Yoba: Fake ChatGPT and Claude Desktop Apps, Signed-Binary DLL Sideload

// HUNT: Published Yoba sample hashes (YobaDropper, YobaLoader, injected XMRig payload) executed or written
// MITRE: T1204.002, T1574.002, T1496
// CONF: high  FP: low  COST: low
// REQUIRES: process creation with hash (ProcessRollup2, SyntheticProcessRollup2) or executable write with hash (PeFileWritten, NewExecutableWritten)
// FALSE POSITIVES: none expected; each value is a Check Point sample hash of a malicious DLL or of the injected payload
// SOURCE: SHA-1 values copied by script from snapshot 01 (one vendor only, so this is a detect, never a block)
// LOOKBACK: 90d. Set the window with the Falcon time picker.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| in(SHA1HashData, values=[
    "17e8639a00bb32b10cb9cf0d292e9441456ce4bb",
    "20238b36645fc63139a76b19a480c6a9166472fa",
    "4ea5b71202b69fc27b06ef9ee3f6f51d6f7b8586",
    "60aece343959a2e1840f6aaeffa38b73ed21af2c",
    "8777db31d8df78f36e4544a132d843dfb2a0f026",
    "22661f4bada8167fa0f410b75e53184998990abb",
    "2ecb5548e9774a3d05e8669e8414dcc366929b79",
    "3fef1af3664429e621d3e0f9408cb5102ef02b84",
    "55043ea6d102670c014e2be5a8197e70b7c201cb",
    "79e87a6df59d68b2dbd2c43950df5663d671007c",
    "7dfcee02732ed89f1ddf25d1689863c26de3df15",
    "bead5748d813a9828ddb7603a32e52aa15349768",
    "cf90c4599257e76984a199d98b1fd082b820a54d",
    "eeedc5c9007d7f01808285e0ae0c0b451bdba003",
    "ea16728f6928dc77deaddee74a6e736dd5f24fc5"
  ], ignoreCase=true)
| table([@timestamp, aid, ComputerName, UserName, #event_simpleName, FileName, ImageFileName, TargetFileName, SHA1HashData, ParentBaseFileName, ContextBaseFileName, CommandLine], limit=500)
| sort(@timestamp, order=desc)

tgt.process.image.sha1 = *
| limit 5
| columns event.time, tgt.process.image.sha1, tgt.file.sha1

// HUNT: Published Yoba sample hashes (YobaDropper, YobaLoader, injected XMRig payload) executed or written
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.002, T1574.002, T1496
// CONF: high | FP: low
// FALSE POSITIVES: none expected; each value is a Check Point sample hash of a malicious DLL or of the injected payload
// EQUIVALENCE: equivalent-with-schema-assumptions - Same published SHA-1 set matched case-insensitively against the hash of a started process or of a written file. The CQL's execution events map to Process Creation image hashes and its executable-write events map to File Creation and File Modification hashes.
// REQUIRES: SentinelOne endpoint telemetry with process image SHA-1 and file SHA-1 populated
// TUNING: None expected: every value is a published sample hash. Ship it as a detect; a miss does not clear a host.
// LOOKBACK: 90d; set the console time picker or query window
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: A sample that is neither started nor written during the window, or whose hash the sensor did not record, is not captured.
// VALIDATION LEVEL: static-reviewed
tgt.process.image.sha1 in:anycase ('17e8639a00bb32b10cb9cf0d292e9441456ce4bb', '20238b36645fc63139a76b19a480c6a9166472fa', '4ea5b71202b69fc27b06ef9ee3f6f51d6f7b8586', '60aece343959a2e1840f6aaeffa38b73ed21af2c', '8777db31d8df78f36e4544a132d843dfb2a0f026', '22661f4bada8167fa0f410b75e53184998990abb', '2ecb5548e9774a3d05e8669e8414dcc366929b79', '3fef1af3664429e621d3e0f9408cb5102ef02b84', '55043ea6d102670c014e2be5a8197e70b7c201cb', '79e87a6df59d68b2dbd2c43950df5663d671007c', '7dfcee02732ed89f1ddf25d1689863c26de3df15', 'bead5748d813a9828ddb7603a32e52aa15349768', 'cf90c4599257e76984a199d98b1fd082b820a54d', 'eeedc5c9007d7f01808285e0ae0c0b451bdba003', 'ea16728f6928dc77deaddee74a6e736dd5f24fc5') or tgt.file.sha1 in:anycase ('17e8639a00bb32b10cb9cf0d292e9441456ce4bb', '20238b36645fc63139a76b19a480c6a9166472fa', '4ea5b71202b69fc27b06ef9ee3f6f51d6f7b8586', '60aece343959a2e1840f6aaeffa38b73ed21af2c', '8777db31d8df78f36e4544a132d843dfb2a0f026', '22661f4bada8167fa0f410b75e53184998990abb', '2ecb5548e9774a3d05e8669e8414dcc366929b79', '3fef1af3664429e621d3e0f9408cb5102ef02b84', '55043ea6d102670c014e2be5a8197e70b7c201cb', '79e87a6df59d68b2dbd2c43950df5663d671007c', '7dfcee02732ed89f1ddf25d1689863c26de3df15', 'bead5748d813a9828ddb7603a32e52aa15349768', 'cf90c4599257e76984a199d98b1fd082b820a54d', 'eeedc5c9007d7f01808285e0ae0c0b451bdba003', 'ea16728f6928dc77deaddee74a6e736dd5f24fc5')
| sort -event.time
| limit 500
| columns event.time, endpoint.name, event.type, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.image.sha1, tgt.process.cmdline, tgt.file.path, tgt.file.sha1

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, SHA1, FileName, FolderPath
| take 5

// HUNT: Published Yoba sample hashes (YobaDropper, YobaLoader, injected XMRig payload) executed or written
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.002, T1574.002, T1496
// CONF: high | FP: low
// FALSE POSITIVES: none expected; each value is a Check Point sample hash of a malicious DLL or of the injected payload
// EQUIVALENCE: approximate-analytic - The same published SHA-1 set is matched against files written or modified on the device. The CQL also matches started processes; one Advanced Hunting query reads one table, so the process-start half is left to the CQL tab.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents) with SHA1 populated
// TUNING: None expected: every value is a published sample hash. Ship it as a detect; a miss does not clear a host.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A sample that is started but never written to disk in the window is not captured: the CQL's process-start hash match has no place in a single-table query. Advanced Hunting keeps 30 days; the CQL tab covers 90 days.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where SHA1 in~ ("17e8639a00bb32b10cb9cf0d292e9441456ce4bb", "20238b36645fc63139a76b19a480c6a9166472fa", "4ea5b71202b69fc27b06ef9ee3f6f51d6f7b8586", "60aece343959a2e1840f6aaeffa38b73ed21af2c", "8777db31d8df78f36e4544a132d843dfb2a0f026", "22661f4bada8167fa0f410b75e53184998990abb", "2ecb5548e9774a3d05e8669e8414dcc366929b79", "3fef1af3664429e621d3e0f9408cb5102ef02b84", "55043ea6d102670c014e2be5a8197e70b7c201cb", "79e87a6df59d68b2dbd2c43950df5663d671007c", "7dfcee02732ed89f1ddf25d1689863c26de3df15", "bead5748d813a9828ddb7603a32e52aa15349768", "cf90c4599257e76984a199d98b1fd082b820a54d", "eeedc5c9007d7f01808285e0ae0c0b451bdba003", "ea16728f6928dc77deaddee74a6e736dd5f24fc5")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, ActionType, FileName, FolderPath, SHA1, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
| take 500

// HUNT: Setup.exe and winmm.dll seen together in a user-writable path on one host (Yoba DLL sideload pairing)
// MITRE: T1574.002, T1204.002
// CONF: medium  FP: medium  COST: medium
// REQUIRES: process creation (ProcessRollup2) and executable write (PeFileWritten, NewExecutableWritten)
// FALSE POSITIVES: games and audio tools that ship their own winmm.dll next to an installer named Setup.exe; software packagers staging both files
// TUNING: exclude a reviewed installer by full path, for example | path_seen!=/\\YourVendorFolder\\/i ; then require a hit from Q3 or Q4 before escalating. Grouping is per host, not per folder, so read the collected paths to confirm the two files share a folder.
// LOOKBACK: 30d. Set the window with the Falcon time picker.
#event_simpleName=/^(ProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| FileName=/^(winmm\.dll|setup\.exe)$/i
| path_seen := coalesce([TargetFileName, ImageFileName])
| path_seen=/\\(Users|ProgramData)\\/i
| path_seen!=/\\(Windows|Program Files)\\/i
| lower(FileName, as=NameLc)
| groupBy([aid, ComputerName], function=[count(NameLc, distinct=true, as=distinct_names), collect([path_seen]), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=1000)
| distinct_names = 2
| table([ComputerName, aid, distinct_names, path_seen, FirstSeen, LastSeen], limit=200)

event.type = 'Process Creation' tgt.process.image.path = *
| limit 5
| columns event.time, event.type, endpoint.name, agent.uuid, tgt.process.image.path, tgt.file.path

// HUNT: Setup.exe and winmm.dll seen together in a user-writable path on one host (Yoba DLL sideload pairing)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002, T1204.002
// CONF: medium | FP: medium
// FALSE POSITIVES: games and audio tools that ship their own winmm.dll next to an installer named Setup.exe; software packagers staging both files
// EQUIVALENCE: approximate-analytic - Same pairing logic: a host that started or wrote setup.exe and wrote winmm.dll in a per-user or ProgramData folder, outside the Windows and Program Files folders. PowerQuery has no collect aggregate, so the paths are one sample each rather than the full set.
// REQUIRES: SentinelOne process creation and file creation telemetry with image and file paths
// TUNING: Exclude a reviewed installer by full path with a further negated matches clause, then require a hit from the next two cards before escalating. Grouping is per host, not per folder, so read the sample paths to confirm the two files share a folder.
// LOOKBACK: 30d; set the console time picker or query window
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: The path is a single sample per host (no collect aggregate), so a host with several folders shows only one of them.
// VALIDATION LEVEL: static-reviewed
event.type in ('Process Creation', 'File Creation', 'File Modification')
(tgt.process.image.path matches ('\\\\setup\\.exe$', '\\\\winmm\\.dll$') or tgt.file.path matches ('\\\\setup\\.exe$', '\\\\winmm\\.dll$'))
(tgt.process.image.path contains ('\\Users\\', '\\ProgramData\\') or tgt.file.path contains ('\\Users\\', '\\ProgramData\\'))
!(tgt.process.image.path contains ('\\Windows\\', '\\Program Files\\') or tgt.file.path contains ('\\Windows\\', '\\Program Files\\'))
| group setup_runs=count(tgt.process.image.path matches '\\\\setup\\.exe$'), setup_writes=count(tgt.file.path matches '\\\\setup\\.exe$'), dll_writes=count(tgt.file.path matches '\\\\winmm\\.dll$'), first_seen=min(event.time), last_seen=max(event.time), process_sample=any(tgt.process.image.path), file_sample=any(tgt.file.path) by endpoint.name, agent.uuid
| filter dll_writes > 0 and (setup_runs > 0 or setup_writes > 0)
| sort -last_seen
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath
| take 5

// HUNT: Setup.exe and winmm.dll seen together in a user-writable path on one host (Yoba DLL sideload pairing)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.002, T1204.002
// CONF: medium | FP: medium
// FALSE POSITIVES: games and audio tools that ship their own winmm.dll next to an installer named Setup.exe; software packagers staging both files
// EQUIVALENCE: approximate-analytic - Same pairing logic over file events only: a device that wrote both setup.exe and winmm.dll in a per-user or ProgramData folder, outside Windows and Program Files. The CQL also counts a started Setup.exe; one query reads one table, so the process-start half is left to the CQL tab.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: Exclude a reviewed installer by FolderPath after a baseline review, then require a hit from the next two cards before escalating. Grouping is per device, so read the collected paths to confirm the two files share a folder.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A Setup.exe that is started but whose file write is outside the window is not counted.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("winmm.dll", "setup.exe")
| where FolderPath contains "\\Users\\" or FolderPath contains "\\ProgramData\\"
| where FolderPath !contains "\\Windows\\" and FolderPath !contains "\\Program Files\\"
| extend NameLc = tolower(FileName)
| summarize DistinctNames = dcount(NameLc), Paths = make_set(FolderPath, 20), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName
| where DistinctNames == 2
| project DeviceName, DeviceId, DistinctNames, Paths, FirstSeen, LastSeen
| sort by LastSeen desc
| take 200

// HUNT: winmm.dll written outside the Windows system folders by an archiver, Explorer or a browser (ZIP from a GitHub release unpacked)
// MITRE: T1574.002, T1204.002
// CONF: medium  FP: medium  COST: low
// REQUIRES: executable write with writer process (PeFileWritten, NewExecutableWritten)
// FALSE POSITIVES: game mods and audio wrappers unpacked by Explorer or an archiver; legitimate winmm.dll is only in the Windows system folders
// TUNING: exclude a reviewed game or tool folder by full path, for example | TargetFileName!=/\\YourGameFolder\\/i . The bare file name winmm.dll is a real Windows DLL name, so never alert on the name alone; the user-path and writer-process conditions are what make this useful.
// LOOKBACK: 30d. Set the window with the Falcon time picker.
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| FileName=/^winmm\.dll$/i
| TargetFileName=/\\(Users|ProgramData)\\/i
| TargetFileName!=/\\Windows\\(System32|SysWOW64|WinSxS)\\/i
| ContextBaseFileName=/^(explorer|7zfm|7zg|7z|winrar|winzip32|winzip64|peazip|bandizip|tar|chrome|msedge|firefox|brave)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA1HashData, SHA256HashData], limit=500)
| sort(@timestamp, order=desc)

event.type = 'File Creation' tgt.file.path = *
| limit 5
| columns event.time, event.type, src.process.name, tgt.file.path

// HUNT: winmm.dll written outside the Windows system folders by an archiver, Explorer or a browser (ZIP from a GitHub release unpacked)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002, T1204.002
// CONF: medium | FP: medium
// FALSE POSITIVES: game mods and audio wrappers unpacked by Explorer or an archiver; legitimate winmm.dll is only in the Windows system folders
// EQUIVALENCE: equivalent-with-schema-assumptions - Same executable-write predicate: winmm.dll written under a per-user or ProgramData folder, outside the Windows system folders, by an archiver, Explorer or a browser. On a file event the writer is src.process.*.
// REQUIRES: SentinelOne file creation telemetry with the writing process name
// TUNING: Exclude a reviewed game or tool folder by full path with a further negated contains clause. The bare file name is a real Windows DLL name, so never alert on the name alone.
// LOOKBACK: 30d; set the console time picker or query window
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: A DLL written by a process outside the listed writer names is not captured.
// VALIDATION LEVEL: static-reviewed
event.type in ('File Creation', 'File Modification')
tgt.file.path matches '\\\\winmm\\.dll$'
tgt.file.path contains ('\\Users\\', '\\ProgramData\\')
!(tgt.file.path contains ('\\Windows\\System32\\', '\\Windows\\SysWOW64\\', '\\Windows\\WinSxS\\'))
src.process.name in:anycase ('explorer.exe', '7zfm.exe', '7zg.exe', '7z.exe', 'winrar.exe', 'winzip32.exe', 'winzip64.exe', 'peazip.exe', 'bandizip.exe', 'tar.exe', 'chrome.exe', 'msedge.exe', 'firefox.exe', 'brave.exe')
| sort -event.time
| limit 500
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.file.path, tgt.file.sha1, tgt.file.sha256

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath, InitiatingProcessFileName
| take 5

// HUNT: winmm.dll written outside the Windows system folders by an archiver, Explorer or a browser (ZIP from a GitHub release unpacked)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.002, T1204.002
// CONF: medium | FP: medium
// FALSE POSITIVES: game mods and audio wrappers unpacked by Explorer or an archiver; legitimate winmm.dll is only in the Windows system folders
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate on file events: winmm.dll written or modified under a per-user or ProgramData folder, outside the Windows system folders, by an archiver, Explorer or a browser. The writer is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: Exclude a reviewed game or tool folder by FolderPath after a baseline review. The bare file name is a real Windows DLL name, so never alert on the name alone.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A DLL written by a process outside the listed writer names is not captured. SHA256 is often unpopulated in DeviceFileEvents; SHA1 is the safer pivot.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where ActionType in ("FileCreated", "FileModified")
| where FileName =~ "winmm.dll"
| where FolderPath contains "\\Users\\" or FolderPath contains "\\ProgramData\\"
| where FolderPath !contains "\\Windows\\System32\\" and FolderPath !contains "\\Windows\\SysWOW64\\" and FolderPath !contains "\\Windows\\WinSxS\\"
| where InitiatingProcessFileName in~ ("explorer.exe", "7zfm.exe", "7zg.exe", "7z.exe", "winrar.exe", "winzip32.exe", "winzip64.exe", "peazip.exe", "bandizip.exe", "tar.exe", "chrome.exe", "msedge.exe", "firefox.exe", "brave.exe")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FolderPath, SHA1, SHA256
| sort by Timestamp desc
| take 500

// HUNT: Setup.exe launched from a ZIP extraction folder, Downloads or Desktop, or from a folder named after a Yoba lure ZIP
// MITRE: T1204.002, T1574.002
// CONF: low  FP: high  COST: low
// REQUIRES: process creation with image path, parent and hash (ProcessRollup2, SyntheticProcessRollup2)
// FALSE POSITIVES: any legitimate installer named Setup.exe that a user runs from Downloads or an unpacked ZIP; this is a triage lead, not an alert
// TUNING: join the hit to Q3 on the same aid and folder before escalating; exclude installers whose SHA1HashData matches an approved package, for example | SHA1HashData!=/^(REPLACE_WITH_APPROVED_SHA1)$/i ; the two signed binaries Check Point lists are legitimate vendor files, so their hashes alone are not a verdict.
// LOOKBACK: 30d. Set the window with the Falcon time picker.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^setup\.exe$/i
| ImageFileName=/\\(Downloads|Desktop)\\|\\Temp\\Temp[0-9]+_[^\\]+\.zip\\|\\(sol-setup|gpt-6-astra-setup|setup-claude)\\/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SHA1HashData], limit=500)
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.name = *
| limit 5
| columns event.time, event.type, tgt.process.name, tgt.process.image.path

// HUNT: Setup.exe launched from a ZIP extraction folder, Downloads or Desktop, or from a folder named after a Yoba lure ZIP
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1204.002, T1574.002
// CONF: low | FP: high
// FALSE POSITIVES: any legitimate installer named Setup.exe that a user runs from Downloads or an unpacked ZIP; this is a triage lead, not an alert
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: setup.exe started from a Downloads or Desktop folder, a ZIP extraction folder, or a folder named after a lure ZIP. On Process Creation the started process is tgt.process.* and its creator is src.process.*.
// REQUIRES: SentinelOne process creation telemetry with image path and command line
// TUNING: Join the hit to the previous card on the same host and folder before escalating; exclude installers whose tgt.process.image.sha1 matches an approved package. The two signed binaries the report lists are legitimate vendor files, so their hashes alone are not a verdict.
// LOOKBACK: 30d; set the console time picker or query window
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: Low confidence and high false-positive risk, as on the CQL tab: a triage lead, not an alert.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.name in:anycase ('setup.exe')
tgt.process.image.path matches ('\\\\(Downloads|Desktop)\\\\', '\\\\Temp\\\\Temp[0-9]+_[^\\\\]+\\.zip\\\\', '\\\\(sol-setup|gpt-6-astra-setup|setup-claude)\\\\')
| sort -event.time
| limit 500
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha1

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath, ProcessCommandLine
| take 5

// HUNT: Setup.exe launched from a ZIP extraction folder, Downloads or Desktop, or from a folder named after a Yoba lure ZIP
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1204.002, T1574.002
// CONF: low | FP: high
// FALSE POSITIVES: any legitimate installer named Setup.exe that a user runs from Downloads or an unpacked ZIP; this is a triage lead, not an alert
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: setup.exe started from a Downloads or Desktop folder, a ZIP extraction folder, or a folder named after a lure ZIP. The created process is FileName and FolderPath; its creator is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Join the hit to the previous card on the same device and folder before escalating; exclude installers whose SHA1 matches an approved package.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Low confidence and high false-positive risk, as on the CQL tab: a triage lead, not an alert.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName =~ "setup.exe"
| where FolderPath matches regex @"(?i)\\(Downloads|Desktop)\\|\\Temp\\Temp[0-9]+_[^\\]+\.zip\\|\\(sol-setup|gpt-6-astra-setup|setup-claude)\\"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FolderPath, ProcessCommandLine, SHA1
| sort by Timestamp desc
| take 500

// HUNT: WMPDMC.exe copy or wmpdui.dll written or run outside the Windows system and Media Player folders (YobaLoader sideload host)
// MITRE: T1574.002, T1036.005, T1053.005
// CONF: high  FP: low  COST: low
// REQUIRES: process creation (ProcessRollup2, SyntheticProcessRollup2) and executable write (PeFileWritten, NewExecutableWritten)
// FALSE POSITIVES: very few; a portable media-player kit or a lab copy of the Windows file. Both names are real Windows files, so the folder condition is the signal, never the name.
// SOURCE: Check Point (snapshot 01): the dropper copies WMPDMC.exe from System32 into ProgramData\WMProcess and writes the loader there as wmpdui.dll
// LOOKBACK: 90d. Set the window with the Falcon time picker.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| FileName=/^(wmpdmc\.exe|wmpdui\.dll)$/i
| path_seen := coalesce([ImageFileName, TargetFileName])
| path_seen!=/\\Windows\\(System32|SysWOW64|WinSxS)\\/i
| path_seen!=/\\Program Files( \(x86\))?\\Windows Media Player\\/i
| table([@timestamp, aid, ComputerName, UserName, #event_simpleName, FileName, path_seen, ParentBaseFileName, ContextBaseFileName, SHA1HashData], limit=500)
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.image.path = *
| limit 5
| columns event.time, event.type, tgt.process.image.path, tgt.file.path

// HUNT: WMPDMC.exe copy or wmpdui.dll written or run outside the Windows system and Media Player folders (YobaLoader sideload host)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002, T1036.005, T1053.005
// CONF: high | FP: low
// FALSE POSITIVES: very few; a portable media-player kit or a lab copy of the Windows file. Both names are real Windows files, so the folder condition is the signal, never the name.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same predicate: wmpdmc.exe or wmpdui.dll started or written outside the Windows system and Media Player folders. A started process is tgt.process.* on Process Creation; a written file is tgt.file.* on File Creation and File Modification.
// REQUIRES: SentinelOne process creation and file creation telemetry with paths
// TUNING: Both names are real Windows files, so the folder condition is the signal, never the name. Exclude a reviewed portable media-player kit by full path.
// LOOKBACK: 90d; set the console time picker or query window
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: A wmpdui.dll that is loaded but neither written nor started in the window is not captured.
// VALIDATION LEVEL: static-reviewed
((event.type = 'Process Creation' and tgt.process.image.path matches ('\\\\wmpdmc\\.exe$', '\\\\wmpdui\\.dll$')) or (event.type in ('File Creation', 'File Modification') and tgt.file.path matches ('\\\\wmpdmc\\.exe$', '\\\\wmpdui\\.dll$')))
!(tgt.process.image.path contains ('\\Windows\\System32\\', '\\Windows\\SysWOW64\\', '\\Windows\\WinSxS\\', '\\Program Files\\Windows Media Player\\', '\\Program Files (x86)\\Windows Media Player\\') or tgt.file.path contains ('\\Windows\\System32\\', '\\Windows\\SysWOW64\\', '\\Windows\\WinSxS\\', '\\Program Files\\Windows Media Player\\', '\\Program Files (x86)\\Windows Media Player\\'))
| sort -event.time
| limit 500
| columns event.time, endpoint.name, src.process.user, event.type, tgt.process.image.path, tgt.file.path, src.process.name, tgt.process.image.sha1, tgt.file.sha1

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath, InitiatingProcessFileName
| take 5

// HUNT: WMPDMC.exe copy or wmpdui.dll written or run outside the Windows system and Media Player folders (YobaLoader sideload host)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.002, T1036.005, T1053.005
// CONF: high | FP: low
// FALSE POSITIVES: very few; a portable media-player kit or a lab copy of the Windows file. Both names are real Windows files, so the folder condition is the signal, never the name.
// EQUIVALENCE: approximate-analytic - Same folder-based predicate over file events: wmpdmc.exe or wmpdui.dll written outside the Windows system and Media Player folders. The CQL also matches a started process; one query reads one table, so the process-start half is left to the CQL tab.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: Both names are real Windows files, so the folder condition is the signal, never the name. Exclude a reviewed portable media-player kit by FolderPath.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A copy of wmpdmc.exe that is started but whose write is outside the window is not captured. Advanced Hunting keeps 30 days; the CQL tab covers 90 days.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("wmpdmc.exe", "wmpdui.dll")
| where FolderPath !contains "\\Windows\\System32\\" and FolderPath !contains "\\Windows\\SysWOW64\\" and FolderPath !contains "\\Windows\\WinSxS\\"
| where FolderPath !contains "\\Program Files\\Windows Media Player\\" and FolderPath !contains "\\Program Files (x86)\\Windows Media Player\\"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, ActionType, FileName, FolderPath, InitiatingProcessFileName, SHA1
| sort by Timestamp desc
| take 500

// HUNT: Scheduled task registered to launch WMPDMC.exe from ProgramData\WMProcess (YobaDropper persistence)
// MITRE: T1053.005, T1036.005
// CONF: high  FP: low  COST: low
// REQUIRES: scheduled task registration with task executable (ScheduledTaskRegistered)
// FALSE POSITIVES: none expected; no Windows component registers a task for a WMPDMC.exe outside System32
// SOURCE: Check Point (snapshot 01): task author set to Microsoft Corporation, runs as Local System, boot trigger delayed 3 minutes (PT3M)
// LOOKBACK: 90d. Set the window with the Falcon time picker.
#event_simpleName=ScheduledTaskRegistered
| TaskExecutable=/\\ProgramData\\WMProcess\\|%ProgramData%\\WMProcess\\|\\wmpdmc\.exe$/i
| TaskExecutable!=/^(C:)?\\Windows\\System32\\wmpdmc\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, TaskName, TaskExecutable, TaskAuthor], limit=500)
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.image.path = *
| limit 5
| columns event.time, event.type, tgt.process.image.path

// HUNT: Scheduled task registered to launch WMPDMC.exe from ProgramData\WMProcess (YobaDropper persistence)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1053.005, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected; no Windows component registers a task for a WMPDMC.exe outside System32
// EQUIVALENCE: telemetry-gap - No task-registration event is attested for SentinelOne here, so this is a partial pivot: it finds wmpdmc.exe started from the ProgramData WMProcess folder, which is what the registered task eventually runs. The registration itself, its author and its boot trigger are not visible.
// REQUIRES: SentinelOne process creation telemetry with image path
// TUNING: None expected: no Windows component runs wmpdmc.exe from outside System32. Read the creator in src.process.name to see whether the task scheduler started it.
// LOOKBACK: 90d; set the console time picker or query window
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: The task registration, the author field and the delayed boot trigger are not visible; a task that never fires in the window is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
tgt.process.image.path matches ('\\\\ProgramData\\\\WMProcess\\\\', '\\\\wmpdmc\\.exe$')
!(tgt.process.image.path matches '^(C:)?\\\\Windows\\\\System32\\\\wmpdmc\\.exe$')
| sort -event.time
| limit 500
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha1

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath, ProcessCommandLine
| take 5

// HUNT: Scheduled task registered to launch WMPDMC.exe from ProgramData\WMProcess (YobaDropper persistence)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1053.005, T1036.005
// CONF: high | FP: low
// FALSE POSITIVES: none expected; no Windows component registers a task for a WMPDMC.exe outside System32
// EQUIVALENCE: telemetry-gap - Defender Advanced Hunting has no scheduled-task registration table with a task executable, so this is a partial pivot: it finds wmpdmc.exe started from the ProgramData WMProcess folder, which is what the registered task eventually runs. The registration itself is not visible.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: None expected: no Windows component runs wmpdmc.exe from outside System32. Read InitiatingProcessFileName to see whether the task scheduler started it.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The task registration, the author field and the delayed boot trigger are not visible. Advanced Hunting keeps 30 days; the CQL tab covers 90 days.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FolderPath contains "\\ProgramData\\WMProcess\\" or FileName =~ "wmpdmc.exe"
| where FolderPath !~ "C:\\Windows\\System32\\wmpdmc.exe"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FolderPath, ProcessCommandLine, SHA1
| sort by Timestamp desc
| take 500

// HUNT: One non-browser process resolving two or more of t.me, dns.google and files.catbox.moe (YobaLoader Telegram, DoH, Catbox chain)
// MITRE: T1102.001, T1071.004, T1105
// CONF: medium  FP: medium  COST: medium
// REQUIRES: DNS lookup with requesting process name (DnsRequest)
// FALSE POSITIVES: chat clients, download managers and developer tools that use Telegram, Google DNS-over-HTTPS or Catbox legitimately
// TUNING: add the reviewed process to the exclusion list, for example | ContextBaseFileName!=/^(YourChatClient)\.exe$/i ; raise the threshold to three distinct names to cut noise further. Q12 is the higher-fidelity variant for the WMPDMC.exe host.
// LOOKBACK: 30d. Set the window with the Falcon time picker.
#event_simpleName=DnsRequest
| DomainName=/^(t\.me|dns\.google|files\.catbox\.moe)$/i
| ContextBaseFileName!=/^(chrome|msedge|msedgewebview2|firefox|brave|opera|vivaldi|iexplore|telegram|teams|slack|discord|code)\.exe$/i
| lower(DomainName, as=Svc)
| groupBy([aid, ComputerName, ContextBaseFileName], function=[count(Svc, distinct=true, as=ServicesSeen), collect([DomainName]), count(as=Lookups), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=1000)
| ServicesSeen >= 2
| table([ComputerName, aid, ContextBaseFileName, ServicesSeen, DomainName, Lookups, FirstSeen, LastSeen], limit=200)

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, event.type, endpoint.name, agent.uuid, src.process.name, event.dns.request

// HUNT: One non-browser process resolving two or more of t.me, dns.google and files.catbox.moe (YobaLoader Telegram, DoH, Catbox chain)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1102.001, T1071.004, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: chat clients, download managers and developer tools that use Telegram, Google DNS-over-HTTPS or Catbox legitimately
// EQUIVALENCE: equivalent-with-schema-assumptions - Same logic: per host and per resolving process, count the distinct services among t.me, dns.google and files.catbox.moe, excluding the browsers and chat clients, and keep two or more. On a DNS event the resolving process is src.process.*.
// REQUIRES: SentinelOne DNS Resolved telemetry with the resolving process name
// TUNING: Add a reviewed process to the exclusion list with a further name in the in:anycase list; raise the threshold to three distinct names to cut noise. The WMPDMC-specific card is the higher-fidelity variant.
// LOOKBACK: 30d; set the console time picker or query window
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: Only one of the matching names is shown per row; the count of distinct services is exact.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved'
event.dns.request in:anycase ('t.me', 'dns.google', 'files.catbox.moe')
!(src.process.name in:anycase ('chrome.exe', 'msedge.exe', 'msedgewebview2.exe', 'firefox.exe', 'brave.exe', 'opera.exe', 'vivaldi.exe', 'iexplore.exe', 'telegram.exe', 'teams.exe', 'slack.exe', 'discord.exe', 'code.exe'))
| group services_seen=estimate_distinct(event.dns.request), lookups=count(), domain_sample=any(event.dns.request), first_seen=min(event.time), last_seen=max(event.time) by endpoint.name, agent.uuid, src.process.name
| filter services_seen >= 2
| sort -last_seen
| limit 200

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields, InitiatingProcessFileName
| take 5

// HUNT: One non-browser process resolving two or more of t.me, dns.google and files.catbox.moe (YobaLoader Telegram, DoH, Catbox chain)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1102.001, T1071.004, T1105
// CONF: medium | FP: medium
// FALSE POSITIVES: chat clients, download managers and developer tools that use Telegram, Google DNS-over-HTTPS or Catbox legitimately
// EQUIVALENCE: equivalent-with-schema-assumptions - Same logic over DnsQueryResponse events in DeviceEvents: per device and process, count the distinct services among t.me, dns.google and files.catbox.moe, excluding the browsers and chat clients, and keep two or more. The name is read from AdditionalFields because Defender has no endpoint DNS table.
// REQUIRES: Defender for Endpoint DNS events (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: Add a reviewed process to the exclusion list; raise the threshold to three distinct names to cut noise.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: DnsQueryResponse events are not recorded for every resolver path, so a lookup the sensor did not log is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| extend DnsName = tolower(tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"])))
| where DnsName in ("t.me", "dns.google", "files.catbox.moe")
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "msedgewebview2.exe", "firefox.exe", "brave.exe", "opera.exe", "vivaldi.exe", "iexplore.exe", "telegram.exe", "teams.exe", "slack.exe", "discord.exe", "code.exe")
| summarize ServicesSeen = dcount(DnsName), Lookups = count(), DomainsSeen = make_set(DnsName), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName, InitiatingProcessFileName
| where ServicesSeen >= 2
| project DeviceName, DeviceId, InitiatingProcessFileName, ServicesSeen, DomainsSeen, Lookups, FirstSeen, LastSeen
| sort by LastSeen desc
| take 200

// HUNT: Lookup of a domain built from the Yoba DGA word lists under dedyn.io, or the early-variant aber.ir suffix, or the one reported sample domain
// MITRE: T1568.002, T1102.001
// CONF: medium  FP: low  COST: low
// REQUIRES: DNS lookup with requesting process name (DnsRequest)
// FALSE POSITIVES: near none; the pattern needs three specific dictionary words and a number under a dynamic-DNS suffix. The operator can change the word lists, so a miss does not clear a host.
// SOURCE: word lists and name format from the DGA snippet in Check Point (snapshot 01); calm-piano-floats-313 is the one sample the report lists
// LOOKBACK: 90d. Set the window with the Falcon time picker.
#event_simpleName=DnsRequest
| DomainName=/^(silver|amber|wild|tiny|brave|lucky|calm|sharp|swift|bright|quiet|bold|gentle|fierce|royal|mystic|username|degenerate|allblack|kizta|graf)-(tiger|river|stone|cloud|wolf|ocean|forest|mountain|eagle|raven|ember|comet|fox|dragon|piano|viper|yoba|yyoba|static|cpp|example)-(runs|jumps|sings|sleeps|flies|hunts|burns|floats|shines|whispers|roars|dreams|strikes|glides|watches|hides|duty|free)-[0-9]{1,3}\.(dedyn\.io|aber\.ir)$/i
| table([@timestamp, aid, ComputerName, UserName, DomainName, ContextBaseFileName], limit=500)
| sort(@timestamp, order=desc)

event.type = 'DNS Resolved' event.dns.request = *
| limit 5
| columns event.time, event.type, src.process.name, event.dns.request

// HUNT: Lookup of a domain built from the Yoba DGA word lists under dedyn.io, or the early-variant aber.ir suffix, or the one reported sample domain
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1568.002, T1102.001
// CONF: medium | FP: low
// FALSE POSITIVES: near none; the pattern needs three specific dictionary words and a number under a dynamic-DNS suffix. The operator can change the word lists, so a miss does not clear a host.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same anchored name pattern: three dictionary words and a one to three digit number under dedyn.io or aber.ir, matched against the DNS request name.
// REQUIRES: SentinelOne DNS Resolved telemetry with the requested name
// TUNING: Near none expected. The operator can change the word lists, so a miss does not clear a host.
// LOOKBACK: 90d; set the console time picker or query window
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: A domain built from word lists outside the reported ones is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'DNS Resolved'
event.dns.request matches '^(silver|amber|wild|tiny|brave|lucky|calm|sharp|swift|bright|quiet|bold|gentle|fierce|royal|mystic|username|degenerate|allblack|kizta|graf)-(tiger|river|stone|cloud|wolf|ocean|forest|mountain|eagle|raven|ember|comet|fox|dragon|piano|viper|yoba|yyoba|static|cpp|example)-(runs|jumps|sings|sleeps|flies|hunts|burns|floats|shines|whispers|roars|dreams|strikes|glides|watches|hides|duty|free)-[0-9]{1,3}\\.(dedyn\\.io|aber\\.ir)$'
| sort -event.time
| limit 500
| columns event.time, endpoint.name, src.process.user, src.process.name, event.dns.request

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields
| take 5

// HUNT: Lookup of a domain built from the Yoba DGA word lists under dedyn.io, or the early-variant aber.ir suffix, or the one reported sample domain
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1568.002, T1102.001
// CONF: medium | FP: low
// FALSE POSITIVES: near none; the pattern needs three specific dictionary words and a number under a dynamic-DNS suffix. The operator can change the word lists, so a miss does not clear a host.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same anchored name pattern over DnsQueryResponse events in DeviceEvents: three dictionary words and a one to three digit number under dedyn.io or aber.ir. The name is read from AdditionalFields because Defender has no endpoint DNS table.
// REQUIRES: Defender for Endpoint DNS events (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: Near none expected. The operator can change the word lists, so a miss does not clear a host.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days; the CQL tab covers 90 days. A domain built from word lists outside the reported ones is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| extend DnsName = tolower(tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"])))
| where DnsName matches regex @"(?i)^(silver|amber|wild|tiny|brave|lucky|calm|sharp|swift|bright|quiet|bold|gentle|fierce|royal|mystic|username|degenerate|allblack|kizta|graf)-(tiger|river|stone|cloud|wolf|ocean|forest|mountain|eagle|raven|ember|comet|fox|dragon|piano|viper|yoba|yyoba|static|cpp|example)-(runs|jumps|sings|sleeps|flies|hunts|burns|floats|shines|whispers|roars|dreams|strikes|glides|watches|hides|duty|free)-[0-9]{1,3}\.(dedyn\.io|aber\.ir)$"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, DnsName
| sort by Timestamp desc
| take 500

// HUNT: Outbound connection to the two obfs4 Tor bridge addresses reported for the Yoba XMRig payload
// MITRE: T1090.003, T1573.002, T1496
// CONF: high  FP: low  COST: low
// REQUIRES: outbound connection with process name (NetworkConnectIP4)
// FALSE POSITIVES: none expected; both addresses are listed as the payload's bridge configuration in Check Point (snapshot 01). Bridge addresses rotate, so absence of a hit is weak evidence.
// LOOKBACK: 90d. Set the window with the Falcon time picker.
#event_simpleName=NetworkConnectIP4
| in(RemoteAddressIP4, values=["51.89.231.85", "51.89.228.250"])
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort, LocalPort], limit=500)
| sort(@timestamp, order=desc)

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.time, event.type, src.process.name, dst.ip.address

// HUNT: Outbound connection to the two obfs4 Tor bridge addresses reported for the Yoba XMRig payload
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1090.003, T1573.002, T1496
// CONF: high | FP: low
// FALSE POSITIVES: none expected; both addresses are listed as the payload's bridge configuration in Check Point (snapshot 01). Bridge addresses rotate, so absence of a hit is weak evidence.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same indicator match: an outbound connection whose destination is one of the two reported Tor bridge addresses. The connecting process is src.process.* on an IP Connect event.
// REQUIRES: SentinelOne IP Connect telemetry with the connecting process name
// TUNING: None expected. Bridge addresses rotate, so absence of a hit is weak evidence.
// LOOKBACK: 90d; set the console time picker or query window
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: Only the two reported addresses are matched; rotated bridges are not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect'
dst.ip.address in ('51.89.231.85', '51.89.228.250')
| sort -event.time
| limit 500
| columns event.time, endpoint.name, src.process.user, src.process.name, dst.ip.address, dst.port.number, src.port.number

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, RemoteIP, RemotePort, InitiatingProcessFileName
| take 5

// HUNT: Outbound connection to the two obfs4 Tor bridge addresses reported for the Yoba XMRig payload
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1090.003, T1573.002, T1496
// CONF: high | FP: low
// FALSE POSITIVES: none expected; both addresses are listed as the payload's bridge configuration in Check Point (snapshot 01). Bridge addresses rotate, so absence of a hit is weak evidence.
// EQUIVALENCE: equivalent-with-schema-assumptions - Same indicator match: an outbound connection whose remote address is one of the two reported Tor bridge addresses. The connecting process is InitiatingProcessFileName.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: None expected. Bridge addresses rotate, so absence of a hit is weak evidence.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Advanced Hunting keeps 30 days; the CQL tab covers 90 days. Only the two reported addresses are matched; rotated bridges are not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemoteIP in ("51.89.231.85", "51.89.228.250")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteIP, RemotePort, LocalPort
| sort by Timestamp desc
| take 500

// HUNT: Process running from a torbundle folder, or any process connecting to the local SOCKS5 port 9550 (Yoba XMRig payload through its bundled Tor)
// MITRE: T1090.003, T1496, T1055
// CONF: medium  FP: low  COST: medium
// REQUIRES: process creation (ProcessRollup2, SyntheticProcessRollup2) and outbound connection (NetworkConnectIP4); loopback connections are not logged in every sensor policy
// FALSE POSITIVES: a developer running a local Tor client from a folder that happens to be called torbundle; the Tor Browser uses different folders and ports
// SOURCE: Check Point (snapshot 01): Tor data directory %TEMP%\torbundle\data, SOCKS5 proxy on 127.0.0.1 port 9550
// LOOKBACK: 30d. Set the window with the Falcon time picker.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|NetworkConnectIP4)$/
| (ImageFileName=/\\torbundle\\/i or CommandLine=/torbundle/i or (RemoteAddressIP4="127.0.0.1" and RemotePort=9550))
| table([@timestamp, aid, ComputerName, UserName, #event_simpleName, FileName, ContextBaseFileName, ImageFileName, CommandLine, RemoteAddressIP4, RemotePort], limit=500)
| sort(@timestamp, order=desc)

event.type = 'IP Connect' dst.ip.address = *
| limit 5
| columns event.time, event.type, dst.ip.address, dst.port.number, tgt.process.image.path, tgt.process.cmdline

// HUNT: Process running from a torbundle folder, or any process connecting to the local SOCKS5 port 9550 (Yoba XMRig payload through its bundled Tor)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1090.003, T1496, T1055
// CONF: medium | FP: low
// FALSE POSITIVES: a developer running a local Tor client from a folder that happens to be called torbundle; the Tor Browser uses different folders and ports
// EQUIVALENCE: equivalent-with-schema-assumptions - Same two branches: a process started from, or with a command line naming, a torbundle folder; or any connection to the loopback address on port 9550. The process branch reads tgt.process.* on Process Creation and the connection branch reads IP Connect.
// REQUIRES: SentinelOne process creation telemetry and IP Connect telemetry; loopback connections are not recorded under every policy
// TUNING: Exclude a developer running a local Tor client by full path. The Tor Browser uses different folders and ports.
// LOOKBACK: 30d; set the console time picker or query window
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: If loopback connections are not logged, only the torbundle branch can fire.
// VALIDATION LEVEL: static-reviewed
(event.type = 'Process Creation' and (tgt.process.image.path contains '\\torbundle\\' or tgt.process.cmdline contains 'torbundle')) or (event.type = 'IP Connect' and dst.ip.address = '127.0.0.1' and dst.port.number = 9550)
| sort -event.time
| limit 500
| columns event.time, endpoint.name, src.process.user, event.type, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, dst.ip.address, dst.port.number

DeviceNetworkEvents
| where Timestamp > ago(1d)
| project Timestamp, RemoteIP, RemotePort, InitiatingProcessFolderPath, InitiatingProcessCommandLine
| take 5

// HUNT: Process running from a torbundle folder, or any process connecting to the local SOCKS5 port 9550 (Yoba XMRig payload through its bundled Tor)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1090.003, T1496, T1055
// CONF: medium | FP: low
// FALSE POSITIVES: a developer running a local Tor client from a folder that happens to be called torbundle; the Tor Browser uses different folders and ports
// EQUIVALENCE: approximate-analytic - Same indicators read from one table: connections to the loopback address on port 9550, or connections made by a process whose image path or command line names a torbundle folder. A torbundle process that never connects is not seen; the CQL tab also matches a process start.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents); loopback connections are not recorded under every policy
// TUNING: Exclude a developer running a local Tor client by InitiatingProcessFolderPath. The Tor Browser uses different folders and ports.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A torbundle process that makes no connection in the window is not captured: the CQL's process-start branch has no place in a single-table query.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where (RemoteIP == "127.0.0.1" and RemotePort == 9550) or InitiatingProcessFolderPath contains "\\torbundle\\" or InitiatingProcessCommandLine contains "torbundle"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, RemoteIP, RemotePort, LocalPort
| sort by Timestamp desc
| take 500

// HUNT: Host showing two or more distinct Yoba stages in the window: winmm.dll in a user path, wmpdui.dll in WMProcess, the WMProcess task, loader lookups
// MITRE: T1574.002, T1053.005, T1102.001
// CONF: medium  FP: low  COST: high
// REQUIRES: executable write (PeFileWritten, NewExecutableWritten), scheduled task registration (ScheduledTaskRegistered), DNS lookup with process (DnsRequest)
// FALSE POSITIVES: low; two different Yoba-specific stages on one host is rare in clean estates
// NOTE: SpanHours shows the gap between the first and last stage. Check Point reports the roughly 12.73 day Sleep loop only on the branch where the host process is NOT named Setup.exe (a sandbox or standalone run). A real infection is therefore expected to span the time to the next reboot (the task fires 3 minutes after boot), not 12 days. Hunt the pairing, not a fixed gap.
// LOOKBACK: 30d. Set the window with the Falcon time picker.
#event_simpleName=/^(PeFileWritten|NewExecutableWritten|ScheduledTaskRegistered|DnsRequest)$/
| case {
    #event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/ and FileName=/^winmm\.dll$/i and TargetFileName=/\\(Users|ProgramData)\\/i | stage := "1-winmm-dll-in-user-path";
    #event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/ and FileName=/^wmpdui\.dll$/i and TargetFileName=/\\ProgramData\\WMProcess\\/i | stage := "2-loader-dll-in-WMProcess";
    #event_simpleName=ScheduledTaskRegistered and TaskExecutable=/\\WMProcess\\/i | stage := "3-task-for-WMProcess";
    #event_simpleName=DnsRequest and ContextBaseFileName=/^wmpdmc\.exe$/i and DomainName=/^(t\.me|dns\.google|files\.catbox\.moe|.+\.dedyn\.io)$/i | stage := "4-loader-lookups";
    * | stage := "none";
  }
| stage != "none"
| groupBy([aid, ComputerName], function=[count(stage, distinct=true, as=StagesSeen), collect([stage]), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=1000)
| StagesSeen >= 2
| SpanHours := (LastSeen - FirstSeen) / 3600000
| table([ComputerName, aid, StagesSeen, stage, SpanHours, FirstSeen, LastSeen], limit=200)

event.type = 'File Creation' tgt.file.path = *
| limit 5
| columns event.time, event.type, endpoint.name, agent.uuid, tgt.file.path, tgt.process.image.path, src.process.name, event.dns.request

// HUNT: Host showing two or more distinct Yoba stages in the window: winmm.dll in a user path, wmpdui.dll in WMProcess, the WMProcess task, loader lookups
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002, T1053.005, T1102.001
// CONF: medium | FP: low
// FALSE POSITIVES: low; two different Yoba-specific stages on one host is rare in clean estates
// EQUIVALENCE: telemetry-gap - Partial pivot of the same correlation. Stage three, the scheduled task for WMProcess, is replaced by a process started from the WMProcess folder because no task-registration event is attested. PowerQuery has no case expression or arithmetic, so the stage count is a pairwise test and the span in hours is not computed; first and last seen are shown instead.
// REQUIRES: SentinelOne file creation, process creation and DNS Resolved telemetry
// TUNING: Hunt the pairing, not a fixed gap: a real infection is expected to span the time to the next reboot, not twelve days.
// LOOKBACK: 30d; set the console time picker or query window
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: The scheduled-task registration stage is approximated by a process start from the WMProcess folder. The span in hours between the first and last stage is not computed; read first_seen and last_seen.
// VALIDATION LEVEL: static-reviewed
(event.type in ('File Creation', 'File Modification') and ((tgt.file.path matches '\\\\winmm\\.dll$' and tgt.file.path contains ('\\Users\\', '\\ProgramData\\')) or tgt.file.path matches '\\\\ProgramData\\\\WMProcess\\\\wmpdui\\.dll$')) or (event.type = 'Process Creation' and tgt.process.image.path contains '\\ProgramData\\WMProcess\\') or (event.type = 'DNS Resolved' and src.process.name in:anycase ('wmpdmc.exe') and event.dns.request matches '^(t\\.me|dns\\.google|files\\.catbox\\.moe|.+\\.dedyn\\.io)$')
| group winmm_written=count(tgt.file.path matches '\\\\winmm\\.dll$'), loader_written=count(tgt.file.path matches '\\\\wmpdui\\.dll$'), wmprocess_started=count(tgt.process.image.path contains '\\ProgramData\\WMProcess\\'), loader_lookups=count(event.type = 'DNS Resolved'), first_seen=min(event.time), last_seen=max(event.time) by endpoint.name, agent.uuid
| filter (winmm_written > 0 and loader_written > 0) or (winmm_written > 0 and wmprocess_started > 0) or (winmm_written > 0 and loader_lookups > 0) or (loader_written > 0 and wmprocess_started > 0) or (loader_written > 0 and loader_lookups > 0) or (wmprocess_started > 0 and loader_lookups > 0)
| sort -last_seen
| limit 200

DeviceFileEvents
| where Timestamp > ago(1d)
| project Timestamp, FileName, FolderPath
| take 5

// HUNT: Host showing two or more distinct Yoba stages in the window: winmm.dll in a user path, wmpdui.dll in WMProcess, the WMProcess task, loader lookups
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.002, T1053.005, T1102.001
// CONF: medium | FP: low
// FALSE POSITIVES: low; two different Yoba-specific stages on one host is rare in clean estates
// EQUIVALENCE: telemetry-gap - Partial pivot of the same correlation over file events only: a device that wrote winmm.dll in a per-user or ProgramData folder and wmpdui.dll in the WMProcess folder. The scheduled-task and lookup stages cannot share a table with the file stages.
// REQUIRES: Defender for Endpoint file telemetry (DeviceFileEvents)
// TUNING: Hunt the pairing, not a fixed gap: a real infection is expected to span the time to the next reboot, not twelve days.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The scheduled-task stage and the loader lookups of t.me, dns.google, files.catbox.moe and dedyn.io by wmpdmc.exe are not covered; they live in other tables.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed-with-warnings; fixtures=0/0
DeviceFileEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("winmm.dll", "wmpdui.dll")
| extend Stage = case(FileName =~ "winmm.dll" and (FolderPath contains "\\Users\\" or FolderPath contains "\\ProgramData\\"), "1-winmm-dll-in-user-folder", FileName =~ "wmpdui.dll" and FolderPath contains "\\ProgramData\\WMProcess\\", "2-loader-dll-in-WMProcess", "none")
| where Stage != "none"
| summarize StagesSeen = dcount(Stage), Stages = make_set(Stage), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, DeviceName
| where StagesSeen >= 2
| extend SpanHours = datetime_diff("hour", LastSeen, FirstSeen)
| project DeviceName, DeviceId, StagesSeen, Stages, SpanHours, FirstSeen, LastSeen
| sort by LastSeen desc
| take 200

// HUNT: WMPDMC.exe doing DNS or network connections, or parenting another process (YobaLoader running inside the sideload host)
// MITRE: T1574.002, T1102.001, T1105, T1055
// CONF: high  FP: low  COST: low
// REQUIRES: DNS lookup (DnsRequest), outbound connection (NetworkConnectIP4), process creation (ProcessRollup2, SyntheticProcessRollup2)
// FALSE POSITIVES: low; the Windows Media Player device-metadata helper does not normally browse, resolve Telegram names or start child processes
// LOOKBACK: 90d. Set the window with the Falcon time picker.
#event_simpleName=/^(DnsRequest|NetworkConnectIP4|ProcessRollup2|SyntheticProcessRollup2)$/
| ContextBaseFileName=/^wmpdmc\.exe$/i or ParentBaseFileName=/^wmpdmc\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, #event_simpleName, ContextBaseFileName, DomainName, RemoteAddressIP4, RemotePort, FileName, ImageFileName, CommandLine, ParentBaseFileName], limit=500)
| sort(@timestamp, order=desc)

event.type = 'DNS Resolved' src.process.name = *
| limit 5
| columns event.time, event.type, src.process.name, event.dns.request

// HUNT: WMPDMC.exe doing DNS or network connections, or parenting another process (YobaLoader running inside the sideload host)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1574.002, T1102.001, T1105, T1055
// CONF: high | FP: low
// FALSE POSITIVES: low; the Windows Media Player device-metadata helper does not normally browse, resolve Telegram names or start child processes
// EQUIVALENCE: equivalent-with-schema-assumptions - Same behaviour: wmpdmc.exe as the acting process of a DNS lookup or a network connection, or as the creator of another process. On DNS and connection events the actor is src.process.*; on Process Creation the creator is also src.process.*.
// REQUIRES: SentinelOne DNS Resolved, IP Connect and Process Creation telemetry with the acting process name
// TUNING: Low false positives expected: the Windows Media Player device-metadata helper does not normally browse, resolve Telegram names or start child processes.
// LOOKBACK: 90d; set the console time picker or query window
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: A lookup or connection made by a process other than wmpdmc.exe itself (for example after injection into another host process) is not captured.
// VALIDATION LEVEL: static-reviewed
event.type in ('DNS Resolved', 'IP Connect', 'Process Creation')
src.process.name in:anycase ('wmpdmc.exe')
| sort -event.time
| limit 500
| columns event.time, endpoint.name, src.process.user, event.type, src.process.name, event.dns.request, dst.ip.address, dst.port.number, tgt.process.name, tgt.process.image.path, tgt.process.cmdline

DeviceEvents
| where Timestamp > ago(1d)
| where ActionType == "DnsQueryResponse"
| project Timestamp, ActionType, AdditionalFields, InitiatingProcessFileName
| take 5

// HUNT: WMPDMC.exe doing DNS or network connections, or parenting another process (YobaLoader running inside the sideload host)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1574.002, T1102.001, T1105, T1055
// CONF: high | FP: low
// FALSE POSITIVES: low; the Windows Media Player device-metadata helper does not normally browse, resolve Telegram names or start child processes
// EQUIVALENCE: telemetry-gap - Partial pivot: wmpdmc.exe as the initiating process of a DNS lookup, read from DnsQueryResponse events in DeviceEvents. Its network connections and child processes live in other tables and are not covered; the CQL tab covers all three.
// REQUIRES: Defender for Endpoint DNS events (DeviceEvents, ActionType DnsQueryResponse)
// TUNING: Low false positives expected: the Windows Media Player device-metadata helper does not normally browse or resolve Telegram names.
// LOOKBACK: 30d (Advanced Hunting retention; the CQL tab covers 90d)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Network connections made by wmpdmc.exe (DeviceNetworkEvents) and processes it starts (DeviceProcessEvents) are not covered. Advanced Hunting keeps 30 days; the CQL tab covers 90 days.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceEvents
| where Timestamp >= ago(30d)
| where ActionType == "DnsQueryResponse"
| where InitiatingProcessFileName =~ "wmpdmc.exe"
| extend DnsName = tolower(tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"])))
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, DnsName
| sort by Timestamp desc
| take 500

// HUNT: Executable or hidden PowerShell script run from TEMP\<10 random chars>\<10 random chars> (YobaLoader deployment methods 2 and 3)
// MITRE: T1059.001, T1204.002, T1553.005
// CONF: medium  FP: medium  COST: low
// REQUIRES: process creation with command line and image path (ProcessRollup2, SyntheticProcessRollup2)
// FALSE POSITIVES: installers and updaters that unpack to a random-named TEMP folder; hidden, execution-policy-bypass PowerShell used by some management tools
// TUNING: exclude a reviewed vendor by full path or by parent, for example | ParentBaseFileName!=/^(YourDeploymentTool)\.exe$/i ; the strongest variant also has ParentBaseFileName of wmpdmc.exe (see Q12).
// SOURCE: Check Point (snapshot 01): method 2 saves %TEMP%\<10 random chars>\<10 random chars>.exe after removing Zone.Identifier; method 3 saves a .ps1 and runs it with -WindowStyle Hidden -ExecutionPolicy Bypass -File
// LOOKBACK: 30d. Set the window with the Falcon time picker.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ImageFileName=/\\Temp\\[A-Za-z0-9]{10}\\[A-Za-z0-9]{10}\.exe$/i or CommandLine=/-WindowStyle Hidden -ExecutionPolicy Bypass -File .*\\Temp\\[A-Za-z0-9]{10}\\[A-Za-z0-9]{10}\.ps1/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA1HashData], limit=500)
| sort(@timestamp, order=desc)

event.type = 'Process Creation' tgt.process.cmdline = *
| limit 5
| columns event.time, event.type, tgt.process.image.path, tgt.process.cmdline

// HUNT: Executable or hidden PowerShell script run from TEMP\<10 random chars>\<10 random chars> (YobaLoader deployment methods 2 and 3)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1059.001, T1204.002, T1553.005
// CONF: medium | FP: medium
// FALSE POSITIVES: installers and updaters that unpack to a random-named TEMP folder; hidden, execution-policy-bypass PowerShell used by some management tools
// EQUIVALENCE: equivalent-with-schema-assumptions - Same two branches on Process Creation: an executable run from TEMP\<10 characters>\<10 characters>.exe, or a PowerShell command line with hidden window and execution-policy bypass running a script from the same kind of folder. The started process is tgt.process.*.
// REQUIRES: SentinelOne process creation telemetry with image path and command line
// TUNING: Exclude a reviewed vendor by full path or by creator process with a further negated clause; the strongest variant also has wmpdmc.exe as the creator (see the WMPDMC card).
// LOOKBACK: 30d; set the console time picker or query window
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: A script run with a different flag order is not captured, as on the CQL tab.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation'
(tgt.process.image.path matches '\\\\Temp\\\\[A-Za-z0-9]{10}\\\\[A-Za-z0-9]{10}\\.exe$' or tgt.process.cmdline matches '-WindowStyle Hidden -ExecutionPolicy Bypass -File .*\\\\Temp\\\\[A-Za-z0-9]{10}\\\\[A-Za-z0-9]{10}\\.ps1')
| sort -event.time
| limit 500
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.image.path, tgt.process.cmdline, tgt.process.image.sha1

DeviceProcessEvents
| where Timestamp > ago(1d)
| project Timestamp, FolderPath, ProcessCommandLine
| take 5

// HUNT: Executable or hidden PowerShell script run from TEMP\<10 random chars>\<10 random chars> (YobaLoader deployment methods 2 and 3)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1059.001, T1204.002, T1553.005
// CONF: medium | FP: medium
// FALSE POSITIVES: installers and updaters that unpack to a random-named TEMP folder; hidden, execution-policy-bypass PowerShell used by some management tools
// EQUIVALENCE: equivalent-with-schema-assumptions - Same two branches on process creation: an executable run from TEMP\<10 characters>\<10 characters>.exe, or a PowerShell command line with hidden window and execution-policy bypass running a script from the same kind of folder. The created process is FileName and FolderPath.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude a reviewed vendor by FolderPath or InitiatingProcessFileName after a baseline review.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A script run with a different flag order is not captured, as on the CQL tab.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FolderPath matches regex @"(?i)\\Temp\\[A-Za-z0-9]{10}\\[A-Za-z0-9]{10}\.exe$" or ProcessCommandLine matches regex @"(?i)-WindowStyle Hidden -ExecutionPolicy Bypass -File .*\\Temp\\[A-Za-z0-9]{10}\\[A-Za-z0-9]{10}\.ps1"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, SHA1
| sort by Timestamp desc
| take 500

// HUNT: Service registered with WinRing0 in its name or image path (Yoba XMRig payload can load the WinRing0 driver for MSR mining tweaks)
// MITRE: T1543.003, T1496
// CONF: low  FP: medium  COST: low
// REQUIRES: service creation (CreateService); on tenants without that event use Windows System event 7045
// FALSE POSITIVES: hardware monitoring and RGB or fan-control tools that bundle a WinRing0 driver legitimately
// TUNING: exclude the reviewed tool by full path, for example | ServiceImagePath!=/\\Program Files\\YourHardwareTool\\/i ; a WinRing0 service created from a user-writable path, or on a host with a Q9 or Q10 hit, is the real lead.
// SOURCE: Check Point (snapshot 01): the payload can conditionally load the WinRing0 driver service for MSR-based mining optimization
// LOOKBACK: 30d. Set the window with the Falcon time picker.
#event_simpleName=CreateService
| ServiceDisplayName=/winring0/i or ServiceImagePath=/winring0/i
| table([@timestamp, aid, ComputerName, UserName, ServiceDisplayName, ServiceImagePath], limit=200)
| sort(@timestamp, order=desc)

event.type = 'Registry Value Modified' registry.keyPath = *
| limit 5
| columns event.time, event.type, registry.keyPath, registry.value

// HUNT: Service registered with WinRing0 in its name or image path (Yoba XMRig payload can load the WinRing0 driver for MSR mining tweaks)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1543.003, T1496
// CONF: low | FP: medium
// FALSE POSITIVES: hardware monitoring and RGB or fan-control tools that bundle a WinRing0 driver legitimately
// EQUIVALENCE: approximate-analytic - No service-creation event is attested for SentinelOne here, so the hunt reads the registry write that creates a service: a value under a Services key whose key path or value names winring0. The CQL matches the service display name or image path.
// REQUIRES: SentinelOne registry value telemetry covering the Services keys
// TUNING: Exclude the reviewed hardware tool by its image path with a further negated contains clause on registry.value. A WinRing0 service created from a user-writable folder, or on a host with a hit on the Tor cards, is the real lead.
// LOOKBACK: 30d; set the console time picker or query window
// CONFIGURATION: No lookup objects or data tables required.
// KNOWN GAPS: A service whose display name alone says WinRing0, with neither key name nor image path matching, is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Registry Value Modified'
registry.keyPath contains '\\Services\\'
(registry.keyPath contains 'winring0' or registry.value contains 'winring0')
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, src.process.name, registry.keyPath, registry.valueName, registry.value

DeviceRegistryEvents
| where Timestamp > ago(1d)
| project Timestamp, ActionType, RegistryKey, RegistryValueData
| take 5

// HUNT: Service registered with WinRing0 in its name or image path (Yoba XMRig payload can load the WinRing0 driver for MSR mining tweaks)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1543.003, T1496
// CONF: low | FP: medium
// FALSE POSITIVES: hardware monitoring and RGB or fan-control tools that bundle a WinRing0 driver legitimately
// EQUIVALENCE: approximate-analytic - Service creation is read from the registry write under a Services key, which needs no extra audit policy: a value whose key or data names winring0. The CQL matches the service display name or image path.
// REQUIRES: Defender for Endpoint registry telemetry (DeviceRegistryEvents)
// TUNING: Exclude the reviewed hardware tool by its image path in RegistryValueData. A WinRing0 service created from a user-writable folder, or on a device with a hit on the Tor cards, is the real lead.
// LOOKBACK: 30d
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A service whose display name alone says WinRing0, with neither key name nor image path matching, is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceRegistryEvents
| where Timestamp >= ago(30d)
| where ActionType == "RegistryValueSet"
| where RegistryKey contains "\\Services\\"
| where RegistryKey contains "winring0" or RegistryValueData contains "winring0"
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData
| sort by Timestamp desc
| take 200