Vasilek Backdoor Hidden in VMware Tools (Partisan Zmiy / Cyber Partisans)

// HUNT: Service creation with a masquerading display name or the loader and DLL service paths
// MITRE: T1543.003, T1036.004
// CONF: high
// FP: low
// COST: low
// REQUIRES: CreateService (service installed) with service fields; ServiceDisplayName and ServiceImagePath are the standard field names but ⚠ validate in tenant against one real CreateService row
// FALSE POSITIVES: none expected for these exact display names and paths; a genuine product with an identical display name is the only collision
// LOOKBACK: 7d (set with the console time picker)
#event_simpleName=CreateService
| ServiceDisplayName=/^(VMware Auth Adapter|Windows Insiders Service|Windows Channels Service|Sybase Inc\. Product File|Access FT Imager Service)$/i or ServiceImagePath=/VMware Tools\\authd\.exe/i or ServiceImagePath=/\\System32\\(tpvmmon|aweman32|msadcs32|uplay_r164)\.dll/i
| table([@timestamp, aid, ComputerName, UserName, ServiceDisplayName, ServiceImagePath, ContextBaseFileName])
| sort(@timestamp, order=desc)

event.type = 'Registry Value Modified' registry.keyPath = * registry.valueName = * registry.value = *
| limit 5
| columns event.type, registry.keyPath, registry.valueName, registry.value

// HUNT: Service creation with a masquerading display name or the loader and DLL service paths
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1543.003, T1036.004
// CONF: high | FP: low
// FALSE POSITIVES: none expected for these exact display names and paths; a genuine product with an identical display name is the only collision
// EQUIVALENCE: approximate-analytic - SentinelOne has no service-install event with a display-name field, so the hunt reads the service key instead: a registry write of the DisplayName or ImagePath value under a Services key, tested against the same display names and the same loader and DLL image paths. The service is seen when its values are written, not when the service manager registers it.
// REQUIRES: SentinelOne EDR registry telemetry (event type Registry Value Modified) with registry.keyPath, registry.valueName and registry.value populated
// TUNING: A genuine product with an identical display name is the only expected collision; exclude it by writer process after reviewing real rows.
// LOOKBACK: 7d (set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A service created through an API that never writes the DisplayName or ImagePath values to the registry is not seen. Rows are registry writes, so a later edit of an existing service value matches as well as a new install.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified' registry.keyPath matches '.Services.' registry.valueName in:anycase ('DisplayName', 'ImagePath') (registry.value matches '^(VMware Auth Adapter|Windows Insiders Service|Windows Channels Service|Sybase Inc\\. Product File|Access FT Imager Service)$' or registry.value matches 'VMware Tools\\\\authd\\.exe' or registry.value matches '\\\\System32\\\\(tpvmmon|aweman32|msadcs32|uplay_r164)\\.dll')
| columns event.time, endpoint.name, src.process.user, src.process.name, registry.keyPath, registry.valueName, registry.value
| sort -event.time
| limit 200

DeviceRegistryEvents
| where Timestamp > ago(1d)
| where ActionType == "RegistryValueSet"
| project Timestamp, ActionType, RegistryKey, RegistryValueName, RegistryValueData
| take 5

// HUNT: Service creation with a masquerading display name or the loader and DLL service paths
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1543.003, T1036.004
// CONF: high | FP: low
// FALSE POSITIVES: none expected for these exact display names and paths; a genuine product with an identical display name is the only collision
// EQUIVALENCE: approximate-analytic - Defender does not record a service display name on a service-creation row, so the hunt reads the service key: a RegistryValueSet of DisplayName or ImagePath under a Services key, tested against the same display names and image paths.
// REQUIRES: Defender for Endpoint registry telemetry (DeviceRegistryEvents)
// TUNING: A genuine product with an identical display name is the only expected collision; exclude it by InitiatingProcessFileName after reviewing real rows.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A service created through an API that never writes the DisplayName or ImagePath values to the registry is not seen.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceRegistryEvents
| where Timestamp >= ago(7d)
| where ActionType == "RegistryValueSet"
| where RegistryKey contains "\\Services\\"
| where RegistryValueName in~ ("DisplayName", "ImagePath")
| where RegistryValueData matches regex @"(?i)^(VMware Auth Adapter|Windows Insiders Service|Windows Channels Service|Sybase Inc\. Product File|Access FT Imager Service)$" or RegistryValueData matches regex @"(?i)VMware Tools\\authd\.exe" or RegistryValueData matches regex @"(?i)\\System32\\(tpvmmon|aweman32|msadcs32|uplay_r164)\.dll"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData
| sort by Timestamp desc
| take 200

// HUNT: Masquerade executables (authd, vmtoolsd32, rpctool32, WsusService) running unsigned from VMware Tools or UpdateServicesPackages
// MITRE: T1036.005, T1543.003, T1090
// CONF: high
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2 with ImageFileName and AuthenticodeHashData (absent on unsigned files per the v3 reference); ⚠ validate in tenant that AuthenticodeHashData is populated for signed VMware binaries before trusting a zero result
// FALSE POSITIVES: genuine VMware authd.exe (signed), unsigned in-house tool reusing a name, sensors without authenticode population
// TUNING: keep the unsigned filter; exclude only after confirming the SHA256HashData against the vendor package for your VMware Tools version; never exclude by file name or folder alone
// LOOKBACK: 7d (set with the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| (FileName=/^(authd|vmtoolsd32|rpctool32)\.exe$/i and ImageFileName=/\\VMware Tools\\[^\\]+$/i) or (FileName=/^WsusService\.exe$/i and ImageFileName=/\\UpdateServicesPackages\\/i)
| AuthenticodeHashData!=*
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.name = * tgt.process.image.path = *
| limit 5
| columns event.type, tgt.process.name, tgt.process.image.path, tgt.process.publisher

// HUNT: Masquerade executables (authd, vmtoolsd32, rpctool32, WsusService) running unsigned from VMware Tools or UpdateServicesPackages
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1036.005, T1543.003, T1090
// CONF: high | FP: medium
// FALSE POSITIVES: genuine VMware authd.exe (signed), unsigned in-house tool reusing a name, sensors without authenticode population
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the three VMware Tools masquerade names in a VMware Tools folder, or WsusService.exe in the package store, with no signer. The new process is tgt.process.*. The unsigned test is an absent publisher, which is the nearest attested signer field.
// REQUIRES: SentinelOne EDR process-creation telemetry with tgt.process.image.path and a populated tgt.process.publisher for signed binaries
// TUNING: Keep the unsigned filter; exclude only after confirming the SHA-256 against the vendor package for your VMware Tools version; never exclude by file name or folder alone.
// LOOKBACK: 7d (set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: If the sensor leaves tgt.process.publisher empty for signed binaries the hunt also returns the genuine signed copies.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' ((tgt.process.name in:anycase ('authd.exe', 'vmtoolsd32.exe', 'rpctool32.exe') and tgt.process.image.path matches '\\\\VMware Tools\\\\[^\\\\]+$') or (tgt.process.name in:anycase ('WsusService.exe') and tgt.process.image.path contains 'UpdateServicesPackages')) !(tgt.process.publisher = *)
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, src.process.name, tgt.process.image.sha256
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath, ProcessVersionInfoCompanyName
| take 5

// HUNT: Masquerade executables (authd, vmtoolsd32, rpctool32, WsusService) running unsigned from VMware Tools or UpdateServicesPackages
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1036.005, T1543.003, T1090
// CONF: high | FP: medium
// FALSE POSITIVES: genuine VMware authd.exe (signed), unsigned in-house tool reusing a name, sensors without authenticode population
// EQUIVALENCE: approximate-analytic - Same masquerade names and folders on process creation, but DeviceProcessEvents has no signature column for the created process, so the unsigned test becomes an empty company name in the version info.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Keep the version-info test; exclude only after confirming the hash against the vendor package for your VMware Tools version; never exclude by file name or folder alone.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A masquerade that forges a company name in its version information is not caught, and a signed copy with no version information is. The CQL's signature test has no created-process equivalent in this table.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where (FileName in~ ("authd.exe", "vmtoolsd32.exe", "rpctool32.exe") and FolderPath matches regex @"(?i)\\VMware Tools\\[^\\]+$") or (FileName =~ "WsusService.exe" and FolderPath contains "UpdateServicesPackages")
| where isempty(ProcessVersionInfoCompanyName)
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: PE file written to VMware Tools folder under attacker file names by a non-installer writer
// MITRE: T1574.004, T1036.005, T1105, T1070.006
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: NewExecutableWritten or PeFileWritten with TargetFileName and ContextBaseFileName (writer process); ⚠ validate ContextBaseFileName in tenant. Non-PE .bak copies appear only if the sensor classifies the content as a PE
// FALSE POSITIVES: VMware Tools upgrade or repair, deployment agents staging the package
// TUNING: extend the writer exclusion with your own deployment agent (for example your software distribution client) after confirming it on real rows; do not exclude msiexec.exe and then forget that an attacker can also run msiexec
// LOOKBACK: 7d (set with the console time picker)
#event_simpleName=/^(NewExecutableWritten|PeFileWritten)$/
| TargetFileName=/\\VMware Tools\\(authd\.exe|vmtoolsd32\.exe|rpctool32\.exe|vmtools\.dll|vmtoolsd\.dll|new\.bak|old-[^\\]*\.bak)$/i
| ContextBaseFileName!=/^(msiexec|VMwareToolsUpgrader|setup|setup64)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, TargetFileName, ContextBaseFileName, SHA256HashData])
| sort(@timestamp, order=desc)

event.type = 'File Creation' tgt.file.path = * src.process.name = *
| limit 5
| columns event.type, tgt.file.path, src.process.name

// HUNT: PE file written to VMware Tools folder under attacker file names by a non-installer writer
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.004, T1036.005, T1105, T1070.006
// CONF: medium | FP: medium
// FALSE POSITIVES: VMware Tools upgrade or repair, deployment agents staging the package
// EQUIVALENCE: approximate-analytic - Same target-path and writer-exclusion predicate, but SentinelOne reports every file creation or modification rather than only files the sensor classified as executable, so the hunt is keyed on the attacker file names alone. The writer is the acting process, src.process.*.
// REQUIRES: SentinelOne EDR file telemetry (File Creation and File Modification) with tgt.file.path and src.process.name populated
// TUNING: Extend the writer exclusion with your own deployment agent after confirming it on real rows; do not exclude msiexec.exe and then forget that an attacker can also run msiexec.
// LOOKBACK: 7d (set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL only fires on files the sensor classified as executable; here a non-executable file with one of these names also matches. A rename onto one of these names may report the old path, so a swap by rename can be missed.
// VALIDATION LEVEL: static-reviewed
event.type in ('File Creation', 'File Modification') tgt.file.path matches '.VMware Tools.(authd\\.exe|vmtoolsd32\\.exe|rpctool32\\.exe|vmtools\\.dll|vmtoolsd\\.dll|new\\.bak|old-[^\\\\]*\\.bak)$' !(src.process.name in:anycase ('msiexec.exe', 'VMwareToolsUpgrader.exe', 'setup.exe', 'setup64.exe'))
| columns event.time, endpoint.name, src.process.user, tgt.file.path, src.process.name, tgt.file.sha256
| sort -event.time
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, FolderPath, FileName, InitiatingProcessFileName
| take 5

// HUNT: PE file written to VMware Tools folder under attacker file names by a non-installer writer
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.004, T1036.005, T1105, T1070.006
// CONF: medium | FP: medium
// FALSE POSITIVES: VMware Tools upgrade or repair, deployment agents staging the package
// EQUIVALENCE: approximate-analytic - Same target-folder, file-name and writer-exclusion predicate on file events; Defender reports every created or modified file rather than only files classified as executable, so the file names carry the selection.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: Extend the writer exclusion with your own deployment agent after confirming it on real rows; do not exclude msiexec.exe and then forget that an attacker can also run msiexec.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL only fires on files the sensor classified as executable; here a non-executable file with one of these names also matches.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(7d)
| where ActionType in~ ("FileCreated", "FileModified")
| where FolderPath contains "\\VMware Tools\\"
| where FileName in~ ("authd.exe", "vmtoolsd32.exe", "rpctool32.exe", "vmtools.dll", "vmtoolsd.dll", "new.bak") or FileName matches regex @"(?i)^old-[^\\]*\.bak$"
| where InitiatingProcessFileName !in~ ("msiexec.exe", "VMwareToolsUpgrader.exe", "setup.exe", "setup64.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, FolderPath, FileName, InitiatingProcessFileName, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: SHA256 match on Solar-published files for this intrusion
// MITRE: T1543.003, T1574.004, T1090, T1071.004
// CONF: high
// FP: low
// COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2, NewExecutableWritten or PeFileWritten carrying SHA256HashData
// FALSE POSITIVES: none expected; GOST and 3proxy are open-source tools, so a hit on those two hashes is the attacker-built copy, but hits should still be reviewed by an analyst rather than auto-actioned
// LOOKBACK: 7d (set with the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|NewExecutableWritten|PeFileWritten)$/
| in(field=SHA256HashData, values=["cc8c707bf49c0cdb79b806d41df6254efc0e9f566a02d223871550f414469d13", "e5c6b6d37ff168def37dfd86c636e512be3ed7ead9a2dc93d5c741c42b47c1f1", "07381d79670129277211a4373e5518799a54b427946602539463ec2dd9cdb5e7", "4f0e23a83d83d901c76353d8b9b6ee2940eb63d531ad15f736193903b5c7c8c3", "8c37c4b1f168219a1ce495c9822730981b20ff03d937ddcd8795fca14a9b7869", "5bc4fa9916c0883d45cb85639e328ed484dc75f4dfda294eb52f4b8b612889f2", "c499fab59acbb1750e1e0e5a3c51d119ccd6374e5f0b45639f29598720222766", "87e713f9b6ae14d97d3fa4d1a882c029e7e963d844d9c93ea383cab3d46a949c", "d7aedc020ce832334abf0d03986da31f41cb2191355f25b17989dcfa8bb2775b", "e55431d6f15aa78ada3f60ed30a3f32b444b952bdc53a652546c1820f8bfa513", "5076286c26f2a5c7dd7f507365fe404db2b05d39b350c463faa053baa37b3742", "125ead2c3b1d0f7aee03d13b927744ec8dc1d046912ce73efc9c5a10243b99dc"])
| table([@timestamp, aid, ComputerName, UserName, #event_simpleName, SHA256HashData, FileName, ImageFileName, TargetFileName, CommandLine])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.image.sha256 = *
| limit 5
| columns event.type, tgt.process.image.sha256, tgt.file.sha256

// HUNT: SHA256 match on Solar-published files for this intrusion
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1543.003, T1574.004, T1090, T1071.004
// CONF: high | FP: low
// FALSE POSITIVES: none expected; GOST and 3proxy are open-source tools, so a hit on those two hashes is the attacker-built copy, but hits should still be reviewed by an analyst rather than auto-actioned
// EQUIVALENCE: equivalent-with-schema-assumptions - Same twelve SHA-256 values matched on the same two populations: an executed image on process creation and a written file on file creation or modification. The hash sits on the created process (tgt.process.image.sha256) and on the written file (tgt.file.sha256).
// REQUIRES: SentinelOne EDR process and file telemetry with SHA-256 populated on tgt.process.image.sha256 and tgt.file.sha256
// TUNING: Review every hit as an analyst rather than auto-actioning it; GOST and 3proxy are open-source tools, so a hit on those hashes is the attacker-built copy.
// LOOKBACK: 7d (set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A file that was neither written nor executed inside the lookback window is not seen.
// VALIDATION LEVEL: static-reviewed
(event.type = 'Process Creation' and tgt.process.image.sha256 in:anycase ('cc8c707bf49c0cdb79b806d41df6254efc0e9f566a02d223871550f414469d13', 'e5c6b6d37ff168def37dfd86c636e512be3ed7ead9a2dc93d5c741c42b47c1f1', '07381d79670129277211a4373e5518799a54b427946602539463ec2dd9cdb5e7', '4f0e23a83d83d901c76353d8b9b6ee2940eb63d531ad15f736193903b5c7c8c3', '8c37c4b1f168219a1ce495c9822730981b20ff03d937ddcd8795fca14a9b7869', '5bc4fa9916c0883d45cb85639e328ed484dc75f4dfda294eb52f4b8b612889f2', 'c499fab59acbb1750e1e0e5a3c51d119ccd6374e5f0b45639f29598720222766', '87e713f9b6ae14d97d3fa4d1a882c029e7e963d844d9c93ea383cab3d46a949c', 'd7aedc020ce832334abf0d03986da31f41cb2191355f25b17989dcfa8bb2775b', 'e55431d6f15aa78ada3f60ed30a3f32b444b952bdc53a652546c1820f8bfa513', '5076286c26f2a5c7dd7f507365fe404db2b05d39b350c463faa053baa37b3742', '125ead2c3b1d0f7aee03d13b927744ec8dc1d046912ce73efc9c5a10243b99dc')) or (event.type in ('File Creation', 'File Modification') and tgt.file.sha256 in:anycase ('cc8c707bf49c0cdb79b806d41df6254efc0e9f566a02d223871550f414469d13', 'e5c6b6d37ff168def37dfd86c636e512be3ed7ead9a2dc93d5c741c42b47c1f1', '07381d79670129277211a4373e5518799a54b427946602539463ec2dd9cdb5e7', '4f0e23a83d83d901c76353d8b9b6ee2940eb63d531ad15f736193903b5c7c8c3', '8c37c4b1f168219a1ce495c9822730981b20ff03d937ddcd8795fca14a9b7869', '5bc4fa9916c0883d45cb85639e328ed484dc75f4dfda294eb52f4b8b612889f2', 'c499fab59acbb1750e1e0e5a3c51d119ccd6374e5f0b45639f29598720222766', '87e713f9b6ae14d97d3fa4d1a882c029e7e963d844d9c93ea383cab3d46a949c', 'd7aedc020ce832334abf0d03986da31f41cb2191355f25b17989dcfa8bb2775b', 'e55431d6f15aa78ada3f60ed30a3f32b444b952bdc53a652546c1820f8bfa513', '5076286c26f2a5c7dd7f507365fe404db2b05d39b350c463faa053baa37b3742', '125ead2c3b1d0f7aee03d13b927744ec8dc1d046912ce73efc9c5a10243b99dc'))
| columns event.time, endpoint.name, event.type, tgt.process.name, tgt.process.image.path, tgt.process.image.sha256, tgt.process.cmdline, tgt.file.path, tgt.file.sha256
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| where isnotempty(SHA256)
| project Timestamp, SHA256
| take 5

// HUNT: SHA256 match on Solar-published files for this intrusion
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1543.003, T1574.004, T1090, T1071.004
// CONF: high | FP: low
// FALSE POSITIVES: none expected; GOST and 3proxy are open-source tools, so a hit on those two hashes is the attacker-built copy, but hits should still be reviewed by an analyst rather than auto-actioned
// EQUIVALENCE: telemetry-gap - One table per query: this pivot covers only the executed-image half of the hash match, on process creation. The written-file half lives in another table and is left to the CQL tab.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) with SHA256 populated
// TUNING: Review every hit as an analyst rather than auto-actioning it; run the CQL tab for the written-file half.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Files that were written but never executed are not covered: that half needs a file-event table. SHA256 is often unpopulated in DeviceProcessEvents and the CQL carries no SHA1 values, so a tenant with sparse SHA256 sees fewer hits than the CQL tab.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where SHA256 in~ ("cc8c707bf49c0cdb79b806d41df6254efc0e9f566a02d223871550f414469d13", "e5c6b6d37ff168def37dfd86c636e512be3ed7ead9a2dc93d5c741c42b47c1f1", "07381d79670129277211a4373e5518799a54b427946602539463ec2dd9cdb5e7", "4f0e23a83d83d901c76353d8b9b6ee2940eb63d531ad15f736193903b5c7c8c3", "8c37c4b1f168219a1ce495c9822730981b20ff03d937ddcd8795fca14a9b7869", "5bc4fa9916c0883d45cb85639e328ed484dc75f4dfda294eb52f4b8b612889f2", "c499fab59acbb1750e1e0e5a3c51d119ccd6374e5f0b45639f29598720222766", "87e713f9b6ae14d97d3fa4d1a882c029e7e963d844d9c93ea383cab3d46a949c", "d7aedc020ce832334abf0d03986da31f41cb2191355f25b17989dcfa8bb2775b", "e55431d6f15aa78ada3f60ed30a3f32b444b952bdc53a652546c1820f8bfa513", "5076286c26f2a5c7dd7f507365fe404db2b05d39b350c463faa053baa37b3742", "125ead2c3b1d0f7aee03d13b927744ec8dc1d046912ce73efc9c5a10243b99dc")
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
| take 200

// HUNT: DnsRequest for published C2 and PartisanDNS domains (including subdomains used for tunnelling)
// MITRE: T1071.004, T1568.002, T1090
// CONF: high
// FP: low
// COST: low
// REQUIRES: DnsRequest with DomainName; host must resolve through a path the sensor sees
// FALSE POSITIVES: none expected for these names
// LOOKBACK: 7d (set with the console time picker)
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(c0ce\.org|p7cp\.org|f91j\.org|w3a01\.net|gov\-by\.com|okkgb\.com|c\-oh\.com|89e\.org|parker\-inc\.com|vpnosljjk\.pro|vfvnfaq\.(top|link|cyou|pro|me|my|buzz|info|space|in|sbs|work|casa|lol|lat|net|org|com))$/i
| groupBy([aid, ComputerName, DomainName], function=[count(as=Lookups), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen), collect([ContextProcessId])], limit=500)
| sort(Lookups, order=desc, limit=200)

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.type, event.dns.request, src.process.name

// HUNT: DnsRequest for published C2 and PartisanDNS domains (including subdomains used for tunnelling)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.004, T1568.002, T1090
// CONF: high | FP: low
// FALSE POSITIVES: none expected for these names
// EQUIVALENCE: equivalent-with-schema-assumptions - Same domain-suffix pattern matched on the DNS lookup name and grouped by host and name with a count and first and last seen. The name is read from event.dns.request, the attested DNS field.
// REQUIRES: SentinelOne EDR DNS telemetry (event type DNS Resolved) with event.dns.request populated; the host must resolve through a path the sensor sees
// TUNING: None expected for these names; escalate every hit.
// LOOKBACK: 7d (set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL also collects the process id behind each lookup; this card shows one process name per group instead.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' event.dns.request matches '(^|\\.)(c0ce\\.org|p7cp\\.org|f91j\\.org|w3a01\\.net|gov[-]by\\.com|okkgb\\.com|c[-]oh\\.com|89e\\.org|parker[-]inc\\.com|vpnosljjk\\.pro|vfvnfaq\\.(top|link|cyou|pro|me|my|buzz|info|space|in|sbs|work|casa|lol|lat|net|org|com))$'
| group lookups = count(), first_seen = min(event.time), last_seen = max(event.time), process_name = any(src.process.name) by endpoint.name, event.dns.request
| sort -lookups
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: DnsRequest for published C2 and PartisanDNS domains (including subdomains used for tunnelling)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.004, T1568.002, T1090
// CONF: high | FP: low
// FALSE POSITIVES: none expected for these names
// EQUIVALENCE: equivalent-with-schema-assumptions - Same domain-suffix pattern matched on the DNS lookup name. Defender has no endpoint DNS table, so the name is read from the DnsQueryResponse action's additional fields.
// REQUIRES: Defender for Endpoint DNS events recorded as DeviceEvents with ActionType DnsQueryResponse
// TUNING: None expected for these names; escalate every hit.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL also collects the process id behind each lookup; this card does not.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "DnsQueryResponse"
| extend QueriedName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where QueriedName matches regex @"(?i)(^|\.)(c0ce\.org|p7cp\.org|f91j\.org|w3a01\.net|gov[-]by\.com|okkgb\.com|c[-]oh\.com|89e\.org|parker[-]inc\.com|vpnosljjk\.pro|vfvnfaq\.(top|link|cyou|pro|me|my|buzz|info|space|in|sbs|work|casa|lol|lat|net|org|com))$"
| summarize Lookups = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName, QueriedName
| sort by Lookups desc
| take 200

// HUNT: NetworkConnectIP4 to the published IPs from a non-browser process
// MITRE: T1071.001, T1090
// CONF: low
// FP: medium
// COST: low
// REQUIRES: NetworkConnectIP4 with RemoteAddressIP4 and ContextBaseFileName
// FALSE POSITIVES: updaters and SaaS clients behind the same CDN addresses
// TUNING: treat as a pivot, not a detection: escalate only when the initiating process is unsigned, sits in a VMware Tools or System32 masquerade path, or also appears in Q1 to Q5; expire the IP list after 30 days
// LOOKBACK: 7d (set with the console time picker)
#event_simpleName=NetworkConnectIP4
| in(field=RemoteAddressIP4, values=["172.67.210.25", "104.21.34.242", "199.59.243.228"])
| ContextBaseFileName!=/^(chrome|msedge|firefox|iexplore|brave)\.exe$/i
| groupBy([aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], function=[count(as=Connections), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=500)
| sort(Connections, order=desc, limit=200)

event.type = 'IP Connect' dst.ip.address = * src.process.name = *
| limit 5
| columns event.type, dst.ip.address, dst.port.number, src.process.name

// HUNT: NetworkConnectIP4 to the published IPs from a non-browser process
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1071.001, T1090
// CONF: low | FP: medium
// FALSE POSITIVES: updaters and SaaS clients behind the same CDN addresses
// EQUIVALENCE: equivalent-with-schema-assumptions - Same three destination addresses, the same browser exclusion, and the same grouping by host, process, address and port. The connecting process is the acting process, src.process.*, on an IP Connect event.
// REQUIRES: SentinelOne EDR network telemetry (event type IP Connect) with dst.ip.address and src.process.name populated
// TUNING: Treat as a pivot, not a detection: escalate only when the initiating process is unsigned, sits in a VMware Tools or System32 masquerade path, or also appears in Q1 to Q5; expire the IP list after 30 days.
// LOOKBACK: 7d (set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The addresses are shared hosting, so a hit is a pivot and not a verdict.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' dst.ip.address in ('172.67.210.25', '104.21.34.242', '199.59.243.228') !(src.process.name in:anycase ('chrome.exe', 'msedge.exe', 'firefox.exe', 'iexplore.exe', 'brave.exe'))
| group connections = count(), first_seen = min(event.time), last_seen = max(event.time) by endpoint.name, src.process.name, dst.ip.address, dst.port.number
| sort -connections
| limit 200

DeviceNetworkEvents
| where Timestamp > ago(1d)
| where ActionType == "ConnectionSuccess"
| project Timestamp, ActionType, RemoteIP, InitiatingProcessFileName
| take 5

// HUNT: NetworkConnectIP4 to the published IPs from a non-browser process
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1071.001, T1090
// CONF: low | FP: medium
// FALSE POSITIVES: updaters and SaaS clients behind the same CDN addresses
// EQUIVALENCE: equivalent-with-schema-assumptions - Same three destination addresses, the same browser exclusion, and the same grouping by host, process, address and port. Successful connections stand in for the CQL's outbound connect events.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Treat as a pivot, not a detection: escalate only when the initiating process is unsigned, sits in a VMware Tools or System32 masquerade path, or also appears in Q1 to Q5; expire the IP list after 30 days.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The addresses are shared hosting, so a hit is a pivot and not a verdict. Failed or blocked connection attempts are not included.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where ActionType == "ConnectionSuccess"
| where RemoteIP in ("172.67.210.25", "104.21.34.242", "199.59.243.228")
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe", "brave.exe")
| summarize Connections = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| sort by Connections desc
| take 200

// HUNT: DnsRequest for api.telegram.org resolved to a non-browser, non-Telegram process
// MITRE: T1102.002, T1041, T1071.001
// CONF: medium
// FP: medium
// COST: medium
// REQUIRES: DnsRequest plus ProcessRollup2 or SyntheticProcessRollup2 joined on aid and process id; a long-running process started before the lookback window needs the Synthetic event; if a proxy resolves DNS for the host, run this against proxy logs instead
// FALSE POSITIVES: admin bots, Telegram desktop updater, chat integrations
// TUNING: allowlist the specific hashes of approved automation and keep the rest; servers and domain controllers should never need this lookup, so raise severity there
// LOOKBACK: 7d (set with the console time picker)
#event_simpleName=DnsRequest
| DomainName=/^api\.telegram\.org$/i
| rename(field=ContextProcessId_decimal, as=TargetProcessId_decimal)
| join(query={#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ | FileName!=/^(chrome|msedge|firefox|iexplore|brave|Telegram|Update)\.exe$/i}, field=[aid, TargetProcessId_decimal], include=[FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])
| table([@timestamp, aid, ComputerName, DomainName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])
| sort(@timestamp, order=desc)

event.type = 'DNS Resolved' event.dns.request = * src.process.name = *
| limit 5
| columns event.type, event.dns.request, src.process.name

// HUNT: DnsRequest for api.telegram.org resolved to a non-browser, non-Telegram process
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1102.002, T1041, T1071.001
// CONF: medium | FP: medium
// FALSE POSITIVES: admin bots, Telegram desktop updater, chat integrations
// EQUIVALENCE: equivalent-with-schema-assumptions - Same lookup name and the same process exclusion. SentinelOne stamps the querying process on the DNS event itself, so the CQL's join back to the process-start event is not needed; the process is src.process.* on a DNS Resolved event.
// REQUIRES: SentinelOne EDR DNS telemetry (event type DNS Resolved) with the querying process populated; if a proxy resolves DNS for the host, run this against proxy logs instead
// TUNING: Allowlist the specific hashes of approved automation and keep the rest; servers and domain controllers should never need this lookup, so raise severity there.
// LOOKBACK: 7d (set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A lookup made through a system resolver service may be attributed to that service rather than the real caller.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved' event.dns.request matches '^api\\.telegram\\.org$' !(src.process.name in:anycase ('chrome.exe', 'msedge.exe', 'firefox.exe', 'iexplore.exe', 'brave.exe', 'Telegram.exe', 'Update.exe'))
| columns event.time, endpoint.name, event.dns.request, src.process.name, src.process.image.path, src.process.cmdline, src.process.parent.name, src.process.image.sha256
| sort -event.time
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields, InitiatingProcessFileName
| take 5

// HUNT: DnsRequest for api.telegram.org resolved to a non-browser, non-Telegram process
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1102.002, T1041, T1071.001
// CONF: medium | FP: medium
// FALSE POSITIVES: admin bots, Telegram desktop updater, chat integrations
// EQUIVALENCE: equivalent-with-schema-assumptions - Same lookup name and the same process exclusion. The DNS action row already names the initiating process, so the CQL's join back to the process-start event is not needed.
// REQUIRES: Defender for Endpoint DNS events recorded as DeviceEvents with ActionType DnsQueryResponse
// TUNING: Allowlist the specific hashes of approved automation and keep the rest; servers and domain controllers should never need this lookup, so raise severity there.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A lookup made through a system resolver service may be attributed to that service rather than the real caller.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(7d)
| where ActionType == "DnsQueryResponse"
| extend QueriedName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"]))
| where QueriedName =~ "api.telegram.org"
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe", "brave.exe", "Telegram.exe", "Update.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, QueriedName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessSHA256
| sort by Timestamp desc
| take 200

// HUNT: Process creation with parent authd.exe, vmtoolsd32.exe or rpctool32.exe, with weekday and hour in UTC
// MITRE: T1059.003, T1090, T1070.004, T1548.004
// CONF: high
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2 with ParentBaseFileName; ParentBaseFileName carries no path, so pair with Q2 for the unsigned test
// FALSE POSITIVES: genuine VMware authd.exe helpers
// TUNING: if your estate legitimately runs a signed authd.exe, keep the vmtoolsd32 and rpctool32 parents (never genuine VMware names per Solar) and join Q2 to restrict authd.exe to unsigned copies
// LOOKBACK: 7d (set with the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(authd|vmtoolsd32|rpctool32)\.exe$/i
| Weekday := formatTime("%a", field=@timestamp)
| HourUtc := formatTime("%H", field=@timestamp)
| table([@timestamp, Weekday, HourUtc, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' src.process.name = *
| limit 5
| columns event.type, src.process.name, tgt.process.name

// HUNT: Process creation with parent authd.exe, vmtoolsd32.exe or rpctool32.exe, with weekday and hour in UTC
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.003, T1090, T1070.004, T1548.004
// CONF: high | FP: medium
// FALSE POSITIVES: genuine VMware authd.exe helpers
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the creator is one of the three masquerade names. On a Process Creation event the creator is src.process.* and the new process is tgt.process.*, so the CQL's parent field maps to src.process.name.
// REQUIRES: SentinelOne EDR process-creation telemetry with the creator process name populated
// TUNING: If your estate legitimately runs a signed authd.exe, keep the vmtoolsd32.exe and rpctool32.exe creators (never genuine VMware names) and pair with Q2 to restrict authd.exe to unsigned copies.
// LOOKBACK: 7d (set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The CQL's weekday and hour-of-day columns are not derived here; read them from event.time.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' src.process.name in:anycase ('authd.exe', 'vmtoolsd32.exe', 'rpctool32.exe')
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdline, tgt.process.image.sha256
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, InitiatingProcessFileName, FileName
| take 5

// HUNT: Process creation with parent authd.exe, vmtoolsd32.exe or rpctool32.exe, with weekday and hour in UTC
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.003, T1090, T1070.004, T1548.004
// CONF: high | FP: medium
// FALSE POSITIVES: genuine VMware authd.exe helpers
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: the initiating process is one of the three masquerade names. The CQL's parent field is InitiatingProcessFileName. Weekday and hour are derived from Timestamp, which is UTC.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: If your estate legitimately runs a signed authd.exe, keep the vmtoolsd32.exe and rpctool32.exe creators (never genuine VMware names) and pair with Q2 to restrict authd.exe to unsigned copies.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The initiating-process name carries no path, so the unsigned test lives on the Q2 card.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName in~ ("authd.exe", "vmtoolsd32.exe", "rpctool32.exe")
| extend Weekday = toint(dayofweek(Timestamp) / 1d), HourUtc = hourofday(Timestamp)
| project Timestamp, Weekday, HourUtc, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA1, SHA256
| sort by Timestamp desc
| take 200

// HUNT: cmd.exe redirecting output to the loopback ADMIN$ share with an underscore-timestamp file name
// MITRE: T1047, T1021.002
// CONF: high
// FP: low
// COST: low
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2 with FileName and CommandLine
// FALSE POSITIVES: none expected; some security assessment tools reproduce the same pattern, which is itself worth knowing
// LOOKBACK: 7d (set with the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^cmd\.exe$/i
| CommandLine=/\\\\127\.0\.0\.1\\ADMIN\$\\__[0-9]+\.[0-9]+/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, CommandLine])
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.name = * tgt.process.cmdline = *
| limit 5
| columns event.type, tgt.process.name, tgt.process.cmdline

// HUNT: cmd.exe redirecting output to the loopback ADMIN$ share with an underscore-timestamp file name
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1047, T1021.002
// CONF: high | FP: low
// FALSE POSITIVES: none expected; some security assessment tools reproduce the same pattern, which is itself worth knowing
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: cmd.exe whose command line names the loopback ADMIN$ share and an underscore-prefixed numeric file name. The new process is tgt.process.*. The share path is matched with literal backslashes.
// REQUIRES: SentinelOne EDR process-creation telemetry with tgt.process.cmdline populated
// TUNING: None expected; some security assessment tools reproduce the same pattern, which is itself worth knowing.
// LOOKBACK: 7d (set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A command line that reaches the share through a different spelling of the loopback address is not matched.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name in:anycase ('cmd.exe') tgt.process.cmdline matches '\\\\\\\\127\\.0\\.0\\.1\\\\ADMIN\\$\\\\__[0-9]+\\.[0-9]+'
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.cmdline
| sort -event.time
| limit 200

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, ProcessCommandLine
| take 5

// HUNT: cmd.exe redirecting output to the loopback ADMIN$ share with an underscore-timestamp file name
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1047, T1021.002
// CONF: high | FP: low
// FALSE POSITIVES: none expected; some security assessment tools reproduce the same pattern, which is itself worth knowing
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: cmd.exe whose command line names the loopback ADMIN$ share and an underscore-prefixed numeric file name. The share path is matched with literal backslashes.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected; some security assessment tools reproduce the same pattern, which is itself worth knowing.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A command line that reaches the share through a different spelling of the loopback address is not matched.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName =~ "cmd.exe"
| where ProcessCommandLine matches regex @"(?i)\\\\127\.0\.0\.1\\ADMIN\$\\__[0-9]+\.[0-9]+"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine
| sort by Timestamp desc
| take 200

// HUNT: Registry value changes on the AppMgmt service key (ServiceDll, ImagePath, ObjectName, Start)
// MITRE: T1569.002, T1112, T1543.003
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: AsepValueUpdate or RegGenericValueUpdate with RegObjectName, RegValueName and RegStringValue; an immediate set-then-restore may produce two rows seconds apart, which is the signal
// FALSE POSITIVES: Windows servicing, management agents
// TUNING: allowlist the servicing parent processes you observe on real rows; escalate set-then-restore pairs under a minute apart and any ServiceDll or ImagePath value that is not the stock AppMgmt value
// LOOKBACK: 7d (set with the console time picker)
#event_simpleName=/^(AsepValueUpdate|RegGenericValueUpdate)$/
| RegObjectName=/\\Services\\AppMgmt(\\Parameters)?$/i
| RegValueName=/^(ServiceDll|ImagePath|ObjectName|Start)$/i
| table([@timestamp, aid, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, ContextBaseFileName])
| sort(@timestamp, order=desc)

event.type = 'Registry Value Modified' registry.keyPath = * registry.valueName = *
| limit 5
| columns event.type, registry.keyPath, registry.valueName, registry.value

// HUNT: Registry value changes on the AppMgmt service key (ServiceDll, ImagePath, ObjectName, Start)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1569.002, T1112, T1543.003
// CONF: medium | FP: medium
// FALSE POSITIVES: Windows servicing, management agents
// EQUIVALENCE: equivalent-with-schema-assumptions - Same registry predicate: a change to ServiceDll, ImagePath, ObjectName or Start on the AppMgmt service key or its Parameters subkey. The writer is the acting process, src.process.*. The key pattern also accepts a path that ends in the value name.
// REQUIRES: SentinelOne EDR registry telemetry (event type Registry Value Modified) with registry.keyPath, registry.valueName and registry.value populated
// TUNING: Allowlist the servicing parent processes you observe on real rows; escalate set-then-restore pairs under a minute apart and any ServiceDll or ImagePath value that is not the stock AppMgmt value.
// LOOKBACK: 7d (set with the console time picker)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A set-then-restore pair shows as two rows; pairing them by time is left to the analyst.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified' registry.keyPath matches '\\\\Services\\\\AppMgmt(\\\\Parameters)?(\\\\(ServiceDll|ImagePath|ObjectName|Start))?$' registry.valueName in:anycase ('ServiceDll', 'ImagePath', 'ObjectName', 'Start')
| columns event.time, endpoint.name, src.process.user, src.process.name, registry.keyPath, registry.valueName, registry.value
| sort -event.time
| limit 200

DeviceRegistryEvents
| where Timestamp > ago(1d)
| where ActionType == "RegistryValueSet"
| project Timestamp, ActionType, RegistryKey, RegistryValueName
| take 5

// HUNT: Registry value changes on the AppMgmt service key (ServiceDll, ImagePath, ObjectName, Start)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1569.002, T1112, T1543.003
// CONF: medium | FP: medium
// FALSE POSITIVES: Windows servicing, management agents
// EQUIVALENCE: equivalent-with-schema-assumptions - Same registry predicate: a RegistryValueSet of ServiceDll, ImagePath, ObjectName or Start on the AppMgmt service key or its Parameters subkey. The writer is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint registry telemetry (DeviceRegistryEvents)
// TUNING: Allowlist the servicing parent processes you observe on real rows; escalate set-then-restore pairs under a minute apart and any ServiceDll or ImagePath value that is not the stock AppMgmt value.
// LOOKBACK: 7d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A set-then-restore pair shows as two rows; pairing them by time is left to the analyst.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceRegistryEvents
| where Timestamp >= ago(7d)
| where ActionType == "RegistryValueSet"
| where RegistryKey matches regex @"(?i)\\Services\\AppMgmt(\\Parameters)?$"
| where RegistryValueName in~ ("ServiceDll", "ImagePath", "ObjectName", "Start")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData
| sort by Timestamp desc
| take 200