert/priv-esc (NetExec, RelayKing, TaskHound, PrivHound, CertiHound), and Velociraptor abused as C2. FP: Velociraptor is a legitimate DFIR tool — allow-list sanctioned IR/forensics AIDs; NetExec/CME may appear in authorized pentests.

// HUNT: The Gentlemen — named toolkit + Velociraptor C2 (T1219/T1018/T1649)
// CONF: high  FP: low-medium  COST: low | TIMEFRAME: last 30d
// FP NOTES: Velociraptor is legit DFIR (allow-list IR AIDs); NetExec/CME in authorized pentests
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| (FileName = /^(nxc|netexec|crackmapexec|RelayKing|TaskHound|PrivHound|CertiHound|velociraptor)\.exe$/i
   or CommandLine = /(netexec|crackmapexec|\bnxc\b|RelayKing|TaskHound|PrivHound|CertiHound)/i
   or CommandLine = /velociraptor.*(\-\-config|client|gui|artifacts collect)/i)
| groupBy([aid, ComputerName, UserName], function=[count(), collect([FileName, CommandLine, ParentBaseFileName], limit=25)])
| sort(_count, order=desc)