VOLTA / VOLTA-AUTODOXER Infostealer

// HUNT: VOLTA published sample hash or build filenames executing or written
// MITRE: T1204.002, T1036.005
// CONF: high | FP: low | COST: low | REQUIRES: ProcessRollup2, PeFileWritten, NewExecutableWritten
// SOURCE: Talos 2026-10-31 "Sample details" table (single source, so detect only)
// FALSE POSITIVES: none expected for the hash; the filenames are random per build
// LOOKBACK: 30d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| SHA256HashData="57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279" OR FileName=/^(9BY0tjwOc3ut\.exe|yLP9m5J3i2Aw\.exe)$/i
| table([@timestamp, ComputerName, UserName, #event_simpleName, ContextBaseFileName, ParentBaseFileName, FileName, ImageFileName, TargetFileName, CommandLine, SHA256HashData, aid], limit=max)

event.type in ('Process Creation', 'File Creation')
| limit 5
| columns event.type, event.time, tgt.process.name, tgt.process.image.sha256, tgt.file.path, tgt.file.sha256

// HUNT: VOLTA published sample hash or build filenames executing or written
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.002, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected for the hash; the filenames are random per build
// EQUIVALENCE: equivalent-with-schema-assumptions - Same indicator set: the published sample hash or either build filename, on a process start or a file write. A process start maps to Process Creation and the executable write maps to File Creation. contains and in:anycase are case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne Process Creation and File Creation events with hash population
// TUNING: None expected for the hash. The two filenames are random per build, so treat a filename-only hit as a lead to confirm by hash.
// LOOKBACK: 30d; set the console time picker or the query window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed build with a different hash is not caught; the filenames are random per build.
// VALIDATION LEVEL: static-reviewed
event.type in ('Process Creation', 'File Creation')
(tgt.process.image.sha256 in:anycase ('57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279') or tgt.file.sha256 in:anycase ('57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279') or tgt.process.name in:anycase ('9BY0tjwOc3ut.exe', 'yLP9m5J3i2Aw.exe') or tgt.file.path contains ('9BY0tjwOc3ut.exe', 'yLP9m5J3i2Aw.exe'))
| columns event.time, endpoint.name, agent.uuid, src.process.user, event.type, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.file.path, tgt.process.image.sha256, tgt.file.sha256
| limit 1000

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, SHA256
| take 5

// HUNT: VOLTA published sample hash or build filenames executing or written
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.002, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected for the hash; the filenames are random per build
// EQUIVALENCE: telemetry-gap - Partial pivot: the process-start half of the CQL on one table. The executable-write half would need a second table, and SHA256 is often unpopulated in DeviceProcessEvents, so the hash match may return nothing on a healthy tenant while the filename match still works.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected for the hash. Confirm any filename-only hit by hash.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 30d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The executable-write half of the CQL (a build written to disk but never run) is not covered by this query. A hash match depends on SHA256 being populated in DeviceProcessEvents.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where SHA256 =~ "57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279" or FileName in~ ("9BY0tjwOc3ut.exe", "yLP9m5J3i2Aw.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: VOLTA staged exfiltration archives written to disk
// MITRE: T1560, T1074.001
// CONF: high | FP: low | COST: low | REQUIRES: ZipFileWritten
// SOURCE: Talos 2026-10-31 (figure 8 and exfil description)
// FALSE POSITIVES: none expected; the volta_ prefix is specific to this family
// NOTE: the builder is customer-configured, so a renamed archive will not match. Treat a miss as unproven.
// LOOKBACK: 30d
#event_simpleName=ZipFileWritten
| FileName=/^volta_(log|dox|doxnet)\.zip$/i OR TargetFileName=/volta_(log|dox|doxnet)\.zip$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, FileName, TargetFileName, SHA256HashData, aid], limit=200)

event.type = 'File Creation'
| limit 5
| columns event.type, event.time, tgt.file.path

// HUNT: VOLTA staged exfiltration archives written to disk
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1560, T1074.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected; the volta_ prefix is specific to this family
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: an archive written whose name is volta_log, volta_dox or volta_doxnet with a zip extension. matches is case-insensitive, which reproduces the CQL /i intent, and the pattern is unanchored at the start like the CQL's path alternative.
// REQUIRES: SentinelOne File Creation events
// TUNING: None expected. The builder is customer-configured, so a renamed archive will not match; treat a miss as unproven.
// LOOKBACK: 30d; set the console time picker or the query window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed archive is not caught.
// VALIDATION LEVEL: static-reviewed
event.type = 'File Creation'
tgt.file.path matches 'volta_(log|dox|doxnet)\\.zip$'
| columns event.time, endpoint.name, agent.uuid, src.process.user, src.process.name, tgt.file.path, tgt.file.sha256
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, FileName
| take 5

// HUNT: VOLTA staged exfiltration archives written to disk
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1560, T1074.001
// CONF: high | FP: low
// FALSE POSITIVES: none expected; the volta_ prefix is specific to this family
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a zip written with one of the three staged names. matches regex with a (?i) prefix reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: None expected. A renamed archive will not match.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 30d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A renamed archive is not caught.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where ActionType == "FileCreated"
| where FileName matches regex @"(?i)^volta_(log|dox|doxnet)\.zip$"
| project Timestamp, ReportId, DeviceId, DeviceName, RequestAccountName, InitiatingProcessFileName, FileName, FolderPath, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: non-browser process resolving openrouter.ai
// MITRE: T1071.001, T1567
// CONF: medium | FP: medium | COST: low | REQUIRES: DnsRequest with process context
// SOURCE: Talos 2026-10-31 (OpenRouter chat completions endpoint, third-party service)
// FALSE POSITIVES: developer tooling, IDE assistants, agent frameworks, notebooks
// TUNING: baseline 30 days, then add sanctioned ContextBaseFileName values (IDE, python, node) per host group
// NOTE: openrouter.ai is a LEGITIMATE service. This is a hunt and alert only, never a block.
// LOOKBACK: 7d
#event_simpleName=DnsRequest
| DomainName=/(^|\.)openrouter\.ai$/i
| ContextBaseFileName!=/^(chrome|msedge|firefox|brave|opera)\.exe$/i
| groupBy([ComputerName, ContextBaseFileName, DomainName], function=[count(as=Requests), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])
| sort(Requests, order=desc, limit=200)

event.type = 'DNS Resolved'
| limit 5
| columns event.type, event.time, event.dns.request, src.process.name

// HUNT: non-browser process resolving openrouter.ai
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1567
// CONF: medium | FP: medium
// FALSE POSITIVES: developer tooling, IDE assistants, agent frameworks, notebooks
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a DNS lookup of openrouter.ai or a subdomain by a process that is not one of the five browsers, counted per host and process. The domain is matched exactly or as a suffix, like the CQL.
// REQUIRES: SentinelOne DNS Resolved events with the acting process
// TUNING: Baseline 30 days, then add sanctioned process names (IDE, python, node) per host group. openrouter.ai is a legitimate service: hunt and alert only, never block.
// LOOKBACK: 7d; set the console time picker or the query window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A browser used as the carrier is excluded by name, so an attacker running inside a browser process is not caught.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved'
(event.dns.request in:anycase ('openrouter.ai') or event.dns.request matches '\\.openrouter\\.ai$')
!(src.process.name matches '^(chrome|msedge|firefox|brave|opera)\\.exe$')
| group requests=count(), first_seen=min(event.time), last_seen=max(event.time) by endpoint.name, src.process.name, event.dns.request
| sort -requests
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields, InitiatingProcessFileName
| take 5

// HUNT: non-browser process resolving openrouter.ai
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1567
// CONF: medium | FP: medium
// FALSE POSITIVES: developer tooling, IDE assistants, agent frameworks, notebooks
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on the endpoint DNS record: openrouter.ai or a subdomain looked up by a process other than the five browsers. There is no endpoint DNS table, so the name is read from AdditionalFields on DnsQueryResponse rows.
// REQUIRES: Defender for Endpoint network telemetry that records DnsQueryResponse in DeviceEvents
// TUNING: Baseline 30 days, then add sanctioned process names per host group. openrouter.ai is a legitimate service: hunt and alert only.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A browser used as the carrier is excluded by name.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "DnsQueryResponse"
| extend Domain = tolower(tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"])))
| where Domain == "openrouter.ai" or Domain endswith ".openrouter.ai"
| where not(InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe"))
| summarize Requests = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName, InitiatingProcessFileName, Domain
| sort by Requests desc
| take 200

// HUNT: single process resolving both openrouter.ai and rolimons.com
// MITRE: T1071.001, T1567, T1657
// CONF: high | FP: low | COST: medium | REQUIRES: DnsRequest with process context
// SOURCE: Talos 2026-10-31 (Roblox inventory valuation via Rolimons, dossier via OpenRouter)
// FALSE POSITIVES: a hobbyist script or bot that uses both services; very rare on managed endpoints
// NOTE: both domains are LEGITIMATE third-party services. Detect only, never prevent.
// LOOKBACK: 7d
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(openrouter\.ai|rolimons\.com)$/i
| ContextBaseFileName!=/^(chrome|msedge|firefox|brave|opera)\.exe$/i
| case {
    DomainName=/openrouter\.ai$/i | Svc := "openrouter";
    DomainName=/rolimons\.com$/i | Svc := "rolimons";
    * | Svc := "other";
  }
| groupBy([aid, ComputerName, ContextProcessId_decimal, ContextBaseFileName], function=[count(Svc, distinct=true, as=Services), collect([DomainName]), min(@timestamp, as=FirstSeen)])
| Services >= 2
| sort(FirstSeen, order=desc, limit=200)

event.type = 'DNS Resolved'
| limit 5
| columns event.type, event.time, event.dns.request, src.process.name, src.process.pid, agent.uuid

// HUNT: single process resolving both openrouter.ai and rolimons.com
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1567, T1657
// CONF: high | FP: low
// FALSE POSITIVES: a hobbyist script or bot that uses both services; very rare on managed endpoints
// EQUIVALENCE: equivalent-with-schema-assumptions - Same logic: one process that looked up both openrouter.ai and rolimons.com, browsers excluded. The CQL's distinct-service count becomes one conditional count per service, both required above zero.
// REQUIRES: SentinelOne DNS Resolved events with the acting process and its pid
// TUNING: A hobbyist script that uses both services is the only expected match. Both domains are legitimate: detect only, never block.
// LOOKBACK: 7d; set the console time picker or the query window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Pid reuse on one host inside the window can merge two processes.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved'
(event.dns.request in:anycase ('openrouter.ai', 'rolimons.com') or event.dns.request matches '\\.(openrouter\\.ai|rolimons\\.com)$')
!(src.process.name matches '^(chrome|msedge|firefox|brave|opera)\\.exe$')
| group openrouter_lookups=count(event.dns.request contains 'openrouter.ai'), rolimons_lookups=count(event.dns.request contains 'rolimons.com'), first_seen=min(event.time) by agent.uuid, endpoint.name, src.process.pid, src.process.name
| filter openrouter_lookups > 0 and rolimons_lookups > 0
| sort -first_seen
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields, InitiatingProcessFileName, InitiatingProcessId
| take 5

// HUNT: single process resolving both openrouter.ai and rolimons.com
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1567, T1657
// CONF: high | FP: low
// FALSE POSITIVES: a hobbyist script or bot that uses both services; very rare on managed endpoints
// EQUIVALENCE: equivalent-with-schema-assumptions - Same logic on the endpoint DNS record: one process instance that looked up both domains, browsers excluded. The name is read from AdditionalFields on DnsQueryResponse rows.
// REQUIRES: Defender for Endpoint network telemetry that records DnsQueryResponse in DeviceEvents
// TUNING: A hobbyist script that uses both services is the only expected match. Detect only, never block.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Process id reuse on one host inside the window can merge two processes.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "DnsQueryResponse"
| extend Domain = tolower(tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"])))
| where Domain == "openrouter.ai" or Domain endswith ".openrouter.ai" or Domain == "rolimons.com" or Domain endswith ".rolimons.com"
| where not(InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe"))
| summarize OpenRouterLookups = countif(Domain == "openrouter.ai" or Domain endswith ".openrouter.ai"), RolimonsLookups = countif(Domain == "rolimons.com" or Domain endswith ".rolimons.com"), FirstSeen = min(Timestamp) by DeviceId, DeviceName, InitiatingProcessId, InitiatingProcessFileName
| where OpenRouterLookups > 0 and RolimonsLookups > 0
| sort by FirstSeen desc
| take 200

// HUNT: Chrome or Edge launched with --headless by a non-browser parent
// MITRE: T1555.003, T1539
// CONF: medium | FP: medium | COST: low | REQUIRES: ProcessRollup2
// SOURCE: Talos 2026-10-31 countermeasures (single source for the headless angle)
// FALSE POSITIVES: Selenium or Playwright test runs, report-to-PDF jobs, CI agents
// TUNING: add sanctioned developer parents (for example your CI agent or IDE) to the ParentBaseFileName exclusion, or scope by host group
// LOOKBACK: 7d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(chrome|msedge)\.exe$/i
| CommandLine=/--headless/i
| CommandLine!=/--type=/i
| ParentBaseFileName!=/^(chrome|msedge)\.exe$/i
| table([@timestamp, ComputerName, UserName, GrandparentBaseFileName, ParentBaseFileName, FileName, CommandLine, SHA256HashData, aid], limit=200)

event.type = 'Process Creation'
| limit 5
| columns event.type, event.time, tgt.process.name, tgt.process.cmdline, src.process.name

// HUNT: Chrome or Edge launched with --headless by a non-browser parent
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1555.003, T1539
// CONF: medium | FP: medium
// FALSE POSITIVES: Selenium or Playwright test runs, report-to-PDF jobs, CI agents
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on a process start: chrome or msedge with --headless, not a --type= child, and not started by a browser. The created process is tgt.process.* and its creator is src.process.*. contains is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne Process Creation events with command line
// TUNING: Add sanctioned developer parents (a CI agent, an IDE) to the creator exclusion, or scope by host group.
// LOOKBACK: 7d; set the console time picker or the query window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Selenium, Playwright, report-to-PDF and CI jobs match by design and need an allowlist.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name in:anycase ('chrome.exe', 'msedge.exe')
tgt.process.cmdline contains '--headless'
!(tgt.process.cmdline contains '--type=')
!(src.process.name in:anycase ('chrome.exe', 'msedge.exe'))
| columns event.time, endpoint.name, agent.uuid, src.process.user, src.process.parent.name, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.process.image.sha256
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine, InitiatingProcessFileName
| take 5

// HUNT: Chrome or Edge launched with --headless by a non-browser parent
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1555.003, T1539
// CONF: medium | FP: medium
// FALSE POSITIVES: Selenium or Playwright test runs, report-to-PDF jobs, CI agents
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: chrome or msedge created with --headless, not a --type= child, and not started by a browser. The creator is InitiatingProcessFileName and the grandparent is InitiatingProcessParentFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Add sanctioned developer parents to the creator exclusion, or scope by host group.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Selenium, Playwright, report-to-PDF and CI jobs match by design and need an allowlist.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName in~ ("chrome.exe", "msedge.exe")
| where ProcessCommandLine contains "--headless"
| where not(ProcessCommandLine contains "--type=")
| where not(InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe"))
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessParentFileName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: non-browser, non-Telegram-client process resolving api.telegram.org
// MITRE: T1567, T1041
// CONF: low | FP: medium | COST: low | REQUIRES: DnsRequest with process context
// NOTE: INFERRED. Talos names a Telegram channel as the destination but publishes no hostname. api.telegram.org is the
//       public Bot API host, used here as a hunt heuristic only. It is not an IOC from any saved source.
// FALSE POSITIVES: alerting bots, scripts, chat clients, admin automation
// TUNING: baseline 30 days, allowlist recurring ContextBaseFileName values per host group, review only new processes
// LOOKBACK: 7d
#event_simpleName=DnsRequest
| DomainName=/^api\.telegram\.org$/i
| ContextBaseFileName!=/^(telegram|chrome|msedge|firefox|brave|opera)\.exe$/i
| groupBy([ComputerName, ContextBaseFileName], function=[count(as=Requests), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])
| sort(Requests, order=desc, limit=200)

event.type = 'DNS Resolved'
| limit 5
| columns event.type, event.time, event.dns.request, src.process.name

// HUNT: non-browser, non-Telegram-client process resolving api.telegram.org
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1567, T1041
// CONF: low | FP: medium
// FALSE POSITIVES: alerting bots, scripts, chat clients, admin automation
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: a DNS lookup of api.telegram.org by a process that is not Telegram or one of the five browsers, counted per host and process. The host is inferred as the Bot API endpoint, not a published indicator.
// REQUIRES: SentinelOne DNS Resolved events with the acting process
// TUNING: Baseline 30 days, allowlist recurring process names per host group, and review only new processes.
// LOOKBACK: 7d; set the console time picker or the query window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The destination is inferred, so a miss proves nothing about the family. Alerting bots, scripts and admin automation match by design.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved'
event.dns.request in:anycase ('api.telegram.org')
!(src.process.name matches '^(telegram|chrome|msedge|firefox|brave|opera)\\.exe$')
| group requests=count(), first_seen=min(event.time), last_seen=max(event.time) by endpoint.name, src.process.name
| sort -requests
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields, InitiatingProcessFileName
| take 5

// HUNT: non-browser, non-Telegram-client process resolving api.telegram.org
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1567, T1041
// CONF: low | FP: medium
// FALSE POSITIVES: alerting bots, scripts, chat clients, admin automation
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on the endpoint DNS record: api.telegram.org looked up by a process other than Telegram or the five browsers. The name is read from AdditionalFields on DnsQueryResponse rows. The host is an inferred heuristic, not a published indicator.
// REQUIRES: Defender for Endpoint network telemetry that records DnsQueryResponse in DeviceEvents
// TUNING: Baseline 30 days, allowlist recurring process names per host group, and review only new processes.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The destination is inferred, so a miss proves nothing about the family.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "DnsQueryResponse"
| extend Domain = tolower(tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"])))
| where Domain == "api.telegram.org"
| where not(InitiatingProcessFileName in~ ("telegram.exe", "chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe"))
| summarize Requests = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName, InitiatingProcessFileName
| sort by Requests desc
| take 200

// HUNT: 12 character mixed-case alphanumeric executable launched from a user-writable path
// MITRE: T1036.005, T1204.002
// CONF: low | FP: medium | COST: medium | REQUIRES: ProcessRollup2
// NOTE: HEURISTIC derived from the two filenames in the Talos sample table. Not a documented builder behavior.
// FALSE POSITIVES: installers and updaters that generate random temporary names
// TUNING: sort by Hosts ascending and review names seen on one or two hosts; add known installer paths to an exclusion
// LOOKBACK: 14d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^[A-Za-z0-9]{12}\.exe$/
| FileName=/[0-9]/
| FileName=/[A-Z]/
| FileName=/[a-z]/
| ImageFileName=/\\(Users\\[^\\]+\\(AppData|Downloads|Desktop)|ProgramData|Windows\\Temp)\\/i
| groupBy([FileName, ImageFileName, SHA256HashData], function=[count(aid, distinct=true, as=Hosts), min(@timestamp, as=FirstSeen), collect([ComputerName])])
| sort(Hosts, order=asc, limit=200)

event.type = 'Process Creation'
| limit 5
| columns event.type, event.time, tgt.process.name, tgt.process.image.path, agent.uuid

// HUNT: 12 character mixed-case alphanumeric executable launched from a user-writable path
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1036.005, T1204.002
// CONF: low | FP: medium
// FALSE POSITIVES: installers and updaters that generate random temporary names
// EQUIVALENCE: equivalent-with-schema-assumptions - Same heuristic on a process start: a 12 character name with a digit, an upper-case and a lower-case letter, running from a user-writable path, counted by distinct hosts. The name checks use matches:matchcase to keep the CQL's case-sensitive intent; the path check is case-insensitive like the CQL /i.
// REQUIRES: SentinelOne Process Creation events with the image path
// TUNING: Sort by hosts ascending and review names seen on one or two hosts; add known installer paths to an exclusion.
// LOOKBACK: 14d; set the console time picker or the query window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Installers and updaters that generate random temporary names match by design. A build with a different name length is not caught.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name matches:matchcase '^[A-Za-z0-9]{12}\\.exe$'
tgt.process.name matches:matchcase '[0-9]'
tgt.process.name matches:matchcase '[A-Z]'
tgt.process.name matches:matchcase '[a-z]'
tgt.process.image.path matches '\\\\(Users\\\\[^\\\\]+\\\\(AppData|Downloads|Desktop)|ProgramData|Windows\\\\Temp)\\\\'
| group hosts=estimate_distinct(agent.uuid), first_seen=min(event.time), host_sample=any(endpoint.name) by tgt.process.name, tgt.process.image.path, tgt.process.image.sha256
| sort +hosts
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath, DeviceId
| take 5

// HUNT: 12 character mixed-case alphanumeric executable launched from a user-writable path
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1036.005, T1204.002
// CONF: low | FP: medium
// FALSE POSITIVES: installers and updaters that generate random temporary names
// EQUIVALENCE: equivalent-with-schema-assumptions - Same heuristic: a 12 character name with a digit, an upper-case and a lower-case letter, running from a user-writable path, counted by distinct hosts. The name checks are case-sensitive regexes and the path check carries a (?i) prefix, matching the CQL.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Sort by Hosts ascending and review names seen on one or two hosts; add known installer paths to an exclusion.
// LOOKBACK: 14d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Installers and updaters that generate random temporary names match by design. The group key uses SHA1 because SHA256 is often unpopulated, so the SHA256 the CQL groups on is not shown.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where FileName matches regex @"^[A-Za-z0-9]{12}\.exe$"
| where FileName matches regex @"[0-9]"
| where FileName matches regex @"[A-Z]"
| where FileName matches regex @"[a-z]"
| where FolderPath matches regex @"(?i)\\(Users\\[^\\]+\\(AppData|Downloads|Desktop)|ProgramData|Windows\\Temp)\\[^\\]*$"
| summarize Hosts = dcount(DeviceId), FirstSeen = min(Timestamp), HostSample = any(DeviceName) by FileName, FolderPath, SHA1
| sort by Hosts asc
| take 200