s1_powerquery_hunting.json

[
  {
    "category": "Installation & Persistence",
    "name": "EpiBrowser and OneStart installation",
    "query": "(event.dns.request contains:anycase 'api.epibrowser.com' and src.process.name = \"installer.exe\") OR (url.address contains:anycase ('resources.epibrowser.com','resources.onestart.ai') AND src.process.name = 'msiexec.exe') OR ((registry.keyPath contains:anycase ('Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\EpiBrowserUpdate','\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\OneStartAutoLaunch_') OR registry.keyPath contains:anycase ('Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\EPISoftware EpiBrowser','Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\OneStart.ai\\ OneStart') OR tgt.file.path contains:anycase ('OneStart.lnk','EpiStart.lnk')) AND src.process.name contains:anycase ('installer.exe', 'setup.exe', 'msiexec.exe')) OR #cmdline contains:anycase 'EPISoftware\\\\installer.exe'\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, event.dns.request, url.address\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, event.dns.request, url.address, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & TTPs",
    "name": "Clickfix TTP detected",
    "query": "((src.process.name contains:anycase (\"powershell.exe\", \"cmd.exe\") and tgt.process.cmdline contains:anycase (\"mshta\",\"-w 1\",\"-w h\",\"/c curl \",\"iex \",\"iwr \",\"msiexec \") and tgt.process.cmdline contains:anycase \"http\") OR (src.process.parent.name = \"explorer.exe\" and src.process.cmdline contains:anycase (\"mshta\",\"-w 1\",\"-w h\",\"/c curl \",\"iex \",\"iwr \",\"msiexec \",\"irm \") and src.process.cmdline contains:anycase \"http\") OR src.process.cmdline contains:anycase (\"iex(irm\", \"iex(iwr\",\"|iex\", \"| iex\", \").Content\", \"[ScriptBlock]::Create\", \"gal i?x\", \"gal i*x\", \"gcm i?x\", \"gcm i*x\",\"[bigint]\",\"verification code\",\"not a robot\",\" verification \") OR (src.process.cmdline contains:anycase \"UTF8.GetString\" AND src.process.cmdline contains:anycase (\"New-Object byte[\", \"[byte]('0x\"))) NOT (tgt.process.cmdline contains (\"chocolatey.org\",\"astral.sh/uv/install.ps1 \") OR src.process.cmdline contains (\"chocolatey.org\",\"astral.sh/uv/install.ps1 \"))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueTgtCmdlines=array_agg_distinct(tgt.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, event.dns.request\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllTgtCmdlines = UniqueTgtCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, AllTgtCmdlines, event.dns.request, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & TTPs",
    "name": "ClickFix TTP (Verbose)",
    "query": "((src.process.name contains:anycase (\"powershell.exe\", \"pwsh.exe\", \"cmd.exe\") and tgt.process.cmdline contains:anycase (\"mshta\",\"-w 1\",\"-w h\",\"-w hidden\",\"-windowstyle h\",\"-nop \",\"-noprofile\",\"-ep bypass\",\"-executionpolicy bypass\",\"-exec bypass\",\"-enc \",\"-encodedcommand\",\"/c curl \",\"curl.exe \",\"curl -o\",\"iex \",\"iwr \",\"irm \",\"msiexec \",\"bitsadmin /transfer\",\"bitsadmin /create\",\"Start-BitsTransfer\",\"certutil -urlcache\",\"certutil -decode\",\"certutil.exe -urlcache\",\"certutil.exe -decode\",\"regsvr32 /s\",\"scrobj.dll\",\"SyncAppvPublishingServer\",\"Microsoft.XMLHTTP\",\"MSXML2.XMLHTTP\",\"WinHttp.WinHttpRequest\",\"Net.WebClient\",\"DownloadString\",\"DownloadFile\",\"Invoke-RestMethod\",\"Invoke-WebRequest\",\"FromBase64String\",\"net use \",\"conhost --headless\",\"conhost.exe --headless\",\"wmic product call\",\"hta:\") and tgt.process.cmdline contains:anycase \"http\") OR (src.process.parent.name = \"explorer.exe\" and src.process.cmdline contains:anycase (\"mshta\",\"-w 1\",\"-w h\",\"-w hidden\",\"-windowstyle h\",\"-nop \",\"-noprofile\",\"-ep bypass\",\"-executionpolicy bypass\",\"-exec bypass\",\"-enc \",\"-encodedcommand\",\"/c curl \",\"curl.exe \",\"curl -o\",\"iex \",\"iwr \",\"irm \",\"msiexec \",\"bitsadmin /transfer\",\"bitsadmin /create\",\"Start-BitsTransfer\",\"certutil -urlcache\",\"certutil -decode\",\"certutil.exe -urlcache\",\"certutil.exe -decode\",\"regsvr32 /s\",\"scrobj.dll\",\"SyncAppvPublishingServer\",\"Microsoft.XMLHTTP\",\"MSXML2.XMLHTTP\",\"WinHttp.WinHttpRequest\",\"Net.WebClient\",\"DownloadString\",\"DownloadFile\",\"Invoke-RestMethod\",\"Invoke-WebRequest\",\"FromBase64String\",\"net use \",\"conhost --headless\",\"conhost.exe --headless\",\"wmic product call\",\"hta:\") and src.process.cmdline contains:anycase \"http\") OR (src.process.parent.name contains:anycase (\"chrome.exe\",\"msedge.exe\",\"firefox.exe\",\"brave.exe\",\"opera.exe\",\"arc.exe\",\"vivaldi.exe\") and src.process.name contains:anycase (\"powershell.exe\",\"pwsh.exe\",\"cmd.exe\",\"mshta.exe\",\"bitsadmin.exe\",\"certutil.exe\",\"regsvr32.exe\",\"rundll32.exe\",\"wscript.exe\",\"cscript.exe\",\"conhost.exe\",\"finger.exe\") and src.process.cmdline contains:anycase (\"#\",\"iex \",\"irm \",\"iwr \",\"mshta\",\"msiexec\",\"rundll32\",\"bitsadmin\",\"certutil\",\"hta:\",\"-w h\",\"-w hidden\",\"-w 1\",\"-windowstyle h\",\"-nop \",\"-ep bypass\",\"-executionpolicy bypass\",\"-exec bypass\",\"-enc \",\"-encodedcommand\",\"DownloadString\",\"FromBase64String\",\"Invoke-RestMethod\",\"Invoke-WebRequest\",\"Start-BitsTransfer\",\"Microsoft.XMLHTTP\",\"WinHttp.WinHttpRequest\",\"Net.WebClient\",\"conhost --headless\",\"net use \",\"SyncAppvPublishingServer\")) OR src.process.cmdline contains:anycase (\"iex(irm\", \"iex(iwr\",\"|iex\", \"| iex\", \").Content\", \"[ScriptBlock]::Create\", \"gal i?x\", \"gal i*x\", \"gcm i?x\", \"gcm i*x\",\"(Get-Clipboard)|iex\",\"(Get-Clipboard) | iex\",\"Get-Clipboard | iex\",\"SyncAppvPublishingServer\") OR (src.process.cmdline contains:anycase \"UTF8.GetString\" AND src.process.cmdline contains:anycase (\"New-Object byte[\", \"[byte]('0x\")) OR (src.process.name contains:anycase \"rundll32.exe\" AND src.process.cmdline contains:anycase ('@80\\\\','@443\\\\','@8080\\\\','@8443\\\\')) OR (src.process.name contains:anycase \"finger.exe\" AND src.process.parent.name contains:anycase (\"explorer.exe\",\"cmd.exe\",\"powershell.exe\",\"pwsh.exe\") AND src.process.cmdline contains:anycase \"@\") OR (src.process.name contains:anycase \"nslookup.exe\" AND src.process.parent.name contains:anycase (\"explorer.exe\",\"cmd.exe\",\"powershell.exe\",\"pwsh.exe\") AND src.process.cmdline contains:anycase (\"-q=txt\",\"-type=txt\",\"-qtype=txt\",\"-querytype=txt\")) OR (src.process.name contains:anycase \"wmic.exe\" AND src.process.cmdline contains:anycase \"product call install\" AND src.process.cmdline contains:anycase \"http\")) NOT (tgt.process.cmdline contains (\"chocolatey.org\",\"astral.sh/uv/install.ps1 \",\"get.scoop.sh\",\"win.rustup.rs\",\"install.python-poetry.org\") OR src.process.cmdline contains (\"chocolatey.org\",\"astral.sh/uv/install.ps1 \",\"get.scoop.sh\",\"win.rustup.rs\",\"install.python-poetry.org\"))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueTgtCmdlines=array_agg_distinct(tgt.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, event.dns.request\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllTgtCmdlines = UniqueTgtCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, AllTgtCmdlines, event.dns.request, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Credential Access",
    "name": "SAM Dumped based on indicator",
    "query": "indicator.name contains \"DumpSAM\" AND NOT (indicator.metadata contains \"Blocked: False\")\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), IndDesc=any(indicator.description), UniqueIndMeta=array_agg_distinct(indicator.metadata, 10) by timestamp, endpoint.name, src.process.user, src.process.storyline.id, indicator.name\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllIndMeta = UniqueIndMeta.to_string(' | ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, timestamp, endpoint.name, src.process.user, src.process.storyline.id, indicator.name, IndDesc, AllIndMeta, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Lateral Movement",
    "name": "WMIExec was used",
    "query": "((src.process.name contains:anycase (\"cmd.exe\",\"powershell.exe\") OR tgt.process.name contains:anycase (\"cmd.exe\",\"powershell.exe\"))\nAND src.process.cmdline contains:anycase \"2>&1\"\nAND (src.process.cmdline contains:anycase (\"C$\",\"ADMIN$\",\"IPC$\",\"PRINT$\",\"FAX$\",\"Temp\") OR src.process.cmdline contains:anycase \"localhost\" OR src.process.cmdline contains:anycase \"Windows\")\nAND osSrc.process.name contains \"wmiprvse.exe\")\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueTgtCmdlines=array_agg_distinct(tgt.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, tgt.process.name\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllTgtCmdlines = UniqueTgtCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, tgt.process.name, AllTgtCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Discovery & Reconnaissance",
    "name": "Listing of domain admin from non admin user",
    "query": "indicator.name=\"PermissionGroupsDiscovery\" AND NOT (src.process.user contains:anycase (\"AUTORITE NT\",\"NT AUTHORITY\"))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueIndMeta=array_agg_distinct(indicator.metadata, 10) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, indicator.name\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllIndMeta = UniqueIndMeta.to_string(' | ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, indicator.name, AllIndMeta, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Lateral Movement",
    "name": "ATExec was used",
    "query": "indicator.name contains \"ScheduleTaskRegister\"\n| let taskCode = indicator.metadata.extract_matches('Task: \"\\\\\\\\([A-Za-z0-9_\\-]{1,64})\"').get(0)\n| filter taskCode != null\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count = count(), UniqueIndMeta=array_agg_distinct(indicator.metadata, 10) by endpoint.name, src.process.user, src.process.storyline.id, taskCode\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllIndMeta = UniqueIndMeta.to_string(' | ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.storyline.id, taskCode, AllIndMeta, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Credential Access",
    "name": "User harvested NTDS with Ntdsutil",
    "query": "src.process.name contains:anycase 'ntdsutil.exe' AND indicator.name = \"VssNtdsHarvesting\" AND AND NOT (src.process.parent.cmdline contains:anycase 'C:\\\\ProgramData\\\\NinjaRMMAgent\\\\')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, indicator.name\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, indicator.name, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Lateral Movement",
    "name": "Possible WMIC lateralisation",
    "query": "(( src.process.name contains:anycase (\"cmd.exe\",\"powershell.exe\") OR tgt.process.name contains:anycase (\"cmd.exe\",\"powershell.exe\")) AND src.process.cmdline contains:anycase \"2>&1\" AND (src.process.cmdline contains:anycase (\"C$\",\"ADMIN$\",\"IPC$\",\"PRINT$\",\"FAX$\",\"Temp\") OR src.process.cmdline contains:anycase \"localhost\" OR src.process.cmdline contains:anycase \"Windows\") AND osSrc.process.name contains \"wmiprvse.exe\")\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueTgtCmdlines=array_agg_distinct(tgt.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, tgt.process.name\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllTgtCmdlines = UniqueTgtCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, tgt.process.name, AllTgtCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & LOLBAS",
    "name": "Suspicious Powershell command",
    "query": "src.process.name contains:anycase ('cmd.exe','powershell.exe','pwsh.exe') AND src.process.cmdline contains:anycase \"2>&1\" AND src.process.cmdline contains:anycase \"/Q\"\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Credential Access",
    "name": "SAM Harvesting from VSS with esentutl",
    "query": "src.process.image.path contains:anycase \"esentutl.exe\" AND src.process.cmdline contains:anycase \"/y /vss C:\\\\Windows\\\\System32\\\\config\\\\SAM /d\" AND indicator.name = \"VssSamHarvesting\"\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, src.process.image.path, indicator.name\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, src.process.image.path, indicator.name, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Lateral Movement",
    "name": "SMBExec was used",
    "query": "src.process.name contains:anycase ('cmd.exe' ,'powershell.exe') AND src.process.cmdline contains:anycase \"2>&1\" AND (src.process.cmdline contains:anycase ( \"C$\", \"ADMIN$\",\"IPC$\", \"PRINT$\", \"FAX$\"))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Discovery & Reconnaissance",
    "name": "NLTEST was used",
    "query": "((src.process.name=\"nltest.exe\" AND src.process.cmdline contains:anycase(\"dclist\",\"dcname\",\"dsgetdc\",\"dnsgetdc\",\"finduser\",\"domain_trusts\",\"dsquerydns\")) OR (tgt.process.name=\"nltest.exe\" AND tgt.process.cmdline contains:anycase (\"dclist\",\"dcname\",\"dsgetdc\",\"dnsgetdc\",\"finduser\",\"domain_trusts\",\"dsquerydns\")) OR (src.process.cmdline contains:anycase \"nltest\" AND src.process.cmdline contains:anycase (\"dclist\",\"dcname\",\"dsgetdc\",\"dnsgetdc\",\"finduser\",\"domain_trusts\",\"dsquerydns\")) OR (tgt.process.cmdline contains:anycase \"nltest\" AND tgt.process.cmdline contains:anycase(\"dclist\",\"dcname\",\"dsgetdc\",\"dnsgetdc\",\"finduser\",\"domain_trusts\",\"dsquerydns\")))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueTgtCmdlines=array_agg_distinct(tgt.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, tgt.process.name\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllTgtCmdlines = UniqueTgtCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, tgt.process.name, AllTgtCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Command & Control",
    "name": "LOLTunnels domain / url hits",
    "query": "event.dns.request contains:anycase (\"shellhub.io\", \"sharedwithexpose.com\", \"eu-1.sharedwithexpose.com\", \"us-1.sharedwithexpose.com\", \"us-2.sharedwithexpose.com\", \"ap-1.sharedwithexpose.com\", \"in-1.sharedwithexpose.com\", \"sa-1.sharedwithexpose.com\", \"au-1.sharedwithexpose.com\", \"eu-2.sharedwithexpose.com\", \"tuns.sh\", \"ssi.sh\", \"tunnelto.dev\", \"pagekite.net\", \"pagekite.me\", \"loca.lt\", \"localtunnel.me\", \"dataplicity.com\", \"devtunnels.ms\", \"tunnels.api.visualstudio.com\", \"get.telebit.io\", \"telebit.io\", \"telebit.cloud\", \"telebit.fun\", \"data.rel.tunnels.api.visualstudio.com\", \"rel.tunnels.api.visualstudio.com\", \"global.rel.tunnels.api.visualstudio.com\", \"localhost.run\", \"pinggy.io\", \"pinggy.link\", \"amazonaws.com/public.pinggy.binaries/\", \"loophole.eu.auth0.com\", \"loophole.site\", \"burrow.io\", \"burrow.link\", \"io.burrow.link\", \"localto.net\", \"localtonet.com\", \"tmate.io\", \"tunnel.staqlab.com\", \"staqlab-tunnel.com\", \"staqlab.com\", \"jprq.io\", \"bore.pub\", \"btunnel.co.in\", \"btunnel.in\", \"ngrok.com\", \"ngrok.io\", \"ngrok.dev\", \"ngrok.app\", \"ngrok.pro\", \"ngrok.pizza\", \"ngrok-agent.com\", \"ngrok-free.app\", \"ngrok-cname.com\", \"serveo.net\", \"pitunnel.com\", \"openport.io\", \"beeceptor.com\", \"localxpose.io\", \"expose.sh\", \"expos.es\", \"trycloudflare.com\", \"cfargotunnel.com\", \"cftunnel.com\", \"bore.digital\") or url.address contains:anycase (\"shellhub.io\", \"sharedwithexpose.com\", \"eu-1.sharedwithexpose.com\", \"us-1.sharedwithexpose.com\", \"us-2.sharedwithexpose.com\", \"ap-1.sharedwithexpose.com\", \"in-1.sharedwithexpose.com\", \"sa-1.sharedwithexpose.com\", \"au-1.sharedwithexpose.com\", \"eu-2.sharedwithexpose.com\", \"tuns.sh\", \"ssi.sh\", \"tunnelto.dev\", \"pagekite.net\", \"pagekite.me\", \"loca.lt\", \"localtunnel.me\", \"dataplicity.com\", \"devtunnels.ms\", \"tunnels.api.visualstudio.com\", \"get.telebit.io\", \"telebit.io\", \"telebit.cloud\", \"telebit.fun\", \"data.rel.tunnels.api.visualstudio.com\", \"rel.tunnels.api.visualstudio.com\", \"global.rel.tunnels.api.visualstudio.com\", \"localhost.run\", \"pinggy.io\", \"pinggy.link\", \"amazonaws.com/public.pinggy.binaries/\", \"loophole.eu.auth0.com\", \"loophole.site\", \"burrow.io\", \"burrow.link\", \"io.burrow.link\", \"localto.net\", \"localtonet.com\", \"tmate.io\", \"tunnel.staqlab.com\", \"staqlab-tunnel.com\", \"staqlab.com\", \"jprq.io\", \"bore.pub\", \"btunnel.co.in\", \"btunnel.in\", \"ngrok.com\", \"ngrok.io\", \"ngrok.dev\", \"ngrok.app\", \"ngrok.pro\", \"ngrok.pizza\", \"ngrok-agent.com\", \"ngrok-free.app\", \"ngrok-cname.com\", \"serveo.net\", \"pitunnel.com\", \"openport.io\", \"beeceptor.com\", \"localxpose.io\", \"expose.sh\", \"expos.es\", \"trycloudflare.com\", \"cfargotunnel.com\", \"cftunnel.com\", \"bore.digital\")\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, event.dns.request\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, event.dns.request, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & Persistence",
    "name": "Scheduled task started remotely",
    "query": "indicator.name contains \"ScheduledTaskProcessStartedRemotely\" AND NOT (indicator.metadata contains (\"\\\\BC\\\\\",\"\\\\Microsoft\\\\Configuration Manager\\\\\",\"OneDrive Startup\",\"\\\\Microsoft\\\\Windows\\\\UpdateOrchestrator\",\"\\\\Take Control Agent N-Central Helper\"))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), IndDesc=any(indicator.description), UniqueIndMeta=array_agg_distinct(indicator.metadata, 10) by endpoint.name, src.process.user, indicator.name\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllIndMeta = UniqueIndMeta.to_string(' | ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, indicator.name, IndDesc, AllIndMeta, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Forensics & Investigation",
    "name": "Forensic memory aquisistion tools used",
    "query": "src.process.publisher contains (\"MAGNET FORENSICS INC.\",\"ACCESSDATA GROUP\",\"EXTERRO\",\"MOONSOLS SARL\",\"BELKASOFT\",\"BASIS TECHNOLOGY CORP\",\"FIREEYE\",\"VOLEXITY\",\"ZIMMERMAN\")\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & LOLBAS",
    "name": "MSIExec remote installation used",
    "query": "(tgt.process.name contains:anycase \"msiexec.exe\" and src.process.name contains:anycase \"cmd.exe\" and tgt.process.cmdline contains:anycase \"http\" and ( tgt.process.cmdline contains:anycase \"/q\" or tgt.process.cmdline contains:anycase \"-q\")) NOT (tgt.process.cmdline contains (\"jabra.com\"))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueTgtCmdlines=array_agg_distinct(tgt.process.cmdline) by endpoint.name, src.process.storyline.id, src.process.user, src.process.parent.name, src.process.name, src.process.verified, tgt.process.name\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllTgtCmdlines = UniqueTgtCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.storyline.id, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, tgt.process.name, AllTgtCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Installation & Persistence",
    "name": "Potential malicious RegistryAutoRun detected",
    "query": "indicator.name contains \"RegistryAutorun\" AND indicator.metadata contains:anycase (\"\\\\run\") AND indicator.metadata contains:anycase (\".ps1\",\".cmd\",\".vba\",\".xlsm\",\".xlsx\",\".docx\",\"cscript\",\".txt\",\".raw\",\".docm\",\".pptm\",\".exe\",\".pif\") AND NOT (src.process.displayName contains:anycase (\"Microsoft\",\"dotnetcore\",\"OneDrive\",\"Edge\",\"Chrome\",\"dropbox\",\"Intel®\",\"Windows®\",\"Java Platform\",\"Adobe\",\"slack\",\"Win32 Cabinet Self-Extractor\",\"IExpress Setup\"))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueIndMeta=array_agg_distinct(indicator.metadata, 10) by endpoint.name, indicator.name, src.process.displayName\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllIndMeta = UniqueIndMeta.to_string(' | ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, indicator.name, AllIndMeta, src.process.displayName, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Discovery & Reconnaissance",
    "name": "RMM DNS or Urls events detected",
    "query": "(event.dns.request contains:anycase (\"portal.ehorus.com\",\"distantdesktop.com\",\"addigy.com\",\"sunlogin.oray.com\",\"showmypc.com\",\"fastviewer.com\",\"radmin.com\",\"syncromsp.com\",\"servably.com\",\"aurelius.host\",\"kabuto.io\",\"repairshopr.com\",\"sorillus.com\",\"acceo.com\",\"naverisk.com\",\"aweray.net\",\"aweray.com\",\"laplink.com\",\"donkz.nl\",\"connectwise.com\",\"screenconnect.com\",\"splashtop.com\",\"splashtop.eu\",\"rudesktop.ru\",\"ivanticloud.com\",\"ivanti.com\",\"kickidler.com\",\"dwservice.net\",\"pdq.com\",\"royalapps.com\",\"gatherplace.com\",\"gatherplace.net\",\"instanthousecall.com\",\"instanthousecall.net\",\"rustdesk.com\",\"neturo.uplus.co.kr\",\"ninjarmm.com\",\"ninjaone.com\",\"jumpcloud.com\",\"fixme.it\",\"techinline.net\",\"gotomypc.com\",\"islonline.com\",\"pcvisit.de\",\"backdrop.cloud\",\"netop.com\",\"nchuser.com\",\"fleetdeck.io\",\"ntrsupport.com\",\"datto.com\",\"centrastage.net\",\"anysupport.net\",\"adobeconnect.com\",\"beyondtrustcloud.com\",\"bomgarcloud.com\",\"skyfex.com\",\"deskroll.com\",\"remote.it\",\"atera.com\",\"tele-desk.com\",\"logmein.com\",\"logmein.eu\",\"logmeinrescue.com\",\"logmeininc.com\",\"getscreen.me\",\"beamyourscreen.com\",\"kaseya.com\",\"auvik.com\",\"getgo.com\",\"fastsupport.com\",\"gotoassist.com\",\"helpme.net\",\"desktopstreaming.com\",\"anyplace-control.com\",\"helpu.co.kr\",\"dameware.com\",\"mygreenpc.com\",\"level.io\",\"remotepass.com\",\"xeox.com\",\"simple-help.com\",\"comodo.com\",\"itarian.com\",\"domotz.co\",\"01com.com\",\"internetid.ru\",\"emcosoftware.com\",\"intelliadmin.com\",\"ezhelp.co.kr\",\"crossloop.com\",\"spytech-web.com\",\"ammyy.com\",\"parallels.com\",\"litemanager.ru\",\"litemanager.com\",\"anyviewer.com\",\"aomeisoftware.com\",\"todesk.com\",\"todesktop.com\",\"tailscale.com\",\"server-eye.de\",\"hostedrmm.com\",\"electric.ai\",\"ultravnc.com\",\"rview.com\",\"syspectr.com\",\"aeroadmin.com\",\"centuriontech.com\",\"tightvnc.com\",\"alpemix.com\",\"realvnc.com\",\"mikogo4.com\",\"mikogo.com\",\"ultraviewer.net\",\"jumpdesktop.com\",\"jumpto.me\",\"ericom.com\",\"soti.net\",\"pilixo.com\",\"teamviewer.com\",\"deskday.ai\",\"beinsync.net\",\"beinsync.com\",\"netsupportmanager.com\",\"ehorus.com\",\"247ithelp.com\",\"superopsbeta.com\",\"superops.ai\",\"superopsalpha.com\",\"anydesk.com\",\"royalapps.com\",\"iperiusremote.com\",\"remotedesktop.com\",\"remotepc.com\",\"laplink.com\",\"ericom.com\",\"goverlan.com\",\"remotecall.com\",\"startsupport.com\",\"eset.com\",\"mremoteng.org\",\"parsec.app\",\"parsec.gg\",\"kace.com\",\"nomachine.com\",\"portswigger.net\",\"owasp.org\",\"tenable.com\",\"cirt.net\",\"acunetix.com\",\"netsparker.com\",\"qualys.com\",\"burpcollaborator.net\",\"oastify.com\") OR url.address contains:anycase (\"portal.ehorus.com\",\"distantdesktop.com\",\"addigy.com\",\"sunlogin.oray.com\",\"showmypc.com\",\"fastviewer.com\",\"radmin.com\",\"syncromsp.com\",\"servably.com\",\"aurelius.host\",\"kabuto.io\",\"repairshopr.com\",\"sorillus.com\",\"acceo.com\",\"naverisk.com\",\"aweray.net\",\"aweray.com\",\"laplink.com\",\"donkz.nl\",\"connectwise.com\",\"screenconnect.com\",\"splashtop.com\",\"splashtop.eu\",\"rudesktop.ru\",\"ivanticloud.com\",\"ivanti.com\",\"kickidler.com\",\"dwservice.net\",\"pdq.com\",\"royalapps.com\",\"gatherplace.com\",\"gatherplace.net\",\"instanthousecall.com\",\"instanthousecall.net\",\"rustdesk.com\",\"neturo.uplus.co.kr\",\"ninjarmm.com\",\"ninjaone.com\",\"jumpcloud.com\",\"fixme.it\",\"techinline.net\",\"gotomypc.com\",\"islonline.com\",\"pcvisit.de\",\"backdrop.cloud\",\"netop.com\",\"nchuser.com\",\"fleetdeck.io\",\"ntrsupport.com\",\"datto.com\",\"centrastage.net\",\"anysupport.net\",\"adobeconnect.com\",\"beyondtrustcloud.com\",\"bomgarcloud.com\",\"skyfex.com\",\"deskroll.com\",\"remote.it\",\"atera.com\",\"tele-desk.com\",\"logmein.com\",\"logmein.eu\",\"logmeinrescue.com\",\"logmeininc.com\",\"getscreen.me\",\"beamyourscreen.com\",\"kaseya.com\",\"auvik.com\",\"getgo.com\",\"fastsupport.com\",\"gotoassist.com\",\"helpme.net\",\"desktopstreaming.com\",\"anyplace-control.com\",\"helpu.co.kr\",\"dameware.com\",\"mygreenpc.com\",\"level.io\",\"remotepass.com\",\"xeox.com\",\"simple-help.com\",\"comodo.com\",\"itarian.com\",\"domotz.co\",\"01com.com\",\"internetid.ru\",\"emcosoftware.com\",\"intelliadmin.com\",\"ezhelp.co.kr\",\"crossloop.com\",\"spytech-web.com\",\"ammyy.com\",\"parallels.com\",\"litemanager.ru\",\"litemanager.com\",\"anyviewer.com\",\"aomeisoftware.com\",\"todesk.com\",\"todesktop.com\",\"tailscale.com\",\"server-eye.de\",\"hostedrmm.com\",\"electric.ai\",\"ultravnc.com\",\"rview.com\",\"syspectr.com\",\"aeroadmin.com\",\"centuriontech.com\",\"tightvnc.com\",\"alpemix.com\",\"realvnc.com\",\"mikogo4.com\",\"mikogo.com\",\"ultraviewer.net\",\"jumpdesktop.com\",\"jumpto.me\",\"ericom.com\",\"soti.net\",\"pilixo.com\",\"teamviewer.com\",\"deskday.ai\",\"beinsync.net\",\"beinsync.com\",\"netsupportmanager.com\",\"ehorus.com\",\"247ithelp.com\",\"superopsbeta.com\",\"superops.ai\",\"superopsalpha.com\",\"anydesk.com\",\"royalapps.com\",\"iperiusremote.com\",\"remotedesktop.com\",\"remotepc.com\",\"laplink.com\",\"ericom.com\",\"goverlan.com\",\"remotecall.com\",\"startsupport.com\",\"eset.com\",\"mremoteng.org\",\"parsec.app\",\"parsec.gg\",\"kace.com\",\"nomachine.com\",\"portswigger.net\",\"owasp.org\",\"tenable.com\",\"cirt.net\",\"acunetix.com\",\"netsparker.com\",\"qualys.com\",\"burpcollaborator.net\",\"oastify.com\"))\n| filter not(event.dns.request contains:anycase (\"dl.acronis.com\",\"teamviewer.com\",\"getgo.com\"))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), TotalHits = count(), UniqueDnsRequests = array_agg_distinct(event.dns.request), UniqueUrlDomains = array_agg_distinct(url.address) by endpoint.name\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllDnsRequests = UniqueDnsRequests.to_string(', '), AllUrlDomains  = UniqueUrlDomains.to_string(', ')\n| columns \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, TotalHits, AllDnsRequests, AllUrlDomains\n| sort -TotalHits\n| limit 100000"
  },
  {
    "category": "Installation & Persistence",
    "name": "Tactical RMM Installation",
    "query": "(src.process.cmdline contains:anycase \"-m\" AND src.process.cmdline contains:anycase \"install\" AND src.process.cmdline contains:anycase \"--api\" AND src.process.cmdline contains:anycase \"--client-id\" AND src.process.cmdline contains:anycase \"--site-id\" AND src.process.cmdline contains:anycase \"--agent-type\" AND src.process.cmdline contains:anycase \"--auth\")\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Installation & Persistence",
    "name": "Windows Suspicious Scheduled Task Creation",
    "query": "(event.category = 'scheduled_task' AND event.type != 'Task Delete' AND (task.path contains:anycase \"cmd.exe\") AND (task.path contains:anycase \"temp\" OR task.path contains:anycase \"rundll32\" OR task.path contains:anycase \"wmic\" OR task.path contains:anycase \"powershell\" OR task.path contains:anycase \"appdata\") AND NOT (task.path contains:anycase \"ansible\" OR task.path contains:anycase \"RemoteSigned\"))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count() by endpoint.name, src.process.user, task.name, task.path\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, task.name, task.path, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & LOLBAS",
    "name": "MMC Spawning Windows Shell",
    "query": "(src.process.parent.name = 'mmc.exe' AND (src.process.name in ('cmd.exe', 'powershell.exe', 'powershell_ise.exe', 'wscript.exe', 'cscript.exe', 'sh.exe', 'bash.exe', 'reg.exe', 'regsvr32.exe') OR src.process.name contains:anycase 'bitsadmin'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & LOLBAS",
    "name": "Suspicious Windows Installer Execution",
    "query": "((src.process.name = 'msiexec.exe' OR src.process.cmdline contains:anycase 'msiexec') AND (src.process.cmdline contains:anycase 'http://' OR src.process.cmdline contains:anycase 'https://') AND (src.process.cmdline contains:anycase '-i' OR src.process.cmdline contains:anycase '-a' OR src.process.cmdline contains:anycase '/i' OR src.process.cmdline contains:anycase '/a' OR src.process.cmdline contains:anycase '/qn' OR src.process.cmdline contains:anycase '-qn'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Exfiltration",
    "name": "Powershell UploadString Function",
    "query": "((src.process.cmdline contains:anycase '.uploadstring' OR src.process.cmdline contains:anycase '.uploaddata' OR src.process.cmdline contains:anycase '.uploadfile' OR src.process.cmdline contains:anycase '.uploadvalues' OR cmdScript.content contains:anycase '.uploadstring' OR cmdScript.content contains:anycase '.uploaddata' OR cmdScript.content contains:anycase '.uploadfile' OR cmdScript.content contains:anycase '.uploadvalues') AND NOT (src.process.image.path contains:anycase 'azure-pipelines-tasks-msbuildhelpers' OR src.process.image.path contains:anycase 'RemoteDeployer.Utility.ps1'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueScripts=array_agg_distinct(cmdScript.content) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, src.process.image.path\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllScripts = UniqueScripts.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, AllScripts, src.process.image.path, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "Address Space Layout Randomization (ASLR) Alteration",
    "query": "((src.process.cmdline contains:anycase 'randomize_va_space' AND (src.process.cmdline contains:anycase '0' OR src.process.cmdline contains:anycase 'tee')) AND NOT (src.process.name in ('grep', 'cat')))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Discovery & Reconnaissance",
    "name": "Suspicious Hostname",
    "query": "(endpoint.name contains:anycase (\"parrot\",\"pentest\",\"redteam\",\"attack\",\"commando\",\"kali\",\"exegol\") OR endpoint.name matches:anycase 'DESKTOP-[A-Z0-9]{2,15}' OR endpoint.name matches:anycase 'LAPTOP-[A-Z0-9]{2,15}' OR endpoint.name matches:anycase 'WIN-[A-Z0-9]{2,15}') AND NOT (event.login.userName contains (\"$\",\"UMFD\",\"DWM\"))\n| filter event.login.userName != null\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count() by endpoint.name, event.login.userName\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, event.login.userName, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Command & Control",
    "name": "SOCKS Tunneling Tool",
    "query": "((src.process.cmdline contains:anycase 'socks5' OR src.process.cmdline contains:anycase 'socks4' OR src.process.cmdline contains:anycase '--tls-skip-verify') AND NOT (src.process.cmdline contains:anycase 'check.torproject.org' OR src.process.cmdline contains:anycase 'SOCKS5_GSSAPI'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Command & Control",
    "name": "Socat Relaying Socket",
    "query": "((src.process.cmdline contains:anycase 'tcp-l:' OR src.process.cmdline contains:anycase 'tcp4-l:' OR src.process.cmdline contains:anycase 'tcp6-l:' OR src.process.cmdline contains:anycase 'tcp-listen:' OR src.process.cmdline contains:anycase 'tcp4-listen:' OR src.process.cmdline contains:anycase 'tcp6-listen:' OR src.process.cmdline contains:anycase 'inet-l:' OR src.process.cmdline contains:anycase 'inet4-l:' OR src.process.cmdline contains:anycase 'inet6-l:' OR src.process.cmdline contains:anycase 'inet-listen:' OR src.process.cmdline contains:anycase 'inet4-listen:' OR src.process.cmdline contains:anycase 'inet6-listen:' OR src.process.cmdline contains:anycase 'ssl-l:' OR src.process.cmdline contains:anycase 'openssl-listen:') AND (src.process.cmdline contains:anycase 'tcp:' OR src.process.cmdline contains:anycase 'tcp4:' OR src.process.cmdline contains:anycase 'tcp6:' OR src.process.cmdline contains:anycase 'tcp-connect:' OR src.process.cmdline contains:anycase 'tcp4-connect:' OR src.process.cmdline contains:anycase 'tcp6-connect:' OR src.process.cmdline contains:anycase 'inet:' OR src.process.cmdline contains:anycase 'inet4:' OR src.process.cmdline contains:anycase 'inet6:' OR src.process.cmdline contains:anycase 'ssl:' OR src.process.cmdline contains:anycase 'openssl:' OR src.process.cmdline contains:anycase 'openssl-connect:' OR src.process.cmdline contains:anycase 'local:' OR src.process.cmdline contains:anycase 'unix-connect:'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Discovery & Reconnaissance",
    "name": "Language Discovery",
    "query": "(cmdScript.content contains:anycase 'query' AND cmdScript.content contains:anycase 'MuiCached')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueScripts=array_agg_distinct(cmdScript.content) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllScripts = UniqueScripts.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, AllScripts, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & TTPs",
    "name": "Screenconnect Remote Execution",
    "query": "(src.process.parent.name = 'ScreenConnect.ClientService.exe' AND src.process.name in ('powershell.exe', 'cmd.exe'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Command & Control",
    "name": "Newly Observed ScreenConnect Host Server",
    "query": "(src.process.name = \"ScreenConnect.ClientService.exe\" OR src.process.publisher contains:anycase \"ConnectWise\") AND src.process.cmdline contains:anycase \"&h=\"\n| let screenconnectServer = src.process.cmdline.extract_matches('[?&]h=([^&\"]+)').get(0)\n| filter screenconnectServer != null\n| filter NOT (screenconnectServer contains:anycase \".screenconnect.com\" OR screenconnectServer contains:anycase \".connectwisecontrol.com\")\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), EndpointCount=estimate_distinct(endpoint.name), UniqueHosts=array_agg_distinct(endpoint.name), UniqueUsers=array_agg_distinct(src.process.user), UniqueParents=array_agg_distinct(src.process.parent.name), UniqueCmdlines=array_agg_distinct(src.process.cmdline) by screenconnectServer\n| filter EndpointCount == 1\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllHosts = UniqueHosts.to_string(', '), AllUsers = UniqueUsers.to_string(', '), AllParents = UniqueParents.to_string(', '), AllCmdlines = UniqueCmdlines.to_string(' | ')\n| sort -_FirstSeenMs\n| columns \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, screenconnectServer, EndpointCount, AllHosts, AllUsers, AllParents, AllCmdlines, Count\n| limit 100000"
  },
  {
    "category": "Execution & TTPs",
    "name": "NetExec RDP Behaviour detected",
    "query": "((src.process.cmdline contains:anycase ('| clip & exit' ,'clip; exit')) OR (tgt.process.cmdline contains:anycase ('| clip & exit' ,'clip; exit'))) OR (src.process.name contains:anycase (\"clip.exe\") AND src.process.parent.name contains:anycase (\"powershell.exe\",\"pwsh.exe\",\"mshta.exe\",\"msiexec.exe\",\"cmd.exe\"))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Credential Access",
    "name": "Credential Dump Tools Related Files",
    "query": "(((tgt.file.path contains:anycase 'pwdump' OR tgt.file.path contains:anycase 'pwhashes' OR tgt.file.path contains:anycase 'wce_ccache' OR tgt.file.path contains:anycase 'wce_krbtkts' OR tgt.file.path contains:anycase 'fgdump-log' OR tgt.file.path contains:anycase 'test.pwd' OR tgt.file.path contains:anycase 'lsremora64.dll' OR tgt.file.path contains:anycase 'lsremora.dll' OR tgt.file.path contains:anycase 'fgexec.exe' OR tgt.file.path contains:anycase 'wceaux.dll' OR tgt.file.path contains:anycase 'sam.out' OR tgt.file.path contains:anycase 'security.out' OR tgt.file.path contains:anycase 'system.out' OR tgt.file.path contains:anycase 'ntds.out' OR tgt.file.path contains:anycase 'dumpext.dll' OR tgt.file.path contains:anycase 'dumpsvc.exe' OR tgt.file.path contains:anycase 'cachedump64.exe' OR tgt.file.path contains:anycase 'cachedump.exe' OR tgt.file.path contains:anycase 'pstgdump.exe' OR tgt.file.path contains:anycase 'servpw.exe' OR tgt.file.path contains:anycase 'servpw64.exe' OR tgt.file.path contains:anycase 'pwdump.exe') OR (tgt.file.path endswith '.kirbi' OR tgt.file.path endswith '.ccache')) AND NOT (tgt.file.path contains:anycase '_PSScriptPolicyTest_'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count() by endpoint.name, src.process.user, tgt.file.path\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, tgt.file.path, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Credential Access",
    "name": "Opening Of a Password File",
    "query": "((src.process.cmdline contains:anycase 'mdp' OR src.process.cmdline contains:anycase 'password' OR src.process.cmdline contains:anycase 'mot de passe' OR src.process.cmdline contains:anycase 'mots de passe') AND src.process.name in ('notepad.exe', 'winword.exe', 'excel.exe', 'powerpnt.exe', 'outlook.exe') AND NOT ((src.process.cmdline contains:anycase 'firefox.exe' OR src.process.cmdline contains:anycase 'msedge.exe' OR src.process.cmdline contains:anycase 'chrome.exe' OR src.process.cmdline contains:anycase 'Office16') AND (src.process.cmdline contains:anycase 'reset' OR src.process.cmdline contains:anycase 'forgot' OR src.process.cmdline contains:anycase 'Réinitialiser')))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Credential Access",
    "name": "Wdigest Enable UseLogonCredential",
    "query": "((registry.keyPath contains:anycase '\\WDigest\\UseLogonCredential' AND registry.value contains:anycase '1') OR (src.process.cmdline contains:anycase 'reg' AND src.process.cmdline contains:anycase 'add' AND src.process.cmdline contains:anycase 'wdigest' AND src.process.cmdline contains:anycase '/v' AND src.process.cmdline contains:anycase 'uselogoncredential' AND src.process.cmdline contains:anycase '1'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, registry.keyPath, registry.value\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, registry.keyPath, registry.value, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Exfiltration",
    "name": "Rclone Process",
    "query": "(((src.process.name in ('rclone.exe', 'rclone') OR src.process.cmdline contains:anycase 'rclone') AND (src.process.cmdline contains:anycase 'config' OR src.process.cmdline contains:anycase 'copy' OR src.process.cmdline contains:anycase 'sync' OR src.process.cmdline contains:anycase 'mega' OR src.process.cmdline contains:anycase 'pcloud' OR src.process.cmdline contains:anycase 'ftp' OR src.process.cmdline contains:anycase 'pass' OR src.process.cmdline contains:anycase 'user' OR src.process.cmdline contains:anycase 'lsd' OR src.process.cmdline contains:anycase 'ls' OR src.process.cmdline contains:anycase 'remote')) OR ((src.process.cmdline contains:anycase 'copy' AND src.process.cmdline contains:anycase ':' AND src.process.cmdline contains:anycase '--') AND (src.process.cmdline contains:anycase 'mega:' OR src.process.cmdline contains:anycase 'ftp:' OR src.process.cmdline contains:anycase 'pcloud:')) OR ((src.process.cmdline contains:anycase 'copy' AND src.process.cmdline contains:anycase 'config' AND src.process.cmdline contains:anycase '.conf') AND (src.process.cmdline contains:anycase '--no-check-certificate' OR src.process.cmdline contains:anycase '--multi-thread--streams' OR src.process.cmdline contains:anycase '--transfers' OR src.process.cmdline contains:anycase '--progress' OR src.process.cmdline contains:anycase '--ignore-existing' OR src.process.cmdline contains:anycase '--auto-confirm'))) AND NOT (src.process.cmdline contains:anycase 'chocolatey')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Command & Control",
    "name": "TOR Usage Generic Rule",
    "query": "(indicator.name contains:anycase 'TorIP' OR indicator.description contains:anycase 'Tor exit node' OR indicator.metadata contains:anycase 'tor:') AND NOT (event.network.direction = 'inbound' AND (indicator.name contains:anycase 'TorIP' OR indicator.description contains:anycase 'Tor exit node' OR indicator.metadata contains:anycase 'tor:'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), IndDesc=any(indicator.description), UniqueIndMeta=array_agg_distinct(indicator.metadata, 10) by endpoint.name, src.ip.address, dst.ip.address, indicator.name\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllIndMeta = UniqueIndMeta.to_string(' | ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.ip.address, dst.ip.address, indicator.name, IndDesc, AllIndMeta, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Discovery & Reconnaissance",
    "name": "Shadow Copies",
    "query": "(((src.process.name endswith 'vssadmin.exe' OR src.process.name endswith 'diskshadow.exe') AND src.process.cmdline contains:anycase 'list' AND src.process.cmdline contains:anycase 'shadows') OR (src.process.name = 'vssadmin.exe' AND src.process.cmdline contains:anycase 'create' AND src.process.cmdline contains:anycase 'shadow') OR (src.process.name endswith 'powershell.exe' AND src.process.cmdline contains:anycase 'Win32_ShadowCopy') OR (cmdScript.content contains:anycase 'Get-WmiObject' AND cmdScript.content contains:anycase 'Win32_ShadowCopy') OR (cmdScript.content contains:anycase 'Get-CimInstance' AND cmdScript.content contains:anycase 'Win32_ShadowCopy')) AND NOT (src.process.cmdline contains:anycase 'AutoRetry')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueScripts=array_agg_distinct(cmdScript.content) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllScripts = UniqueScripts.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, AllScripts, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Exfiltration",
    "name": "Compress Data for Exfiltration via Archiver",
    "query": "(((src.process.name in ('winrar.exe', 'rar.exe') AND (src.process.cmdline contains:anycase ' -r ' OR src.process.cmdline contains:anycase ' -m ' OR src.process.cmdline contains:anycase '-ep ' OR src.process.cmdline contains:anycase '-hp' OR src.process.cmdline contains:anycase ' -p ' OR src.process.cmdline contains:anycase '-ta' OR src.process.cmdline contains:anycase '-tb' OR src.process.cmdline contains:anycase '-sdel' OR src.process.cmdline contains:anycase '-dw')) OR (src.process.name in ('winzip.exe', 'winzip64.exe') AND (src.process.cmdline contains:anycase ' -s ' OR src.process.cmdline contains:anycase '-min' OR src.process.cmdline contains:anycase ' -a '))) AND NOT (tgt.file.path contains:anycase 'Meshroom' OR tgt.file.path contains:anycase 'CompilacionVB6'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, tgt.file.path\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, tgt.file.path, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "Disabling SmartScreen Via Registry",
    "query": "(event.type in ('Registry Value Set', 'Registry Value Create')) AND ((registry.value = 'EnableSmartScreen' AND registry.keyPath contains:anycase 'DWORD (0x00000000)') OR (registry.value = 'SmartScreenEnabled' AND registry.keyPath contains:anycase 'Off'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count() by endpoint.name, src.process.name, src.process.verified, registry.keyPath, registry.value\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.name, src.process.verified, registry.keyPath, registry.value, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Privilege Escalation",
    "name": "UAC Bypass Using Fodhelper",
    "query": "(event.type in ('Registry Value Set', 'Registry Value Create')) AND (registry.keyPath contains:anycase '\\\\ms-settings\\\\Shell\\\\Open\\\\command' AND registry.value contains:anycase 'DelegateExecute')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count() by endpoint.name, src.process.name, src.process.verified, registry.keyPath, registry.value\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.name, src.process.verified, registry.keyPath, registry.value, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Privilege Escalation",
    "name": "RedSun Windows Defender 0-day (CVE-2026-33825)",
    "query": "(tgt.file.path contains:anycase \"\\\\Temp\\\\RS-{\" OR src.process.cmdline contains:anycase \"\\\\Temp\\\\RS-{\" OR src.process.image.path contains:anycase \"\\\\Temp\\\\RS-{\" OR tgt.file.path contains:anycase \"\\\\pipe\\\\REDSUN\" OR src.process.cmdline contains:anycase \"\\\\pipe\\\\REDSUN\" OR (src.process.name contains:anycase \"MsMpEng.exe\" AND tgt.file.path contains:anycase \"TieringEngineService.exe\") OR (tgt.file.path contains:anycase \"TieringEngineService.exe\" AND tgt.file.path contains:anycase (\"\\\\Temp\\\\\",\"\\\\AppData\\\\\",\"\\\\ProgramData\\\\\",\"\\\\Users\\\\Public\\\\\",\"\\\\Downloads\\\\\",\"\\\\Desktop\\\\\")) OR (src.process.parent.image.path contains:anycase \"\\\\TieringEngineService.exe\" AND src.process.name contains:anycase \"conhost.exe\") OR src.process.cmdline contains:anycase (\"SERIOUSLYMSFT\",\"The red sun shall prevail\",\"The sun is shinning\") OR indicator.metadata contains:anycase (\"SERIOUSLYMSFT\",\"50d185b9-fff3-4656-92c7-e4018da4361d\",\"\\\\pipe\\\\REDSUN\",\"\\\\Temp\\\\RS-{\")) NOT (tgt.file.path contains:anycase (\"\\\\WinSxS\\\\\",\"\\\\servicing\\\\\",\"\\\\SoftwareDistribution\\\\\",\"\\\\DriverStore\\\\\",\"\\\\Windows\\\\Installer\\\\\",\"\\\\Windows\\\\assembly\\\\\",\"\\\\Windows Defender\\\\Quarantine\\\\\",\"\\\\Windows Defender\\\\Platform\\\\\"))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueTgtPaths=array_agg_distinct(tgt.file.path), UniqueIndMeta=array_agg_distinct(indicator.metadata, 10) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, indicator.name\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllTgtPaths = UniqueTgtPaths.to_string(', '), AllIndMeta = UniqueIndMeta.to_string(' | ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, AllTgtPaths, indicator.name, AllIndMeta, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & LOLBAS",
    "name": "Usage Of Sysinternals Tools",
    "query": "(registry.value = 'EulaAccepted' OR src.process.cmdline contains:anycase '-accepteula')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, registry.keyPath, registry.value\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, registry.keyPath, registry.value, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Installation & Persistence",
    "name": "Malware Persistence Registry Key",
    "query": "NOT (registry.value contains:anycase 'atlassian' OR registry.value contains:anycase 'Agent' OR registry.value contains:anycase 'BlueJeans' OR registry.value contains:anycase 'Cisco' OR registry.value contains:anycase 'Discord' OR registry.value contains:anycase 'Dropbox' OR registry.value contains:anycase 'Docker' OR registry.value contains:anycase 'EIConnectorProxy' OR registry.value contains:anycase 'GoToMeeting' OR registry.value contains:anycase 'Lifesize' OR registry.value contains:anycase 'Mattermost' OR registry.value contains:anycase 'Microsoft Edge Update' OR registry.value contains:anycase 'OneDrive' OR registry.value contains:anycase 'PTOneClick' OR registry.value contains:anycase 'slack' OR registry.value contains:anycase 'Teams' OR registry.value contains:anycase 'VMware' OR registry.value contains:anycase 'W3DClient' OR registry.value contains:anycase 'MicrosoftSaRA' OR src.process.image.path contains:anycase 'atlassian' OR src.process.image.path contains:anycase 'blujeanslauncher' OR src.process.image.path contains:anycase 'dropbox' OR src.process.image.path contains:anycase 'msiexec.exe' OR src.process.image.path contains:anycase 'onedrivesetup.exe' OR src.process.image.path contains:anycase 'sara.exe' OR src.process.cmdline contains:anycase 'Letsignit') AND (((registry.keyPath endswith 'Microsoft\\\\Windows\\\\CurrentVersion\\\\Run' OR registry.keyPath endswith 'Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run' OR registry.keyPath endswith 'Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce') AND event.type = 'Registry Value Set' AND (registry.value contains:anycase 'C:\\\\Windows\\\\Temp\\\\' OR registry.value contains:anycase 'C:\\\\ProgramData\\\\' OR registry.value contains:anycase 'Recycle.bin\\\\' OR registry.value contains:anycase 'AppData' OR registry.value contains:anycase 'C:\\\\Temp\\\\' OR registry.value contains:anycase 'C:\\\\Users\\\\Public\\\\' OR registry.value contains:anycase 'C:\\\\Users\\\\Default\\\\' OR registry.value contains:anycase 'wscript' OR registry.value contains:anycase 'script') AND registry.value endswith '.exe') OR (src.process.cmdline contains:anycase 'reg' AND src.process.cmdline contains:anycase 'add' AND src.process.cmdline contains:anycase 'microsoft\\\\windows\\\\currentversion' AND src.process.cmdline contains:anycase '/f' AND src.process.cmdline contains:anycase '/v' AND src.process.cmdline contains:anycase 'reg_sz' AND src.process.cmdline contains:anycase 'c:\\\\users\\\\' AND src.process.cmdline contains:anycase '.exe' AND (src.process.cmdline contains:anycase '\\\\run' OR src.process.cmdline contains:anycase '\\\\policies\\\\explorer\\\\run' OR src.process.cmdline contains:anycase '\\\\runonce')))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, registry.keyPath, registry.value, src.process.image.path\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, registry.keyPath, registry.value, src.process.image.path, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & LOLBAS",
    "name": "BITSAdmin Download",
    "query": "((src.process.name = 'bitsadmin.exe' AND ((src.process.cmdline contains:anycase ' /transfer ' OR src.process.cmdline contains:anycase 'download' OR src.process.cmdline contains:anycase 'ftp' OR src.process.cmdline contains:anycase '\\\\') OR (src.process.cmdline contains:anycase '/addfile ' AND src.process.cmdline contains:anycase 'http'))) OR (src.process.cmdline contains:anycase 'copy' AND src.process.cmdline contains:anycase 'bitsadmin.exe'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & LOLBAS",
    "name": "Suspicious PowerShell Keywords",
    "query": "((cmdScript.content contains:anycase 'System.Reflection.Assembly.Load($' OR cmdScript.content contains:anycase '[System.Reflection.Assembly]::Load($' OR cmdScript.content contains:anycase '[Reflection.Assembly]::Load($' OR cmdScript.content contains:anycase 'System.Reflection.AssemblyName' OR cmdScript.content contains:anycase 'Reflection.Emit.AssemblyBuilderAccess' OR cmdScript.content contains:anycase 'Runtime.InteropServices.DllImportAttribute' OR cmdScript.content contains:anycase 'SuspendThread' OR cmdScript.content contains:anycase 'DefineDynamicModule' OR cmdScript.content contains:anycase 'GetDelegateForFunctionPointer' OR cmdScript.content contains:anycase 'System.Reflection.CallingConventions' OR src.process.cmdline contains:anycase 'System.Reflection.Assembly.Load($' OR src.process.cmdline contains:anycase '[System.Reflection.Assembly]::Load($' OR src.process.cmdline contains:anycase '[Reflection.Assembly]::Load($' OR src.process.cmdline contains:anycase 'System.Reflection.AssemblyName' OR src.process.cmdline contains:anycase 'Reflection.Emit.AssemblyBuilderAccess' OR src.process.cmdline contains:anycase 'Runtime.InteropServices.DllImportAttribute' OR src.process.cmdline contains:anycase 'SuspendThread' OR src.process.cmdline contains:anycase 'DefineDynamicModule' OR src.process.cmdline contains:anycase 'GetDelegateForFunctionPointer' OR src.process.cmdline contains:anycase 'System.Reflection.CallingConventions') AND NOT (cmdScript.content contains:anycase 'ProgramData\\N-Able Technologies\\AutomationManager'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueScripts=array_agg_distinct(cmdScript.content) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllScripts = UniqueScripts.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, AllScripts, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Installation & Persistence",
    "name": "COM (Component Object Model) Hijacking",
    "query": "((src.process.cmdline contains:anycase 'GetTypeFromCLSID' AND src.process.cmdline contains:anycase 'ShellExecute') OR (src.process.cmdline contains:anycase 'CreateInstance' AND src.process.cmdline contains:anycase 'ShellExecute') OR (src.process.cmdline contains:anycase 'GetTypeFromCLSID' AND src.process.cmdline contains:anycase 'CreateInstance'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & TTPs",
    "name": "OneNote Suspicious Children Process",
    "query": "(NOT (src.process.image.path contains:anycase '\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\' AND src.process.image.path contains:anycase '\\\\FileCoAuth.exe') AND NOT (src.process.image.path contains:anycase '\\\\AppData\\\\Local\\\\Microsoft\\\\Teams\\\\' AND src.process.image.path contains:anycase '\\\\Teams.exe') AND NOT (src.process.name = 'rundll32.exe' AND src.process.cmdline contains:anycase 'PrintHTML') AND NOT (src.process.cmdline contains:anycase 'AppData\\\\Local\\\\Google\\\\Chrome' OR src.process.cmdline contains:anycase 'AppData\\\\Local\\\\Mozilla' OR src.process.cmdline contains:anycase 'AppData\\\\Local\\\\BraveSoftware' OR src.process.cmdline contains:anycase 'AppData\\\\Local\\\\Vivaldi' OR src.process.cmdline contains:anycase 'AppData\\\\Local\\\\Programs\\\\Opera')) AND ((src.process.parent.name = 'onenote.exe' AND (src.process.name in ('rundll32.exe', 'regsvr32.exe', 'bitsadmin.exe', 'certutil.exe', 'installutil.exe', 'schtasks.exe', 'wmic.exe', 'cscript.exe', 'wscript.exe', 'cmstp.exe', 'Microsoft.Workflow.Compiler.exe', 'regasm.exe', 'regsvcs.exe', 'mshta.exe', 'msxsl.exe', 'ieexec.exe', 'cmd.exe', 'powershell.exe', 'javaw.exe', 'pcalua.exe', 'curl.exe', 'scriptrunner.exe', 'certoc.exe', 'workfolders.exe', 'odbcconf.exe', 'msiexec.exe', 'msdt.exe') OR (src.process.name = 'explorer.exe' AND (src.process.cmdline contains:anycase '.hta' OR src.process.cmdline contains:anycase '.vb' OR src.process.cmdline contains:anycase '.wsh' OR src.process.cmdline contains:anycase '.js' OR src.process.cmdline contains:anycase '.ps' OR src.process.cmdline contains:anycase '.scr' OR src.process.cmdline contains:anycase '.pif' OR src.process.cmdline contains:anycase '.bat' OR src.process.cmdline contains:anycase '.cmd')) OR (src.process.image.path contains:anycase '\\\\AppData\\\\' OR src.process.image.path contains:anycase '\\\\Users\\\\Public\\\\' OR src.process.image.path contains:anycase '\\\\ProgramData\\\\' OR src.process.image.path contains:anycase '\\\\Windows\\\\Tasks\\\\' OR src.process.image.path contains:anycase '\\\\Windows\\\\Temp\\\\' OR src.process.image.path contains:anycase '\\\\Windows\\\\System32\\\\Tasks\\\\'))) OR (tgt.file.path contains:anycase '\\\\exported\\\\' AND tgt.file.path contains:anycase '.lnk' AND src.process.name = 'onenote.exe'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, src.process.image.path, tgt.file.path\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, src.process.image.path, tgt.file.path, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "Netsh Port Forwarding / Opening",
    "query": "(src.process.name = 'netsh.exe' AND ((src.process.cmdline contains:anycase 'advfirewall' AND src.process.cmdline contains:anycase 'firewall' AND src.process.cmdline contains:anycase 'add' AND src.process.cmdline contains:anycase 'rule' AND src.process.cmdline contains:anycase 'action=allow' AND src.process.cmdline contains:anycase 'localport=') OR (src.process.cmdline contains:anycase 'firewall' AND src.process.cmdline contains:anycase 'add' AND src.process.cmdline contains:anycase 'portopening')))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Credential Access",
    "name": "PowerShell Credential Prompt",
    "query": "(cmdScript.content contains:anycase 'PromptForCredential(')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueScripts=array_agg_distinct(cmdScript.content) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllScripts = UniqueScripts.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, AllScripts, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "PowerShell NTFS Alternate Data Stream",
    "query": "(cmdScript.content contains:anycase (\"set-content\",\"add-content\") AND cmdScript.content contains:anycase (\"-stream\"))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueScripts=array_agg_distinct(cmdScript.content) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllScripts = UniqueScripts.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, AllScripts, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Malware & Threats",
    "name": "Download Files From Suspicious TLDs",
    "query": "(((url.address contains:anycase '.country/' OR url.address contains:anycase '.stream/' OR url.address contains:anycase '.gdn/' OR url.address contains:anycase '.mom/' OR url.address contains:anycase '.xin/' OR url.address contains:anycase '.kim/' OR url.address contains:anycase '.men/' OR url.address contains:anycase '.loan/' OR url.address contains:anycase '.download/' OR url.address contains:anycase '.racing/' OR url.address contains:anycase '.online/' OR url.address contains:anycase '.science/' OR url.address contains:anycase '.ren/' OR url.address contains:anycase '.gb/' OR url.address contains:anycase '.win/' OR url.address contains:anycase '.top/' OR url.address contains:anycase '.review/' OR url.address contains:anycase '.vip/' OR url.address contains:anycase '.party/' OR url.address contains:anycase '.tech/' OR url.address contains:anycase '.xyz/' OR url.address contains:anycase '.date/' OR url.address contains:anycase '.faith/' OR url.address contains:anycase '.cricket/' OR url.address contains:anycase '.space/' OR url.address contains:anycase '.info/' OR url.address contains:anycase '.vn/' OR url.address contains:anycase '.cm/' OR url.address contains:anycase '.am/' OR url.address contains:anycase '.cc/' OR url.address contains:anycase '.asia/' OR url.address contains:anycase '.ws/' OR url.address contains:anycase '.tk/' OR url.address contains:anycase '.biz/' OR url.address contains:anycase '.su/' OR url.address contains:anycase '.st/' OR url.address contains:anycase '.ge/' OR url.address contains:anycase '.pk/' OR url.address contains:anycase '.nu/' OR url.address contains:anycase '.me/' OR url.address contains:anycase '.ph/' OR url.address contains:anycase '.to/' OR url.address contains:anycase '.tt/' OR url.address contains:anycase '.name/' OR url.address contains:anycase '.tv/' OR url.address contains:anycase '.kz/' OR url.address contains:anycase '.tc/' OR url.address contains:anycase '.mobi/' OR url.address contains:anycase '.study/' OR url.address contains:anycase '.click/' OR url.address contains:anycase '.link/' OR url.address contains:anycase '.trade/' OR url.address contains:anycase '.accountant/' OR url.address contains:anycase '.cf/' OR url.address contains:anycase '.gq/' OR url.address contains:anycase '.ml/' OR url.address contains:anycase '.ga/' OR url.address contains:anycase '.pw/') AND (url.address endswith '.exe' OR url.address endswith '.vbs' OR url.address endswith '.bat' OR url.address endswith '.rar' OR url.address endswith '.ps1' OR url.address endswith '.doc' OR url.address endswith '.docm' OR url.address endswith '.xls' OR url.address endswith '.xlsm' OR url.address endswith '.pptm' OR url.address endswith '.rtf' OR url.address endswith '.hta' OR url.address endswith '.dll' OR url.address endswith '.ws' OR url.address endswith '.wsf' OR url.address endswith '.sct' OR url.address endswith '.zip' OR url.address endswith '.bin')) AND NOT (url.address contains:anycase 'dailyinnovation.biz' OR url.address contains:anycase 'bigolive.tv' OR url.address contains:anycase 'snow.me' OR url.address contains:anycase 'freesudoku.me'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count() by endpoint.name, src.process.name, src.process.verified, url.address\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.name, src.process.verified, url.address, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Malware & Threats",
    "name": "Download Files From Non-Legitimate TLDs",
    "query": "((url.address endswith '.exe' OR url.address endswith '.vbs' OR url.address endswith '.bat' OR url.address endswith '.rar' OR url.address endswith '.ps1' OR url.address endswith '.doc' OR url.address endswith '.docm' OR url.address endswith '.xls' OR url.address endswith '.xlsm' OR url.address endswith '.pptm' OR url.address endswith '.rtf' OR url.address endswith '.hta' OR url.address endswith '.dll' OR url.address endswith '.ws' OR url.address endswith '.wsf' OR url.address endswith '.sct' OR url.address endswith '.zip' OR url.address endswith '.bin') AND NOT (url.address contains:anycase 'LOCAL' OR url.address contains:anycase '.com' OR url.address contains:anycase '.org' OR url.address contains:anycase '.net' OR url.address contains:anycase '.edu' OR url.address contains:anycase '.gov' OR url.address contains:anycase '.int' OR url.address contains:anycase '.uk' OR url.address contains:anycase '.ca' OR url.address contains:anycase '.de' OR url.address contains:anycase '.jp' OR url.address contains:anycase '.fr' OR url.address contains:anycase '.au' OR url.address contains:anycase '.us' OR url.address contains:anycase '.ch' OR url.address contains:anycase '.it' OR url.address contains:anycase '.nl' OR url.address contains:anycase '.se' OR url.address contains:anycase '.no' OR url.address contains:anycase '.es' OR url.address contains:anycase '.cn' OR url.address contains:anycase '.eu' OR url.address contains:anycase '.kr' OR url.address contains:anycase '.io' OR url.address contains:anycase '.ms' OR src.ip.address matches '^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[0-1])\\\\.|192\\\\.168\\\\.|127\\\\.).*' OR dst.ip.address matches '^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[0-1])\\\\.|192\\\\.168\\\\.|127\\\\.).*'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count() by endpoint.name, src.process.name, src.process.verified, url.address, src.ip.address, dst.ip.address\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.name, src.process.verified, url.address, src.ip.address, dst.ip.address, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Command & Control",
    "name": "Ngrok Process Execution",
    "query": "((src.process.name = 'ngrok.exe' AND (src.process.cmdline contains:anycase ' tcp ' OR src.process.cmdline contains:anycase ' http ' OR src.process.cmdline contains:anycase ' authtoken ')) OR (src.process.cmdline contains:anycase ' tcp 139' OR src.process.cmdline contains:anycase ' tcp 445' OR src.process.cmdline contains:anycase ' tcp 3389' OR src.process.cmdline contains:anycase ' tcp 5985' OR src.process.cmdline contains:anycase ' tcp 5986')) OR event.dns.request contains:anycase \"ngrok\"\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, event.dns.request\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, event.dns.request, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Discovery & Reconnaissance",
    "name": "Burp Suite Tool Detected",
    "query": "(event.dns.request contains:anycase 'burpcollaborator.net' OR url.address contains:anycase 'burpcollaborator.net') AND (src.ip.address matches '^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[0-1])\\\\.|192\\\\.168\\\\.|127\\\\.).*' OR dst.ip.address matches '^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[0-1])\\\\.|192\\\\.168\\\\.|127\\\\.).*')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count() by endpoint.name, src.process.name, src.process.verified, event.dns.request, url.address, src.ip.address, dst.ip.address\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.name, src.process.verified, event.dns.request, url.address, src.ip.address, dst.ip.address, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Lateral Movement",
    "name": "Impacket Wmiexec Module",
    "query": "(src.process.parent.name = 'wmiprvse.exe' AND (src.process.cmdline contains:anycase '\\\\127.0.0.1' OR src.process.cmdline matches '.*\\\\\\\\__[0-9]{10}\\\\.[0-9]{6}.*' OR src.process.cmdline contains:anycase '$ProgressPreference=' OR src.process.cmdline matches '^cmd\\.exe /q /c .*' OR src.process.cmdline matches '^powershell\\.exe -nop -e .*'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Discovery & Reconnaissance",
    "name": "WMIC Command To Determine The Antivirus",
    "query": "(((src.process.cmdline contains:anycase 'WMIC' AND src.process.cmdline contains:anycase 'AntiVirusProduct') AND NOT (src.process.parent.name in ('pycharm64.exe', 'idea64.exe'))) OR (cmdScript.content contains:anycase 'WMIC' AND cmdScript.content contains:anycase 'AntiVirusProduct') OR (src.process.cmdline contains:anycase 'wmic' AND src.process.cmdline contains:anycase 'FirewallProduct') OR (cmdScript.content contains:anycase 'wmi' AND cmdScript.content contains:anycase 'FirewallProduct'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueScripts=array_agg_distinct(cmdScript.content) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllScripts = UniqueScripts.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, AllScripts, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "Dism Disabling Windows Defender",
    "query": "(src.process.name = 'dism.exe' AND src.process.cmdline contains:anycase '/Disable-Feature' AND src.process.cmdline contains:anycase 'Windows-Defender')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Impact",
    "name": "WMIC Uninstall Product",
    "query": "(src.process.cmdline contains:anycase 'product' AND src.process.cmdline contains:anycase 'name' AND src.process.cmdline contains:anycase 'call' AND src.process.cmdline contains:anycase 'uninstall')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "Attrib.exe hidden files",
    "query": "(tgt.process.name = \"attrib.exe\" AND tgt.process.cmdline contains:anycase \" +h \") NOT (tgt.process.cmdline contains:anycase (\"+R +H +S +A *.cui\", \"\\\\desktop.ini\", \"c:\\\\windows\\\\temp\",\".drawio.dtmp\",\".drawio.bkp\"))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueTgtCmdlines=array_agg_distinct(tgt.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, tgt.process.name, tgt.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllTgtCmdlines = UniqueTgtCmdlines.to_string(', ')\n| columns \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, tgt.process.name, tgt.process.verified, AllSrcCmdlines, AllTgtCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "Suspicious Double Extension",
    "query": "#filepath contains:anycase (\".doc.bat\",\".doc.dll\",\".doc.exe\",\".doc.htm\",\".doc.iso\",\".doc.jar\",\".doc.js\",\".doc.rar\",\".doc.sfx\",\".doc.vbs\",\".doc.zip\",\".docx.bat\",\".docx.dll\",\".docx.exe\",\".docx.htm\",\".docx.iso\",\".docx.jar\",\".docx.js\",\".docx.rar\",\".docx.sfx\",\".docx.vbs\",\".docx.zip\",\".jpg.exe\",\".jpg.iso\",\".jpg.rar\",\".jpg.zip\",\".pdf.bat\",\".pdf.exe\",\".pdf.htm\",\".pdf.iso\",\".pdf.jar\",\".pdf.js\",\".pdf.rar\",\".pdf.sfx\",\".pdf.vbs\",\".pdf.zip\",\".ppt.bat\",\".ppt.dll\",\".ppt.exe\",\".ppt.htm\",\".ppt.iso\",\".ppt.jar\",\".ppt.js\",\".ppt.rar\",\".ppt.sfx\",\".ppt.vbs\",\".ppt.zip\",\".pptx.bat\",\".pptx.dll\",\".pptx.exe\",\".pptx.htm\",\".pptx.iso\",\".pptx.jar\",\".pptx.js\",\".pptx.rar\",\".pptx.sfx\",\".pptx.vbs\",\".pptx.zip\",\".rar.exe\",\".rar.iso\",\".rtf.bat\",\".rtf.dll\",\".rtf.exe\",\".rtf.htm\",\".rtf.jar\",\".rtf.js\",\".rtf.sfx\",\".rtf.vbs\",\".txt.bat\",\".txt.dll\",\".txt.exe\",\".txt.htm\",\".txt.iso\",\".txt.jar\",\".txt.js\",\".txt.sfx\",\".txt.vbs\",\".xls.bat\",\".xls.dll\",\".xls.exe\",\".xls.htm\",\".xls.iso\",\".xls.jar\",\".xls.js\",\".xls.rar\",\".xls.sfx\",\".xls.vbs\",\".xls.zip\",\".xlsx.bat\",\".xlsx.dll\",\".xlsx.exe\",\".xlsx.htm\",\".xlsx.iso\",\".xlsx.jar\",\".xlsx.js\",\".xlsx.rar\",\".xlsx.sfx\",\".xlsx.vbs\",\".xlsx.zip\",\".zip.exe\",\".zip.iso\",\".pdf.msi\")\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, src.process.image.path, tgt.file.path, tgt.file.originalFileName\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, src.process.image.path, tgt.file.path , tgt.file.originalFileName, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Credential Access",
    "name": "WiFi Credentials Harvesting Using Netsh",
    "query": "(src.process.cmdline contains:anycase 'wlan' AND src.process.cmdline contains:anycase 'profile' AND src.process.cmdline contains:anycase 'key' AND src.process.cmdline contains:anycase 'clear')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "ETW Tampering",
    "query": "(((src.process.cmdline contains:anycase 'sl' AND src.process.cmdline contains:anycase '/e:false') OR (src.process.cmdline contains:anycase 'sl' AND src.process.cmdline contains:anycase '/enabled:false') OR src.process.cmdline contains:anycase 'set-log' OR (src.process.cmdline contains:anycase 'logman' AND src.process.cmdline contains:anycase 'update' AND src.process.cmdline contains:anycase '--p' AND src.process.cmdline contains:anycase '-ets') OR src.process.cmdline contains:anycase 'set-etwtraceprovider' OR src.process.cmdline contains:anycase 'remove-etwtraceprovider') AND NOT (src.process.cmdline contains:anycase 'Microsoft-Windows-PrintService'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & LOLBAS",
    "name": "Suspicious Windows Script Execution",
    "query": "(((src.process.name in ('wscript.exe', 'cscript.exe') AND (src.process.cmdline contains:anycase 'C:\\\\Users\\\\*\\\\Roaming\\\\' OR src.process.cmdline contains:anycase 'C:\\\\ProgramData\\\\') AND src.process.cmdline contains:anycase '.txt' AND (src.process.cmdline contains:anycase '/E:jscript' OR src.process.cmdline contains:anycase '/E:vbscript'))) OR (src.process.name in ('wscript.exe', 'cscript.exe') AND src.process.cmdline contains:anycase '/b' AND src.process.cmdline contains:anycase '.js'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Discovery & Reconnaissance",
    "name": "AdFind Usage",
    "query": "(src.process.name = 'adfind.exe' OR (src.process.cmdline contains:anycase ' -f ' AND src.process.cmdline contains:anycase 'category=') OR src.process.cmdline contains:anycase 'trustdmp' OR src.process.cmdline contains:anycase ' -gcb' OR (src.process.cmdline contains:anycase ' -gc' AND src.process.cmdline contains:anycase ' -sc ') OR src.process.cmdline contains:anycase ' -subnets ')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & TTPs",
    "name": "Suspicious Headless Web Browser Execution To Download File",
    "query": "(src.process.name contains:anycase (\"chrome.exe\", \"msedge.exe\")) AND (src.process.cmdline contains:anycase (\"--headless\",\"--dump-dom\")) AND src.process.cmdline contains:anycase \"http\"\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Credential Access",
    "name": "Copying Browser Files With Credentials",
    "query": "((src.process.name = 'esentutl.exe' OR src.process.cmdline contains:anycase 'copy ' OR src.process.cmdline contains:anycase 'Copy-Item') AND ((src.process.cmdline contains:anycase '\\\\User Data\\\\Default\\\\Login Data' OR src.process.cmdline contains:anycase '\\\\User Data\\\\Default\\\\Network\\\\Cookie') OR (src.process.cmdline contains:anycase '\\\\Profiles\\\\' AND (src.process.cmdline contains:anycase 'cookies.sqlite' OR src.process.cmdline contains:anycase 'key3.db' OR src.process.cmdline contains:anycase 'logins.json')) OR (src.process.cmdline contains:anycase '\\\\Opera Stable\\\\Login Data' OR src.process.cmdline contains:anycase '\\\\Opera Stable\\\\Cookies')))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & TTPs",
    "name": "Execution From Suspicious Folder",
    "query": "((src.process.image.path contains:anycase 'C:\\\\Perflogs\\\\' OR src.process.image.path contains:anycase '\\\\$Recycle.bin\\\\' OR src.process.image.path contains:anycase '\\\\config\\\\systemprofile\\\\' OR src.process.image.path contains:anycase '\\\\Intel\\\\Logs\\\\' OR src.process.image.path contains:anycase '\\\\RSA\\\\MachineKeys\\\\' OR src.process.image.path contains:anycase '\\\\Users\\\\All Users\\\\' OR src.process.image.path contains:anycase '\\\\Users\\\\Default\\\\' OR src.process.image.path contains:anycase '\\\\Users\\\\NetworkService\\\\' OR src.process.image.path contains:anycase '\\\\Users\\\\Public\\\\' OR src.process.image.path contains:anycase '\\\\Windows\\\\addins\\\\' OR src.process.image.path contains:anycase '\\\\Windows\\\\debug\\\\' OR src.process.image.path contains:anycase '\\\\Windows\\\\Fonts\\\\' OR src.process.image.path contains:anycase '\\\\Windows\\\\Help\\\\' OR src.process.image.path contains:anycase '\\\\Windows\\\\IME\\\\' OR src.process.image.path contains:anycase '\\\\Windows\\\\Media\\\\' OR src.process.image.path contains:anycase '\\\\Windows\\\\repair\\\\' OR src.process.image.path contains:anycase '\\\\Windows\\\\security\\\\' OR src.process.image.path contains:anycase '\\\\Windows\\\\System32\\\\Tasks\\\\' OR src.process.image.path contains:anycase '\\\\Windows\\\\Tasks\\\\') AND NOT (src.process.image.path contains:anycase 'firefox' OR src.process.image.path contains:anycase 'citrix' OR src.process.image.path contains:anycase 'splunkd.exe' OR src.process.image.path contains:anycase 'ldapadmin.exe' OR src.process.image.path contains:anycase 'acslaunch_win' OR src.process.image.path contains:anycase 'gotoassist' OR src.process.user contains:anycase (\"system\",\"système\")))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, src.process.image.path\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, src.process.image.path, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "RDP Sensitive Settings Changed",
    "query": "(event.type in ('Registry Value Set', 'Registry Value Create')) AND // Terminal Server\\\\fDenyTSConnections => 0 RDP ON \n(registry.keyPath contains:anycase '\\\\services\\\\TermService\\\\Parameters\\\\ServiceDll' OR registry.keyPath contains:anycase '\\\\Control\\\\Terminal Server\\\\fSingleSessionPerUser' OR registry.keyPath contains:anycase '\\\\Control\\\\Terminal Server\\\\fDenyTSConnections' OR registry.keyPath contains:anycase '\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\Shadow' OR registry.keyPath contains:anycase '\\\\Control\\\\Terminal Server\\\\WinStations\\\\RDP-Tcp\\\\InitialProgram' OR registry.keyPath contains:anycase '\\\\Control\\\\Terminal Server\\\\WinStations\\\\RDP-Tcp\\\\UserAuthentication')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count() by endpoint.name, src.process.name, src.process.verified, registry.keyPath, registry.value\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.name, src.process.verified, registry.keyPath, registry.value, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Command & Control",
    "name": "Telegram Bot API Request",
    "query": "(event.dns.request contains:anycase 'api.telegram.org' OR url.address contains:anycase 'api.telegram.org')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count() by endpoint.name, src.process.name, src.process.verified, event.dns.request, url.address\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.name, src.process.verified, event.dns.request, url.address, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Exfiltration",
    "name": "Exfiltration Domain In Command Line",
    "query": "(src.process.cmdline contains:anycase 'httpbin.org' OR src.process.cmdline contains:anycase 'httpdump.io' OR src.process.cmdline contains:anycase 'pie.dev' OR src.process.cmdline contains:anycase 'requestbin.com' OR src.process.cmdline contains:anycase 'requestcatcher.com' OR src.process.cmdline contains:anycase 'requestinspector.com' OR src.process.cmdline contains:anycase 'typedwebhook.tools' OR src.process.cmdline contains:anycase 'webhook.site' OR src.process.cmdline contains:anycase 'webhookinbox.com')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "Suspicious XOR Encoded PowerShell Command Line",
    "query": "((src.process.name in ('powershell.exe', 'powershell_ise.exe') AND ( (src.process.cmdline contains:anycase 'char' AND src.process.cmdline contains:anycase 'bxor' AND src.process.cmdline contains:anycase 'join') OR (cmdScript.content contains:anycase 'char' AND cmdScript.content contains:anycase 'bxor' AND cmdScript.content contains:anycase 'join') )) AND NOT (cmdScript.content contains:anycase '\\program files\\sentinelone' OR cmdScript.content contains:anycase 'windowspowershell\\modules\\dbatools\\allcommands.ps1'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueScripts=array_agg_distinct(cmdScript.content) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllScripts = UniqueScripts.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, AllScripts, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Discovery & Reconnaissance",
    "name": "Advanced IP Scanner",
    "query": "(src.process.cmdline contains:anycase 'advanced_ip_scanner' OR src.process.name contains:anycase 'advanced_ip_scanner' OR tgt.file.path contains:anycase 'advanced_ip_scanner' OR (src.process.cmdline contains:anycase '/portable' AND src.process.cmdline contains:anycase '/lng'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, tgt.file.path\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, tgt.file.path, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Malware & Threats",
    "name": "Possible Malicious File Double Extension from URL",
    "query": "(url.address endswith '.doc.exe' OR url.address endswith '.pdf.exe' OR url.address endswith '.ppt.exe' OR url.address endswith '.docx.exe' OR url.address endswith '.pptx.exe' OR url.address endswith '.xls.exe' OR url.address endswith '.xlsx.exe' OR url.address endswith '.txt.exe' OR url.address endswith '.jpg.exe' OR url.address endswith '.rar.exe' OR url.address endswith '.zip.exe' OR url.address endswith '.doc.iso' OR url.address endswith '.pdf.iso' OR url.address endswith '.ppt.iso' OR url.address endswith '.docx.iso' OR url.address endswith '.pptx.iso' OR url.address endswith '.xls.iso' OR url.address endswith '.xlsx.iso' OR url.address endswith '.txt.iso' OR url.address endswith '.jpg.iso' OR url.address endswith '.rar.iso' OR url.address endswith '.zip.iso')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count() by endpoint.name, src.process.name, src.process.verified, url.address\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.name, src.process.verified, url.address, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Credential Access",
    "name": "KeePass Config XML In Command-Line",
    "query": "(src.process.cmdline contains:anycase 'keepass' AND src.process.cmdline contains:anycase 'config.xml')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion & Execution",
    "name": "CreateRemoteThread Common Process Injection",
    "query": "( (indicator.name contains:anycase 'ProcessInjection' OR indicator.category = 'injection' OR event.type = 'Cross Process Thread Create') AND (tgt.process.name in ('rundll32.exe', 'dllhost.exe', 'lsass.exe', 'svchost.exe', 'wermgr.exe', 'bash.exe', 'cvtres.exe', 'defrag.exe', 'dnx.exe', 'esentutl.exe', 'excel.exe', 'expand.exe', 'explorer.exe', 'find.exe', 'findstr.exe', 'forfiles.exe', 'git.exe', 'gpupdate.exe', 'hh.exe', 'iexplore.exe', 'installutil.exe', 'lync.exe', 'makecab.exe', 'mdnsresponder.exe', 'monitoringhost.exe', 'msbuild.exe', 'mshta.exe', 'msiexec.exe', 'mspaint.exe', 'outlook.exe', 'ping.exe', 'powershell.exe', 'provtool.exe', 'python.exe', 'regsvr32.exe', 'robocopy.exe', 'runonce.exe', 'sapcimc.exe', 'schtasks.exe', 'smartscreen.exe', 'spoolsv.exe', 'tstheme.exe', 'vssadmin.exe', 'vssvc.exe', 'w3wp.exe', 'winlogon.exe', 'winscp.exe', 'wmic.exe', 'word.exe', 'wscript.exe', 'cscript.exe', 'winword.exe') OR (tgt.process.image.path contains:anycase 'lsass.exe' AND NOT src.process.name in ('mmc.exe', 'sysmon64.exe', 'sysmon.exe', 'werfault.exe')) OR (indicator.metadata contains:anycase 'kernel32.dll' AND (indicator.metadata contains:anycase 'LoadLibraryA' OR indicator.metadata contains:anycase 'LoadLibraryExA' OR indicator.metadata contains:anycase 'LoadLibraryW' OR indicator.metadata contains:anycase 'LoadLibraryExW'))) )\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), IndDesc=any(indicator.description), UniqueIndMeta=array_agg_distinct(indicator.metadata, 10) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, tgt.process.name, tgt.process.image.path, indicator.name, event.type\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllIndMeta = UniqueIndMeta.to_string(' | ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, tgt.process.name, tgt.process.image.path, indicator.name, IndDesc, AllIndMeta, event.type, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & TTPs",
    "name": "Rare Lsass Child Found",
    "query": "(src.process.parent.name = 'lsass.exe' AND (src.process.parent.image.path contains:anycase '\\\\windows\\\\system32' OR src.process.parent.image.path contains:anycase '\\\\windows\\\\syswow64') AND NOT src.process.name in ('efsui.exe', 'nxserver.bin', 'nxnode.bin', 'mfeepehost.exe', 'epepccredentialproviderhelper.exe', '6432transport.exe', 'lsass.exe', 'installerevents.exe', 'werfault.exe'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, src.process.parent.image.path\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, src.process.parent.image.path, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Exfiltration",
    "name": "Python HTTP Server",
    "query": "((src.process.cmdline contains:anycase 'python' AND src.process.cmdline contains:anycase ' -m ' AND (src.process.cmdline contains:anycase 'http.server' OR src.process.cmdline contains:anycase 'SimpleHTTPServer')) OR (cmdScript.content contains:anycase 'python' AND cmdScript.content contains:anycase ' -m ' AND (cmdScript.content contains:anycase 'http.server' OR cmdScript.content contains:anycase 'SimpleHTTPServer')))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueScripts=array_agg_distinct(cmdScript.content) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllScripts = UniqueScripts.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, AllScripts, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Helper & Utilities",
    "name": "HELPER - Storyline ID Hunting",
    "query": "#storylineid contains \"STORYLINE_ID_HERE\" \n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueTgtCmdlines=array_agg_distinct(tgt.process.cmdline), UniqueTgtFiles=array_agg_distinct(tgt.file.path), UniqueScripts=array_agg_distinct(cmdScript.content) by event.type, src.process.storyline.id, src.process.pid, src.process.parent.name, src.process.name, src.process.verified, tgt.process.name, event.dns.request, dst.ip.address, dst.port.number\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllTgtCmdlines = UniqueTgtCmdlines.to_string(', '), AllTgtFiles = UniqueTgtFiles.to_string(', '), AllScripts = UniqueScripts.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, event.type, src.process.storyline.id, src.process.pid, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, tgt.process.name, AllTgtCmdlines, AllTgtFiles, AllScripts, event.dns.request, dst.ip.address, dst.port.number, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Helper & Utilities",
    "name": "HELPER - Get All Indicator names from one endpoint",
    "query": "endpoint.name contains \"ENDPOINT_NAME_HERE\"\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), IndDesc=any(indicator.description), UniqueIndMeta=array_agg_distinct(indicator.metadata, 10), UniqueUsers=array_agg_distinct(src.process.user) by indicator.category, indicator.name\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllIndMeta = UniqueIndMeta.to_string(' | '), AllUsers = UniqueUsers.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, indicator.category, indicator.name, IndDesc, AllUsers, AllIndMeta, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Exfiltration",
    "name": "Robocopy - Suspicious Copy From or To System Directory",
    "query": "((src.process.name contains:anycase 'robocopy.exe' OR src.process.name contains:anycase 'xcopy.exe') OR\n(src.process.name contains:anycase 'cmd.exe' AND src.process.cmdline contains:anycase 'copy ') OR\n((src.process.name contains:anycase 'powershell.exe' OR src.process.name contains:anycase 'pwsh.exe') AND\n (src.process.cmdline contains:anycase 'copy-item' OR src.process.cmdline contains:anycase ' copy ' OR src.process.cmdline contains:anycase 'cpi ' OR src.process.cmdline contains:anycase ' cp '))) AND\n(src.process.cmdline contains:anycase '\\\\System32' OR src.process.cmdline contains:anycase '\\\\SysWOW64' OR src.process.cmdline contains:anycase '\\\\WinSxS')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Command & Control",
    "name": "Remote installation of custom chromium extensions",
    "query": "endpoint.os = \"windows\" AND event.type contains:anycase (\"File Creation\", \"File Modification\") AND (tgt.file.path matches:anycase \"\\\\\\\\Secure Preferences$\" OR tgt.file.path matches:anycase \"\\\\\\\\Preferences$\") NOT(src.process.name contains:anycase (\"chrome\",\"edege\",\"spotify\",\"opera\",\"brave\",\"msedgewebview2\",\"HPWPD.exe\"))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, tgt.file.path\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, tgt.file.path, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Installation & Persistence",
    "name": "RMM Process detected",
    "query": "(src.process.name contains:anycase (\"TeamViewer.exe\", \"AnyDesk.exe\", \"ScreenConnect.Client.exe\", \"LogMeIn.exe\", \"SRManager.exe\", \"SplashtopRemoteService.exe\", \"g2comm.exe\", \"g2tray.exe\", \"winvnc.exe\", \"DWRCS.exe\", \"DWRCSMS.exe\", \"rfusclient.exe\", \"rutserv.exe\", \"ZohoAssistService.exe\", \"KaUsrTsk.exe\", \"AgentMon.exe\", \"AteraAgent.exe\", \"pulsewayagent.exe\", \"NinjaRMMAgent.exe\", \"ncentralagent.exe\", \"MWAgent.exe\", \"ITSMService.exe\", \"CloudBerryRemoteAssistant.exe\", \"DomotzAgent.exe\", \"rasagent.exe\", \"client32.exe\", \"pciclient.exe\", \"vncserver.exe\", \"vncviewer.exe\", \"tvnviewer.exe\", \"tvnserver.exe\", \"AA_v3.exe\", \"rpclient.exe\", \"dwagent.exe\", \"isl_light_client.exe\", \"RemoteDesktopManager.exe\", \"Bomgar-scc.exe\", \"bomgar-rep.exe\", \"AweSun.exe\", \"wtserver.exe\", \"Action1Agent.exe\", \"Addigy.app\", \"AeroAdmin.exe\", \"Alpemix.exe\", \"apc_admin.exe\", \"AnyViewer.exe\", \"AuvikAgentService.exe\", \"BYS.exe\", \"BASupSrvc.exe\", \"remoting_host.exe\", \"CrossLoopConnect.exe\", \"CrossTecRemote.exe\", \"CagService.exe\", \"DesktopNow.exe\", \"DistantDesktop.exe\", \"ehorusclientctl.exe\", \"fleetdeck_agent_svc\", \"getscreen.exe\", \"IperiusRemote.exe\", \"JumpCloud.exe\", \"server.exe\", \"MeshAgent.exe\", \"mRemoteNG.exe\", \"naveriskagent.exe\", \"OptiTuneAgent.exe\", \"Panorama9.exe\", \"parsecd.exe\", \"PDQInventory.exe\", \"rserver3.exe\", \"rustdesk.exe\", \"ScreenMeetSupport.app\", \"ScreenMeetSupport.exe\", \"ServerEye.Client.exe\", \"wShowMyPC.exe\", \"simplehelp.exe\", \"Supremo.exe\", \"Syncro.exe\", \"SyspectrAgent.exe\", \"TacticalAgent.exe\", \"techinline.exe\", \"winvnc4.exe\", \"UltraViewer.exe\", \"XMReality.exe\"))\nOR\n(src.process.parent.name contains:anycase (\"TeamViewer\", \"AnyDesk\", \"ScreenConnect.Client\", \"LogMeIn\", \"SRManager\", \"SplashtopRemoteService\", \"g2comm\", \"g2tray\", \"winvnc\", \"DWRCS\", \"DWRCSMS\", \"rfusclient\", \"rutserv\", \"ZohoAssistService\", \"KaUsrTsk\", \"AgentMon\", \"AteraAgent\", \"pulsewayagent\", \"NinjaRMMAgent\", \"ncentralagent\", \"MWAgent\", \"ITSMService\", \"CloudBerryRemoteAssistant\", \"DomotzAgent\", \"rasagent\", \"client32\", \"pciclient\", \"vncserver\", \"vncviewer\", \"tvnviewer\", \"tvnserver\", \"AA_v3\", \"rpclient\", \"dwagent\", \"isl_light_client\", \"RemoteDesktopManager\", \"Bomgar-scc\", \"bomgar-rep\", \"AweSun\", \"wtserver\", \"Action1Agent\", \"Addigy.app\", \"AeroAdmin\", \"Alpemix\", \"apc_admin\", \"AnyViewer\", \"AuvikAgentService\", \"BYS\", \"BASupSrvc\", \"remoting_host\", \"CrossLoopConnect\", \"CrossTecRemote\", \"CagService\", \"DesktopNow\", \"DistantDesktop\", \"ehorusclientctl\", \"fleetdeck_agent_svc\", \"getscreen.exe\", \"IperiusRemote\", \"JumpCloud\", \"server\", \"MeshAgent\", \"mRemoteNG\", \"naveriskagent\", \"OptiTuneAgent\", \"Panorama9\", \"parsecd\", \"PDQInventory\", \"rserver3\", \"rustdesk.exe\", \"ScreenMeetSupport.app\", \"ScreenMeetSupport.exe\", \"ServerEye.Client\", \"wShowMyPC\", \"simplehelp\", \"Supremo\", \"Syncro\", \"SyspectrAgent\", \"TacticalAgent\", \"techinline\", \"winvnc4\", \"UltraViewer\", \"XMReality\"))\nAND\nNOT src.process.cmdline contains:anycase (\"Microsoft.DesktopAppInstaller\",\"Microsoft Azure AD Sync\",\"SAP BusinessObjects\")\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueTgtCmdlines=array_agg_distinct(tgt.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, event.dns.request\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllTgtCmdlines = UniqueTgtCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, AllTgtCmdlines, event.dns.request, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "Anomalous Virtual Machine Installation Detected",
    "query": "#filepath contains:anycase (\".vmdk\",\".ovf\",\".ova\") #filepath contains:anycase (\"kali\",\"parrot\",\"blackarch\",\"exegol\",\"pentest\",\"redteam\",\"purpleteam\",\"reverse\",\"malware\")\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, src.process.image.path, tgt.file.path, tgt.file.originalFileName\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, src.process.image.path, tgt.file.path , tgt.file.originalFileName, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Malware & Threats",
    "name": "Recent ISO Image Mount Activity Detected",
    "query": "indicator.metadata contains:anycase (\"\\\\Microsoft\\\\Windows\\\\Recent\\\\\") indicator.metadata contains:anycase (\".iso.lnk\", \".img.lnk\", \".vhd.lnk\", \".vhdx.lnk\")\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueIndMeta=array_agg_distinct(indicator.metadata, 10) by endpoint.name, indicator.name, src.process.displayName\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllIndMeta = UniqueIndMeta.to_string(' | ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, indicator.name, AllIndMeta, src.process.displayName, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Malware & Threats",
    "name": ".NET ClickOnce installation",
    "query": "src.process.name = \"rundll32.exe\" #cmdline contains:anycase \"ShOpenVerbApplication\" #cmdline contains:anycase (\"http\",\".application\")\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueTgtCmdlines=array_agg_distinct(tgt.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, event.dns.request\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllTgtCmdlines = UniqueTgtCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, AllTgtCmdlines, event.dns.request, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Malware & Threats",
    "name": "Suspicious ZoneIdentifier detected",
    "query": "indicator.name contains:anycase \"WriteToADS\" AND indicator.metadata contains:anycase \"Zone.Identifier\" AND ((indicator.metadata contains:anycase 'C:\\\\Perflogs\\\\' OR indicator.metadata contains:anycase '\\\\$Recycle.bin\\\\' OR indicator.metadata contains:anycase '\\\\config\\\\systemprofile\\\\' OR indicator.metadata contains:anycase '\\\\Intel\\\\Logs\\\\' OR indicator.metadata contains:anycase '\\\\RSA\\\\MachineKeys\\\\' OR indicator.metadata contains:anycase '\\\\Users\\\\All Users\\\\' OR indicator.metadata contains:anycase '\\\\Users\\\\Default\\\\' OR indicator.metadata contains:anycase '\\\\Users\\\\NetworkService\\\\' OR indicator.metadata contains:anycase '\\\\Users\\\\Public\\\\' OR indicator.metadata contains:anycase '\\\\Windows\\\\addins\\\\' OR indicator.metadata contains:anycase '\\\\Windows\\\\debug\\\\' OR indicator.metadata contains:anycase '\\\\Windows\\\\Fonts\\\\' OR indicator.metadata contains:anycase '\\\\Windows\\\\Help\\\\' OR indicator.metadata contains:anycase '\\\\Windows\\\\IME\\\\' OR indicator.metadata contains:anycase '\\\\Windows\\\\Media\\\\' OR indicator.metadata contains:anycase '\\\\Windows\\\\repair\\\\' OR indicator.metadata contains:anycase '\\\\Windows\\\\security\\\\' OR indicator.metadata contains:anycase '\\\\Windows\\\\System32\\\\Tasks\\\\' OR indicator.metadata contains:anycase '\\\\Windows\\\\Tasks\\\\') AND NOT (indicator.metadata contains:anycase 'firefox' OR indicator.metadata contains:anycase 'citrix' OR indicator.metadata contains:anycase 'splunkd.exe' OR indicator.metadata contains:anycase 'ldapadmin.exe' OR indicator.metadata contains:anycase 'acslaunch_win' OR indicator.metadata contains:anycase 'gotoassist' OR src.process.user contains:anycase (\"system\",\"système\")))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), IndDesc=any(indicator.description), UniqueIndMeta=array_agg_distinct(indicator.metadata, 10) by endpoint.name, indicator.name\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllIndMeta = UniqueIndMeta.to_string(' | ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, indicator.name, IndDesc, AllIndMeta, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Helper & Utilities",
    "name": "HELPER - User Activity Hunting",
    "query": "src.process.user contains \"USERNAME_HERE\"\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, event.type, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllCmdlines = UniqueCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, event.type, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Helper & Utilities",
    "name": "HELPER - Process Tree from Parent",
    "query": "(src.process.parent.name contains:anycase \"PARENT_PROCESS_HERE\" OR src.process.name contains:anycase \"PARENT_PROCESS_HERE\") AND endpoint.name contains \"ENDPOINT_NAME_HERE\"\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count() by event.type, src.process.pid, src.process.parent.name, src.process.name, src.process.verified, src.process.cmdline, tgt.process.name, tgt.process.cmdline, src.process.storyline.id\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, event.type, src.process.pid, src.process.parent.name, src.process.name, src.process.verified, src.process.cmdline, tgt.process.name, tgt.process.cmdline, src.process.storyline.id, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Helper & Utilities",
    "name": "HELPER - Network Connections by Endpoint",
    "query": "endpoint.name contains \"ENDPOINT_NAME_HERE\" AND dst.ip.address=*\n| filter NOT (dst.ip.address matches '^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[0-1])\\\\.|192\\\\.168\\\\.|127\\\\.).*')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniquePorts=array_agg_distinct(dst.port.number) by endpoint.name, src.process.name, src.process.verified, dst.ip.address\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllPorts = UniquePorts.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.name, src.process.verified, dst.ip.address, AllPorts, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Helper & Utilities",
    "name": "HELPER - DNS Requests by Endpoint",
    "query": "endpoint.name contains \"ENDPOINT_NAME_HERE\" AND event.dns.request=*\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count() by endpoint.name, src.process.name, src.process.verified, event.dns.request\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.name, src.process.verified, event.dns.request, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Helper & Utilities",
    "name": "HELPER - Unsigned Process Execution",
    "query": "src.process.verified != \"verified\" AND src.process.name=*\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueEndpoints=array_agg_distinct(endpoint.name), UniqueCmdlines=array_agg_distinct(src.process.cmdline) by src.process.name, src.process.image.path, src.process.parent.name, src.process.publisher\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllEndpoints = UniqueEndpoints.to_string(', '), AllCmdlines = UniqueCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, src.process.name, src.process.image.path, src.process.parent.name, src.process.publisher, AllEndpoints, AllCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Helper & Utilities",
    "name": "HELPER - Rare Process by Hash (Fleet-wide)",
    "query": "src.process.image.sha256=*\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), EndpointCount=estimate_distinct(endpoint.name), Count=count(), UniqueEndpoints=array_agg_distinct(endpoint.name), UniqueCmdlines=array_agg_distinct(src.process.cmdline) by src.process.name, src.process.image.sha256, src.process.verified, src.process.publisher\n| filter EndpointCount <= 3\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllEndpoints = UniqueEndpoints.to_string(', '), AllCmdlines = UniqueCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, src.process.name, src.process.image.sha256, src.process.verified, src.process.publisher, EndpointCount, AllEndpoints, AllCmdlines, Count\n| sort +EndpointCount\n| limit 100000"
  },
  {
    "category": "Helper & Utilities",
    "name": "HELPER - Login Activity by Endpoint",
    "query": "endpoint.name contains \"ENDPOINT_NAME_HERE\" AND event.login.userName=*\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count() by endpoint.name, event.type, event.login.userName, event.login.type, event.login.loginIsSuccessful, src.ip.address\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, event.type, event.login.userName, event.login.type, event.login.loginIsSuccessful, src.ip.address, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Helper & Utilities",
    "name": "HELPER - Registry Modifications by Endpoint",
    "query": "(event.type in ('Registry Value Set', 'Registry Value Create')) AND endpoint.name contains \"ENDPOINT_NAME_HERE\"\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueValues=array_agg_distinct(registry.value) by endpoint.name, src.process.name, src.process.verified, registry.keyPath\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllValues = UniqueValues.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.name, src.process.verified, registry.keyPath, AllValues, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "ArgFuscator Command-Line Obfuscation (T1027.010)",
    "query": "endpoint.os = \"windows\" AND (#cmdline contains (\"\u1d43\",\"\u1d47\",\"\u1d9c\",\"\u1d48\",\"\u1d49\",\"\u1da0\",\"\u1d4d\",\"\u02b0\",\"\u02b2\",\"\u1d4f\",\"\u02e1\",\"\u1d50\",\"\u207f\",\"\u1d52\",\"\u1d56\",\"\u02b3\",\"\u02e2\",\"\u1d57\",\"\u1d58\",\"\u1d5b\",\"\u02b7\",\"\u02e3\",\"\u02b8\",\"\u1dbb\") OR (#cmdline contains (\"\uff42\",\"\uff43\",\"\uff44\",\"\uff46\",\"\uff48\",\"\uff49\",\"\uff4a\",\"\uff4b\",\"\uff4d\",\"\uff50\",\"\uff51\",\"\uff52\",\"\uff53\",\"\uff54\",\"\uff55\",\"\uff56\",\"\uff57\",\"\uff58\",\"\uff59\",\"\uff5a\",\"\uff21\",\"\uff24\",\"\uff2a\",\"\uff2b\",\"\uff2f\",\"\uff33\",\"\uff34\",\"\uff35\",\"\uff36\",\"\uff37\",\"\uff38\",\"\uff39\",\"\uff02\",\"\uff10\",\"\uff11\",\"\uff1a\",\"\u00ad\",\"\u034f\",\"\u200b\",\"\u200c\",\"\u200d\",\"\u200e\",\"\u200f\",\"\u202a\",\"\u202b\",\"\u202c\",\"\u202d\",\"\u202e\",\"\u2060\",\"\u2061\",\"\u2062\",\"\u2063\",\"\u2064\",\"\ufeff\") AND src.process.name in (\"adfind.exe\",\"arp.exe\",\"aspnet_compiler.exe\",\"auditpol.exe\",\"bcdedit.exe\",\"cacls.exe\",\"certreq.exe\",\"certutil.exe\",\"cmdkey.exe\",\"cmstp.exe\",\"csc.exe\",\"cscript.exe\",\"curl.exe\",\"dism.exe\",\"driverquery.exe\",\"expand.exe\",\"extrac32.exe\",\"findstr.exe\",\"forfiles.exe\",\"ftp.exe\",\"ipconfig.exe\",\"jsc.exe\",\"makecab.exe\",\"msbuild.exe\",\"msiexec.exe\",\"nbtstat.exe\",\"net.exe\",\"netstat.exe\",\"nltest.exe\",\"nslookup.exe\",\"ping.exe\",\"pnputil.exe\",\"powershell.exe\",\"pwsh.exe\",\"procdump.exe\",\"psexec.exe\",\"query.exe\",\"reg.exe\",\"regedit.exe\",\"regsvr32.exe\",\"robocopy.exe\",\"route.exe\",\"rpcping.exe\",\"runas.exe\",\"schtasks.exe\",\"takeown.exe\",\"tar.exe\",\"taskkill.exe\",\"tasklist.exe\",\"vbc.exe\",\"w32tm.exe\",\"wevtutil.exe\",\"where.exe\",\"whoami.exe\",\"wmic.exe\",\"wscript.exe\")))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueTgtCmdlines=array_agg_distinct(tgt.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllTgtCmdlines = UniqueTgtCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, AllTgtCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Command & Control",
    "name": "Ligolo-ng Tunneling and Ligolo-IWA Browser Pivot",
    "query": "tgt.file.path endswith \".swbn\" OR (src.process.name contains:anycase (\"chrome\",\"msedge\") AND dst.port.number = 11601) OR #cmdline contains:anycase \"enable-isolated-web-app-dev-mode\" OR event.dns.request contains:anycase \"ligolo.ng\" OR (#cmdline contains:anycase \"ligolo\" AND #cmdline contains:anycase (\"-connect\",\"-selfcert\",\"-ignore-cert\",\"agent\",\"proxy\")) OR src.process.name contains:anycase (\"ligolo-agent\",\"ligolo-ng\",\"ligolo-proxy\") OR tgt.process.name contains:anycase (\"ligolo-agent\",\"ligolo-ng\",\"ligolo-proxy\")\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, event.type, event.dns.request, dst.ip.address, dst.port.number, tgt.file.path\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, event.type, event.dns.request, dst.ip.address, dst.port.number, tgt.file.path, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "macOS",
    "name": "macOS LOOBins - Living Off the Orchard (High Confidence)",
    "query": "endpoint.os = \"osx\" AND ((src.process.name = \"security\" AND src.process.cmdline contains:anycase \"dump-keychain\") OR (src.process.name = \"security\" AND src.process.cmdline contains:anycase \"find-generic-password\" AND src.process.cmdline contains:anycase \"Chrome Safe Storage\") OR (src.process.name = \"osascript\" AND src.process.cmdline contains:anycase \"display dialog\" AND src.process.cmdline contains:anycase (\"password\",\"keychain\",\"credential\",\"login\",\"authentif\")) OR (src.process.name = \"sqlite3\" AND src.process.cmdline contains:anycase (\"cookies.sqlite\",\"moz_cookies\",\"Login Data\")) OR (src.process.name = \"log\" AND src.process.cmdline contains:anycase \"eyJ\") OR (#cmdline contains \"com.apple.quarantine\" AND #cmdline contains \"-d\") OR (src.process.name = \"spctl\" AND src.process.cmdline contains:anycase \"--master-disable\") OR (src.process.name = \"log\" AND src.process.cmdline contains:anycase \"erase\" AND src.process.cmdline contains:anycase \"--all\") OR (src.process.name = \"csrutil\" AND src.process.cmdline contains:anycase \"disable\") OR (src.process.name = \"sfltool\" AND src.process.cmdline contains:anycase \"resetbtm\") OR (src.process.name = \"ssh-keygen\" AND src.process.cmdline contains:anycase \".dylib\") OR (src.process.name = \"tclsh\" AND src.process.cmdline contains:anycase \".dylib\") OR (src.process.cmdline contains:anycase \"LoginHook\") OR (src.process.name = \"sysadminctl\" AND src.process.cmdline contains:anycase (\"-addUser\",\"-resetPasswordFor\",\"-smbGuestAccess\",\"-afpGuestAccess\")) OR (src.process.name = \"networksetup\" AND src.process.cmdline contains:anycase (\"-setwebproxy\",\"-setsecurewebproxy\",\"-setautoproxyurl\")) OR (src.process.name = \"systemsetup\" AND src.process.cmdline contains:anycase (\"-setremotelogin\",\"-setremoteappleevents\")))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Exfiltration",
    "name": "Cloud Storage Exfiltration Domain Hits",
    "query": "event.dns.request contains:anycase (\"api.backblazeb2.com\", \"backblazeb2.com\", \"api.dropboxapi.com\", \"content.dropboxapi.com\", \"dropboxapi.com\", \"dropbox.com\", \"g.api.mega.co.nz\", \"upload.mega.co.nz\", \"userstorage.mega.co.nz\", \"static.mega.co.nz\", \"api.mega.co.nz\", \"mega.co.nz\", \"mega.nz\", \"mega.io\", \"api.pcloud.com\", \"pcloud.com\", \"mediafire.com\", \"4shared.com\", \"api.4shared.com\", \"fex.net\", \"api.fex.net\", \"bublup.com\", \"api.bublup.com\", \"gofile.io\", \"store1.gofile.io\", \"store2.gofile.io\", \"api.gofile.io\", \"anonfiles.com\", \"api.anonfiles.com\", \"bashupload.com\", \"temp.sh\", \"transfer.sh\", \"tempsend.com\", \"sendspace.com\", \"file.io\", \"catbox.moe\", \"files.catbox.moe\", \"dropmefiles.com\", \"easyupload.io\", \"ufile.io\", \"qaz.im\", \"privat.lab\", \"share.riseup.net\", \"transfert-my-files.com\", \"oshi.at\", \"send.exploit.in\", \"bayfiles.com\", \"filetransfer.io\", \"myftp.biz\", \"myftp.org\") or url.address contains:anycase (\"api.backblazeb2.com\", \"backblazeb2.com\", \"api.dropboxapi.com\", \"content.dropboxapi.com\", \"dropboxapi.com\", \"dropbox.com\", \"g.api.mega.co.nz\", \"upload.mega.co.nz\", \"userstorage.mega.co.nz\", \"static.mega.co.nz\", \"api.mega.co.nz\", \"mega.co.nz\", \"mega.nz\", \"mega.io\", \"api.pcloud.com\", \"pcloud.com\", \"mediafire.com\", \"4shared.com\", \"api.4shared.com\", \"fex.net\", \"api.fex.net\", \"bublup.com\", \"api.bublup.com\", \"gofile.io\", \"store1.gofile.io\", \"store2.gofile.io\", \"api.gofile.io\", \"anonfiles.com\", \"api.anonfiles.com\", \"bashupload.com\", \"temp.sh\", \"transfer.sh\", \"tempsend.com\", \"sendspace.com\", \"file.io\", \"catbox.moe\", \"files.catbox.moe\", \"dropmefiles.com\", \"easyupload.io\", \"ufile.io\", \"qaz.im\", \"privat.lab\", \"share.riseup.net\", \"transfert-my-files.com\", \"oshi.at\", \"send.exploit.in\", \"bayfiles.com\", \"filetransfer.io\", \"myftp.biz\", \"myftp.org\")\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, event.dns.request, url.address\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, event.dns.request, url.address, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Credential Access",
    "name": "Sensitive Registry Hives Dumped via Reg.exe",
    "query": "src.process.name = 'reg.exe' AND src.process.cmdline contains:anycase ('save','export') AND src.process.cmdline contains:anycase ('hklm','hkey_local_machine') AND (src.process.cmdline endswith 'system' OR src.process.cmdline endswith 'sam' OR src.process.cmdline endswith 'security' OR src.process.cmdline contains:anycase ('hklm\\\\sam','hkey_local_machine\\\\sam','hklm\\\\security','hkey_local_machine\\\\security','hklm\\\\system','hkey_local_machine\\\\system')) AND NOT (src.process.parent.name = 'MdmDiagnosticsTool.exe' OR src.process.cmdline contains:anycase ('mdmdiagnostics','HomeGroupProvider','WlanAPIPermissions','TimeZoneInformation','Omnissa') OR src.process.parent.cmdline contains:anycase ('LicensingDiag','SentinelOne','Dell\\\\SupportAssist\\\\Agent\\\\'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Credential Access",
    "name": "Credential Harvesting via VaultCmd",
    "query": "src.process.name = 'vaultcmd.exe' AND src.process.cmdline contains:anycase '/list'\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Credential Access",
    "name": "Rubeus Kerberos Abuse Command-Line",
    "query": "NOT (src.process.name contains:anycase 'java') AND (src.process.cmdline contains:anycase ('asktgt','asktgs','currentluid','tgssub','createnetonly','kerberoast','asreproast','aspreproast','tgtdeleg') OR (src.process.cmdline contains:anycase ('renew','brute','s4u','golden','silver','ptt','describe','triage','dump','monitor','harvest') AND src.process.cmdline contains:anycase ('/ptt:','/ticket:','/dc:','/autorenew','/password:','/noticket','/rc4:','/aes128:','/aes256:','/nopac','/impersonateuser:','/msdsspn:','/altservice:','/bronzebit:','/luid:')))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Credential Access",
    "name": "Certify / Certipy AD CS Abuse",
    "query": "(src.process.name in ('Certify.exe','certipy.exe') OR src.process.cmdline contains:anycase (' certipy ','certipy.exe','certipy find','certipy auth','certipy req') OR tgt.file.path contains:anycase 'Certify.exe.log') AND NOT (src.process.image.path contains:anycase 'CertifyTheWeb')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Credential Access",
    "name": "PuTTY Saved Sessions Enumeration",
    "query": "(registry.keyPath contains:anycase 'SimonTatham\\\\PuTTY\\\\Sessions' OR registry.keyPath contains:anycase 'PuTTY\\\\Sessions' OR (src.process.cmdline contains:anycase 'PuTTY' AND src.process.cmdline contains:anycase 'Sessions' AND src.process.cmdline contains:anycase 'Software')) AND NOT (src.process.name in ('regedit.exe','putty.exe','setuphost.exe','pageant.exe'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, registry.keyPath, registry.value\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, registry.keyPath, registry.value, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Discovery & Reconnaissance",
    "name": "PowerView Domain Enumeration Commandlets",
    "query": "(src.process.cmdline contains:anycase ('Add-DomainGroupMember','Add-DomainObjectAcl','Find-DomainLocalGroupMember','Find-DomainProcess','Find-DomainShare','Find-DomainUserLocation','Find-InterestingDomainAcl','Find-InterestingDomainShareFile','Get-DomainComputer','Get-DomainController','Get-DomainGPO','Get-DomainGPOLocalGroup','Get-DomainGroup','Get-DomainGroupMember','Get-DomainObjectAcl','Get-DomainOU','Get-DomainPolicy','Get-DomainSID','Get-DomainSPNTicket','Get-DomainTrust','Get-DomainTrustMapping','Get-DomainUser','Get-ForestDomain','Get-NetComputer','Get-NetDomain','Get-NetDomainController','Get-NetForestDomain','Get-NetGroup','Get-NetGroupMember','Get-NetLocalGroup','Get-NetLocalGroupMember','Get-NetLoggedon','Get-NetSession','Get-NetShare','Get-NetUser','Get-ObjectAcl','Invoke-ACLScanner','Invoke-Kerberoast','Invoke-UserImpersonation','Request-SPNTicket','Set-DomainObject','Set-DomainUserPassword','Find-LocalAdminAccess','Invoke-CheckLocalAdminAccess','Get-NetRDPSession','Get-CachedRDPConnection') OR cmdScript.content contains:anycase ('Add-DomainGroupMember','Add-DomainObjectAcl','Find-DomainLocalGroupMember','Find-DomainProcess','Find-DomainShare','Find-DomainUserLocation','Find-InterestingDomainAcl','Find-InterestingDomainShareFile','Get-DomainComputer','Get-DomainController','Get-DomainGPO','Get-DomainGPOLocalGroup','Get-DomainGroup','Get-DomainGroupMember','Get-DomainObjectAcl','Get-DomainOU','Get-DomainPolicy','Get-DomainSID','Get-DomainSPNTicket','Get-DomainTrust','Get-DomainTrustMapping','Get-DomainUser','Get-ForestDomain','Get-NetComputer','Get-NetDomain','Get-NetDomainController','Get-NetForestDomain','Get-NetGroup','Get-NetGroupMember','Get-NetLocalGroup','Get-NetLocalGroupMember','Get-NetLoggedon','Get-NetSession','Get-NetShare','Get-NetUser','Get-ObjectAcl','Invoke-ACLScanner','Invoke-Kerberoast','Invoke-UserImpersonation','Request-SPNTicket','Set-DomainObject','Set-DomainUserPassword','Find-LocalAdminAccess','Invoke-CheckLocalAdminAccess','Get-NetRDPSession','Get-CachedRDPConnection'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Discovery & Reconnaissance",
    "name": "Active Directory Module Reconnaissance",
    "query": "(src.process.cmdline contains:anycase ('Get-ADDomainController','Get-ADDomain','Get-ADUser','Get-ADComputer','Get-ADGroup','Get-ADTrust','Get-ADForest','Get-AppLockerPolicy') OR cmdScript.content contains:anycase ('Get-ADDomainController','Get-ADDomain','Get-ADUser','Get-ADComputer','Get-ADGroup','Get-ADTrust','Get-ADForest','Get-AppLockerPolicy')) AND NOT (src.process.name = 'WmiPrvSE.exe' OR src.process.cmdline contains:anycase 'Visual Studio Code Host' OR src.process.cmdline contains:anycase '\\\\.vscode\\\\extensions\\\\ms-vscode')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Discovery & Reconnaissance",
    "name": "WMIC Reconnaissance Commands",
    "query": "src.process.name = 'wmic.exe' AND (src.process.cmdline contains:anycase '/Format:' OR (src.process.cmdline contains:anycase 'computersystem' AND src.process.cmdline contains:anycase 'totalphysicalmemory') OR (src.process.cmdline contains:anycase 'csproduct' AND src.process.cmdline contains:anycase 'uuid') OR (src.process.cmdline contains:anycase ' os ' AND src.process.cmdline contains:anycase 'get') OR (src.process.cmdline contains:anycase ' cpu ' AND src.process.cmdline contains:anycase 'get'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Discovery & Reconnaissance",
    "name": "Domain Group & Share Enumeration via Net",
    "query": "src.process.name in ('net.exe','net1.exe') AND ((src.process.cmdline contains:anycase 'group' AND src.process.cmdline contains:anycase '/domain') OR src.process.cmdline contains:anycase ' view' OR (src.process.cmdline contains:anycase 'share' AND NOT src.process.cmdline contains:anycase '/add'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Discovery & Reconnaissance",
    "name": "AdExplorer Snapshot Capture",
    "query": "src.process.name = 'adexplorer.exe' OR (src.process.cmdline contains:anycase 'adexplorer' AND src.process.cmdline contains:anycase ('-snapshot','/snapshot') AND NOT src.process.name in ('java.exe','javaw.exe','snaptool.exe'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Discovery & Reconnaissance",
    "name": "Adidnsdump DNS Record Enumeration",
    "query": "src.process.cmdline contains:anycase 'adidnsdump' OR cmdScript.content contains:anycase 'adidnsdump' OR (tgt.file.path contains:anycase 'adidnsdump' AND tgt.file.path contains:anycase 'records.csv')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Discovery & Reconnaissance",
    "name": "Recon Commands Spawned From Cmd.exe",
    "query": "src.process.parent.name = 'cmd.exe' AND (src.process.cmdline matches:anycase '.*ipconfig\\s+/all.*' OR src.process.cmdline matches:anycase '.*arp\\s+-a.*' OR src.process.cmdline matches:anycase '.*tasklist\\s+-v.*' OR src.process.cmdline matches:anycase '.*sc\\s+query.*')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & LOLBAS",
    "name": "Microsoft Office Product Spawning Windows Shell",
    "query": "src.process.parent.name in ('excel.exe','winword.exe','powerpnt.exe','mspub.exe','visio.exe','outlook.exe','msaccess.exe','eqnedt32.exe','wordpad.exe') AND src.process.name in ('cmd.exe','powershell.exe','powershell_ise.exe','pwsh.exe','wscript.exe','cscript.exe','sh.exe','bash.exe','scrcons.exe','schtasks.exe','regsvr32.exe','hh.exe','wmic.exe','wmiprvse.exe','mshta.exe','rundll32.exe','msiexec.exe','forfiles.exe','scriptrunner.exe','mftrace.exe','AppVLP.exe','msbuild.exe') AND NOT (src.process.cmdline contains:anycase ('zedmail','msoasb','MonitorPrintJobStatus','NetworkDiagnosticsSharing','CheckDevice','PhotoViewer.dll','DseMonitorJob'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & LOLBAS",
    "name": "Microsoft Office Spawning Executable From User Directory",
    "query": "src.process.parent.name in ('winword.exe','excel.exe','powerpnt.exe','mspub.exe','visio.exe') AND src.process.image.path contains:anycase 'C:\\\\Users' AND src.process.image.path endswith '.exe' AND NOT (src.process.image.path endswith 'teams.exe' OR src.process.image.path contains:anycase 'onedrive' OR src.process.name in ('eikonboxnet.exe','eikon.exe'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, src.process.image.path\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, src.process.image.path, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & LOLBAS",
    "name": "Microsoft Office Writing Script or Executable File",
    "query": "src.process.name in ('excel.exe','winword.exe','powerpnt.exe') AND (tgt.file.path endswith '.ps1' OR tgt.file.path endswith '.bat' OR tgt.file.path endswith '.dll' OR tgt.file.path endswith '.exe' OR tgt.file.path endswith '.js' OR tgt.file.path endswith '.ocx' OR tgt.file.path endswith '.com' OR tgt.file.path endswith '.vbs' OR tgt.file.path endswith '.scr' OR tgt.file.path endswith '.hta') AND NOT (tgt.file.path contains:anycase ('INetCache','Microsoft\\\\Office','WebServiceCache','assembly','SOLIDWORKS'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, tgt.file.path\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, tgt.file.path, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & LOLBAS",
    "name": "Web Server Process Spawning Shell (Webshell)",
    "query": "src.process.parent.name in ('w3wp.exe','php-cgi.exe','nginx.exe','httpd.exe','Apache.exe','tomcat.exe','java.exe') AND src.process.name in ('cmd.exe','powershell.exe','powershell_ise.exe','pwsh.exe','mshta.exe','wscript.exe','cscript.exe','mftrace.exe','scriptrunner.exe','forfiles.exe','msiexec.exe','rundll32.exe','wmic.exe','hh.exe','regsvr32.exe','schtasks.exe','scrcons.exe','bash.exe','sh.exe','net.exe','net1.exe','whoami.exe') AND NOT (src.process.cmdline contains:anycase 'Win32_PerfFormattedData_PerfProc_thread' OR src.process.parent.name = 'BodetServiceTomcat.exe' OR src.process.parent.cmdline contains:anycase 'inetpub\\\\temp\\\\apppools')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & LOLBAS",
    "name": "Suspicious Regsvr32 Execution",
    "query": "((src.process.name = 'regsvr32.exe' AND (src.process.cmdline contains:anycase ('\\\\temp\\\\','\\\\Users\\\\Public\\\\','\\\\AppData\\\\') OR src.process.cmdline matches:anycase '.*/i:.*scrobj\\.dll.*' OR src.process.cmdline contains:anycase ('.jpg','.png','.jpeg','.gif','.bmp') OR (src.process.cmdline contains:anycase 'appdata' AND src.process.cmdline contains:anycase '.ocx'))) OR (src.process.parent.name = 'regsvr32.exe' AND src.process.name in ('wscript.exe','cscript.exe','cmd.exe','powershell.exe')) OR (src.process.name = 'regsvr32.exe' AND src.process.parent.name in ('mshta.exe','excel.exe','winword.exe','cscript.exe','wscript.exe'))) AND NOT (src.process.cmdline contains:anycase ('\\\\AppData\\\\Local\\\\Microsoft\\\\TeamsMeetingAddin\\\\','\\\\AppData\\\\Local\\\\GoToMeeting\\\\','\\\\AppData\\\\Roaming\\\\Dropbox\\\\bin\\\\','\\\\AppData\\\\Local\\\\Microsoft\\\\Teams\\\\','AccessibleMarshal.dll','Microsoft.PowerAutomateDesktop'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & LOLBAS",
    "name": "Regasm / Regsvcs Execution From Suspicious Folder",
    "query": "src.process.name in ('regsvcs.exe','regasm.exe') AND src.process.cmdline contains:anycase ('\\\\Users\\\\Public\\\\','\\\\AppData\\\\Local\\\\Temp\\\\','\\\\Downloads\\\\','\\\\Desktop\\\\','\\\\PerfLogs\\\\','\\\\Windows\\\\Temp\\\\','\\\\Start Menu\\\\Programs\\\\Startup\\\\') AND NOT (src.process.cmdline contains:anycase ('\\\\Citrix\\\\','\\\\Virtual Desktop Agent\\\\','conhost.exe','\\\\Veeam\\\\','\\\\Wildix\\\\','regfile','codebase'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & LOLBAS",
    "name": "Control.exe Loading DLL / CPL Payload",
    "query": "src.process.name = 'control.exe' AND src.process.cmdline contains:anycase ('.dll','.jpg','.png','.gif','.bmp','.jpeg','.dat','.cpl:','../../..','/AppData/Local','Users\\\\Public','AppData\\\\Local') AND NOT (src.process.cmdline contains:anycase ('input.dll','keymgr.dll'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & LOLBAS",
    "name": "AccCheckConsole Loading Arbitrary DLL",
    "query": "src.process.name = 'acccheckconsole.exe' AND src.process.cmdline contains:anycase '-window' AND src.process.cmdline contains:anycase '.dll'\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & LOLBAS",
    "name": "xWizard Executing Custom CLSID",
    "query": "src.process.name = 'xwizard.exe' AND src.process.cmdline matches:anycase '.*\\{[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}\\}.*' AND NOT (src.process.parent.image.path in ('C:\\\\Windows\\\\System32\\\\sihost.exe','C:\\\\Windows\\\\System32\\\\RuntimeBroker.exe','C:\\\\Windows\\\\ImmersiveControlPanel\\\\SystemSettings.exe'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & TTPs",
    "name": "VSCode Remote Tunnel Shell Execution",
    "query": "src.process.parent.name = 'powershell.exe' AND src.process.parent.cmdline contains:anycase '.vscode\\\\cli\\\\servers\\\\' AND src.process.parent.cmdline contains:anycase 'shellIntegration.ps1'\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & TTPs",
    "name": "Interactive TTY Spawned via Python",
    "query": "src.process.name contains:anycase 'python' AND src.process.cmdline contains:anycase 'import pty' AND src.process.cmdline contains:anycase 'pty.spawn' AND src.process.cmdline contains:anycase ('sh','bash','dash')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & TTPs",
    "name": "Suspicious Cmd.exe Copy/Start /B Usage",
    "query": "((src.process.cmdline contains:anycase 'cmd' AND src.process.cmdline contains:anycase '/c ' AND src.process.cmdline contains:anycase 'copy' AND src.process.cmdline contains:anycase '/b ') OR (src.process.cmdline contains:anycase 'cmd' AND src.process.cmdline contains:anycase '/c ' AND src.process.cmdline contains:anycase 'start' AND src.process.cmdline contains:anycase '/b ') OR (src.process.cmdline contains:anycase 'cmd' AND src.process.cmdline contains:anycase '/c ' AND src.process.cmdline contains:anycase 'start' AND src.process.cmdline contains:anycase '/I ')) AND NOT (src.process.parent.name in ('pycharm.exe','pycharm64.exe','idea64.exe','code.exe','webstorm64.exe') OR src.process.parent.image.path contains:anycase ('\\\\ninja.exe','\\\\HPUpdate\\\\HPUpdate.exe','\\\\bin\\\\glpi-agent.exe'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Privilege Escalation",
    "name": "Elevated Msiexec Repair Functionality (CVE-2024-38014)",
    "query": "src.process.name = 'msiexec.exe' AND src.process.cmdline contains:anycase ' /f ' AND NOT (src.process.cmdline contains:anycase 'GLPI' AND src.process.cmdline contains:anycase 'Agent')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Privilege Escalation",
    "name": "Local Account Created via Net.exe",
    "query": "src.process.name in ('net.exe','net1.exe') AND src.process.cmdline contains:anycase 'user' AND src.process.cmdline contains:anycase '/add'\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Privilege Escalation",
    "name": "User Added To Admin Group (macOS)",
    "query": "(src.process.name = 'sysadminctl' AND src.process.cmdline contains:anycase '-addUser' AND src.process.cmdline contains:anycase '-admin') OR (src.process.name = 'dscl' AND src.process.cmdline contains:anycase '-append' AND src.process.cmdline contains:anycase 'GroupMembership' AND src.process.cmdline contains:anycase '/Groups/admin') OR (src.process.name = 'dseditgroup' AND src.process.cmdline contains:anycase 'admin' AND src.process.cmdline contains:anycase '-a ' AND src.process.cmdline contains:anycase '-t user')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "Microsoft Defender Exclusion Added",
    "query": "registry.keyPath contains:anycase 'Microsoft\\\\Windows Defender\\\\Exclusions' OR src.process.cmdline contains:anycase ('-ExclusionPath','-ExclusionExtension','-ExclusionProcess','-ExclusionIpAddress') OR cmdScript.content contains:anycase ('-ExclusionPath','-ExclusionExtension','-ExclusionProcess','-ExclusionIpAddress') OR (src.process.cmdline contains:anycase 'reg' AND src.process.cmdline contains:anycase 'add' AND src.process.cmdline contains:anycase 'Windows Defender\\\\Exclusions')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, registry.keyPath, registry.value\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, registry.keyPath, registry.value, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "Microsoft Defender Disabled via Registry",
    "query": "(src.process.cmdline contains:anycase 'reg' AND src.process.cmdline contains:anycase 'add' AND src.process.cmdline contains:anycase 'Policies' AND src.process.cmdline contains:anycase 'Microsoft' AND (src.process.cmdline contains:anycase 'Windows Defender' OR src.process.cmdline contains:anycase 'MRT')) OR (cmdScript.content contains:anycase ('Add-ItemProperty','Set-ItemProperty') AND cmdScript.content contains:anycase 'Policies' AND cmdScript.content contains:anycase 'Windows Defender') OR (registry.keyPath contains:anycase 'Policies\\\\Microsoft\\\\Windows Defender' AND registry.value contains:anycase ('DisableAntiSpyware','DisableRealtimeMonitoring'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, registry.keyPath, registry.value\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, registry.keyPath, registry.value, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "AMSI Provider Removed via Registry",
    "query": "(src.process.name = 'reg.exe' AND src.process.cmdline contains:anycase 'delete' AND src.process.cmdline contains:anycase 'amsi' AND src.process.cmdline contains:anycase 'providers') OR (cmdScript.content contains:anycase 'Remove-Item' AND cmdScript.content contains:anycase 'AMSI' AND cmdScript.content contains:anycase 'Providers') OR (registry.keyPath contains:anycase 'software\\\\microsoft\\\\amsi\\\\providers' AND event.type contains:anycase 'Delete')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, registry.keyPath, registry.value\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, registry.keyPath, registry.value, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "Event Log Service Disabled via MiniNt Key",
    "query": "registry.keyPath contains:anycase 'Control\\\\minint' OR (src.process.cmdline contains:anycase 'add' AND src.process.cmdline contains:anycase 'Control\\\\minint')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, registry.keyPath, registry.value\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, registry.keyPath, registry.value, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "Minifilter Driver Unloaded via FltMC",
    "query": "(src.process.cmdline contains:anycase 'fltmc' AND src.process.cmdline contains:anycase 'unload') OR (src.process.name = 'fltMC.exe' AND src.process.parent.name in ('cmd.exe','powershell.exe','pwsh.exe'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "Windows Firewall Disabled via Netsh",
    "query": "(src.process.cmdline contains:anycase 'advfirewall' AND src.process.cmdline contains:anycase 'state' AND src.process.cmdline contains:anycase 'off') OR (src.process.cmdline contains:anycase 'firewall' AND src.process.cmdline contains:anycase 'opmode' AND src.process.cmdline contains:anycase 'disable')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "Process Explorer Driver (PROCEXP152.sys) Dropped in Temp",
    "query": "tgt.file.path contains:anycase '\\\\AppData\\\\Local\\\\Temp\\\\' AND tgt.file.path contains:anycase 'PROCEXP152.sys' AND NOT (src.process.name in ('procexp64.exe','procexp.exe','procmon64.exe','procmon.exe'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, tgt.file.path\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, tgt.file.path, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "WerFaultSecure Abuse (EDR-Freeze)",
    "query": "src.process.name = 'WerFaultSecure.exe' AND src.process.cmdline contains:anycase '/h' AND src.process.cmdline contains:anycase '/pid' AND src.process.cmdline contains:anycase '/encfile' AND NOT (src.process.parent.cmdline contains:anycase 'wsappx')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Impact",
    "name": "Service Stop & Backup Removal (Ransomware Prep)",
    "query": "((src.process.cmdline contains:anycase 'net' AND src.process.cmdline contains:anycase 'stop' AND src.process.cmdline contains:anycase 'service' AND src.process.cmdline contains:anycase '/y') OR (src.process.cmdline contains:anycase 'sc' AND src.process.cmdline contains:anycase 'config' AND src.process.cmdline contains:anycase 'start=' AND src.process.cmdline contains:anycase 'disabled') OR (src.process.cmdline contains:anycase 'taskkill' AND src.process.cmdline contains:anycase '/im' AND src.process.cmdline contains:anycase '/f')) AND NOT (src.process.cmdline contains:anycase 'taskkill' AND src.process.cmdline contains:anycase '/im' AND src.process.cmdline contains:anycase 'mspub.exe')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Impact",
    "name": "Cryptomining Pool Activity",
    "query": "event.dns.request contains:anycase ('pool.minexmr.com','xmrpool.eu','nanopool.org','supportxmr.com','minexmr.com','f2pool.com','herominers.com','c3pool.com','2miners.com','hashvault.pro','moneroocean.stream','zergpool.com','nicehash.com') OR url.address contains:anycase ('xmrpool','supportxmr','nanopool.org','herominers','moneroocean') OR src.process.cmdline contains:anycase ('stratum+tcp://','stratum+ssl://','--coin monero','--donate-level','xmrig','--cpu-priority','randomx','--rig-id')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, event.dns.request\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, event.dns.request, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Installation & Persistence",
    "name": "IFEO / SilentProcessExit Persistence",
    "query": "(registry.keyPath contains:anycase 'Image File Execution Options\\\\' AND registry.keyPath contains:anycase 'GlobalFlag') OR (registry.keyPath contains:anycase 'SilentProcessExit\\\\' AND registry.keyPath contains:anycase 'ReportingMode') OR (registry.keyPath contains:anycase 'SilentProcessExit\\\\' AND registry.keyPath contains:anycase 'MonitorProcess') OR (src.process.cmdline contains:anycase 'Image File Execution Options' AND src.process.cmdline contains:anycase 'GlobalFlag') OR (src.process.cmdline contains:anycase 'SilentProcessExit' AND src.process.cmdline contains:anycase 'MonitorProcess')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, registry.keyPath, registry.value\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, registry.keyPath, registry.value, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Installation & Persistence",
    "name": "UserInitMprLogonScript Persistence",
    "query": "registry.keyPath contains:anycase 'UserInitMprLogonScript' OR (src.process.cmdline contains:anycase 'UserInitMprLogonScript' AND NOT (src.process.name = 'explorer.exe' OR src.process.cmdline contains:anycase ('netlogon.bat','UsrLogon.cmd','netlogon\\\\default.cmd')))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, registry.keyPath, registry.value\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, registry.keyPath, registry.value, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Installation & Persistence",
    "name": "PowerShell Writing Startup Folder Shortcut",
    "query": "src.process.name in ('powershell.exe','pwsh.exe') AND tgt.file.path contains:anycase 'Startup' AND tgt.file.path contains:anycase 'Start Menu' AND tgt.file.path endswith '.lnk' AND NOT (tgt.file.path contains:anycase ('Citrix Workspace.lnk','setwallpaper.lnk'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, tgt.file.path\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, tgt.file.path, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Installation & Persistence",
    "name": "New Service Created via sc.exe / PowerShell",
    "query": "(src.process.name = 'sc.exe' AND src.process.cmdline contains:anycase 'create' AND src.process.cmdline contains:anycase 'binpath') OR (cmdScript.content contains:anycase 'New-Service' AND cmdScript.content contains:anycase 'BinaryPathName') OR (src.process.cmdline contains:anycase 'New-Service' AND src.process.cmdline contains:anycase 'BinaryPathName')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Installation & Persistence",
    "name": "DNS ServerLevelPluginDll Backdoor",
    "query": "registry.keyPath contains:anycase ('services\\\\DNS\\\\Parameters\\\\ServerLevelPluginDll','services\\\\DNS\\\\InternalParameters\\\\ServerLevelPluginDll') OR (src.process.cmdline contains:anycase 'dnscmd' AND src.process.cmdline contains:anycase '/config' AND src.process.cmdline contains:anycase '/serverlevelplugindll')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, registry.keyPath, registry.value\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, registry.keyPath, registry.value, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Installation & Persistence",
    "name": "IIS Module Installation (Server Backdoor)",
    "query": "(src.process.name = 'appcmd.exe' AND src.process.cmdline contains:anycase ('add','install') AND src.process.cmdline contains:anycase 'module' AND src.process.cmdline contains:anycase 'name:') OR (cmdScript.content contains:anycase 'New-WebGlobalModule' AND cmdScript.content contains:anycase '-Name') OR (src.process.cmdline contains:anycase 'New-WebGlobalModule')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Installation & Persistence",
    "name": "Outlook LoadMacroProviderOnBoot Persistence",
    "query": "registry.keyPath contains:anycase 'LoadMacroProviderOnBoot' OR (src.process.cmdline contains:anycase 'LoadMacroProviderOnBoot' AND src.process.cmdline contains:anycase ('add','Set-ItemProperty','New-ItemProperty'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, registry.keyPath, registry.value\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, registry.keyPath, registry.value, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Execution & TTPs",
    "name": "RDP Configuration File From Mail Client",
    "query": "(src.process.name in ('outlook.exe','thunderbird.exe') AND tgt.file.path endswith '.rdp') OR (src.process.parent.name in ('outlook.exe','thunderbird.exe') AND src.process.name = 'mstsc.exe' AND src.process.cmdline contains:anycase '.rdp')\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, tgt.file.path\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, tgt.file.path, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Exfiltration",
    "name": "File Transfer via PSCP (PuTTY SCP)",
    "query": "src.process.name = 'pscp.exe' AND src.process.cmdline contains:anycase '@' AND src.process.cmdline contains:anycase ':' AND src.process.cmdline contains:anycase '/'\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  },
  {
    "category": "Defense Evasion",
    "name": "Shell History Erased (Linux/macOS)",
    "query": "(src.process.name = 'history' AND src.process.cmdline contains:anycase ('-c','-w')) OR (src.process.name in ('rm','shred','truncate','echo') AND src.process.cmdline contains:anycase ('bash_history','zsh_history')) OR (src.process.name = 'ln' AND src.process.cmdline contains:anycase '-sf' AND src.process.cmdline contains:anycase '/dev/' AND src.process.cmdline contains:anycase ('bash_history','zsh_history'))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, Count\n| sort -Count\n| limit 100000"
  }
]