IoC corpus

Defender XDR hunting query: new remote files downloaded via curl not seen in prior 7 days (DeviceNetworkEvents + SecurityEvent 4688).
let known_files = DeviceNetworkEvents | where TimeGenerated between (ago(7d)..ago(1d)) | where InitiatingProcessFileName has "curl" | extend url = extract("http[s]?:\\/\\/(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\\(\\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+", 0,InitiatingProcessCommandLine) | extend ip = extract("(\\b25[0-5]|\\b2[0-4][0-9]|\\b[01]?[0-9][0-9]?)(\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}[^ ]*", 0, InitiatingProcessCommandLine) | extend remote_file = iif(isnotempty(url), url, ip) | union (SecurityEvent | where TimeGenerated between (ago(7d)..ago(1d)) | where EventID == 4688 | where CommandLine has "curl" | extend url = extract("http[s]?:\\/\\/(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\\(\\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+", 0,CommandLine) | extend ip = extract("(\\b25[0-5]|\\b2[0-4][0-9]|\\b[01]?[0-9][0-9]?)(\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}[^ ]*", 0, CommandLine) | extend remote_file = iif(isnotempty(url), url, ip)) | summarize by remote_file; DeviceNetworkEvents | where TimeGenerated > ago(1d) | where InitiatingProcessFileName has "curl" | extend url = extract("http[s]?:\\/\\/(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\\(\\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+", 0,InitiatingProcessCommandLine) | extend ip = extract("(\\b25[0-5]|\\b2[0-4][0-9]|\\b[01]?[0-9][0-9]?)(\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}[^ ]*", 0, InitiatingProcessCommandLine) | extend remote_file = iif(isnotempty(url), url, ip) | union (SecurityEvent | where EventID == 4688 | where CommandLine has "curl" | extend url = extract("http[s]?:\\/\\/(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\\(\\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+", 0,CommandLine) | extend ip = extract("(\\b25[0-5]|\\b2[0-4][0-9]|\\b[01]?[0-9][0-9]?)(\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}[^ ]*", 0, CommandLine) | extend remote_file = iif(isnotempty(url), url, ip)) | where remote_file !in (known_files)

Sentinel ASIM query for network sessions to published IOC IPs over 30 days (note: query lists 178.15.54.129 while the IOC table lists 178.16.54[.]129).
let lookback = 30d; let ioc_ip_addr = dynamic(["199.19.95.66", "199.19.95.67", "199.19.95.68", "91.92.240.238", "85.11.168.45", "178.15.54.129", "31.77.229.35", "85.11.167.52"]); _Im_NetworkSession(starttime=todatetime(ago(lookback)), endtime=now()) | where DstIpAddr in (ioc_ip_addr) | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), EventCount=count() by SrcIpAddr, DstIpAddr, DstDomain, Dvc, EventProduct, EventVendor

SPN sign-ins from suspicious IP
let startTime = datetime(2026-10-28T00:00:00Z);
let endTime = now();
EntraIdSpnSignInEvents
| where Timestamp between (startTime .. endTime)
| where IPAddress in ("199.19.77.84")
| project Timestamp, TenantId, Application, ApplicationId, ServicePrincipalName, ServicePrincipalId, ResourceDisplayName, ResourceId, ResourceTenantId, IPAddress, ErrorCode, UserAgent, CorrelationId, RequestId
| order by Timestamp asc

Graph API requests from campaign IP
let startTime = datetime(2026-10-28T00:00:00Z);
let endTime = now();
GraphAPIAuditEvents
| where Timestamp between (startTime .. endTime)
| where IpAddress in ("199.19.77.84")
| project Timestamp, TenantId, ApplicationId, ServicePrincipalId, AccountObjectId, IpAddress, RequestMethod, RequestUri, ResponseStatusCode, ResponseSize, Scopes, EntityType, TargetWorkload, UniqueTokenIdentifier, ClientRequestId, OperationId, RequestId
| order by Timestamp asc

M365/Azure cloud activity from campaign IP
let startTime = datetime(2026-10-28T00:00:00Z);
let endTime = now();
CloudAppEvents
| where Timestamp between (startTime .. endTime)
| where IPAddress in ("199.19.77.84")
| project Timestamp, Application, CloudAppId = ApplicationId, ActionType, ActivityType, AccountType, AccountDisplayName, AccountId, AccountObjectId, IPAddress, UserAgent, ObjectName, ObjectType, ObjectId, ActivityObjects, ReportId, RawEventData
| order by Timestamp asc

Suspicious control-plane operations
CloudAuditEvents
| where IPAddress has_any ('199.19.77.84','65.87.223.26')

Possible exfiltration from Storage Accounts
CloudStorageAggregatedEvents
| where IPAddress in ('199.19.77.84','65.87.223.26')
| where SuccessfulOperationsCount > 0

Check for the backdoor's Unix socket ngx_http_integrity_helper; any result indicates infection.
ss -axp | grep integrity

Look for unexpected helper processes started by cwpsrv.
ps aux | grep cwpsrv

Search the cwpsrv binary for backdoor header names.
strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity

Hunt emails from the Salary Review campaign sender
EmailEvents
| where SenderMailFromAddress == “smtp@wekash.net”

Hunt emails from the Spanish-language Agent Tesla campaign sender
EmailEvents | where SenderMailFromAddress == "contacto06@carloxmextos.org"

Inno offer-execution callbacks
DeviceNetworkEvents | where RemoteUrl has "d=inno" | where RemoteUrl has_any ("r=offer_execution", "r=offer_execution_fail") | project Timestamp, DeviceName, RemoteUrl, InitiatingProcessFileName

Payload execution from Inno temporary directories
DeviceProcessEvents | where FolderPath has @"\AppData\Local\Temp\is-" | where FileName matches regex @"(?i)^(eld[0-9]+|set_[0-9]+|FirstFast(?:\[1\])?|SecondRunner(?:\[1\])?)\.exe$" | project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, SHA256

Outbound connections to observed campaign infrastructure
DeviceNetworkEvents | where RemoteUrl has_any ("orbittrack.cfd", "prairielink.cfd", "willowbox.xyz", "stonestation.cfd", "foldlodge.xyz", "friendsanchor.xyz", "fallport.cfd", "wishcourt.cfd", "cratebase.cfd", "belieftrack.cfd", "beliefdesk.xyz", "companyharbor.xyz", "signalpane.cfd", "inkact.xyz", "wishgrove.cfd") | project Timestamp, DeviceName, RemoteUrl, RemotePort, InitiatingProcessFileName

Hunt external Teams chats and impersonation/security-risk call signals.
CloudAppEvents
| where Timestamp > ago(7d)
| where Application == "Microsoft Teams"
| where (ActionType == "ChatCreated" and IsExternalUser == true) or ActionType in~ ( "TeamsImpersonationDetected", "SecurityRiskInCallDetected")
| order by Timestamp desc

Network connections to reported C2 IP
DeviceNetworkEvents | where Timestamp > ago(30d) | where RemoteIP == "134.209.82.225" or RemoteUrl has "134.209.82.225" | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl

File events for hash and persistence artifact names
DeviceFileEvents | where Timestamp > ago(30d) | where SHA256 == "ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15" or FileName in~ ( ".smt", ".smtk", "smt.cmd", "smtk", "sysmon.cmd", "com.apple.sysmond.plist" ) or FileName startswith ".stk_" | project Timestamp, DeviceName, ActionType, FolderPath, FileName, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine

Scheduled task creation containing SysMon and smt
DeviceEvents | where Timestamp > ago(30d) | where ActionType == "ScheduledTaskCreated" | where AdditionalFields has "SysMon" and AdditionalFields has "smt" | project Timestamp, DeviceName, AccountName, AdditionalFields, InitiatingProcessFileName, InitiatingProcessCommandLine

macOS LaunchAgent plist modification
DeviceEvents | where ActionType == "PlistPropertyModified" | where FolderPath has "com.apple.sysmond.plist"

ClamAV signature detecting NIK C2 implant
Win.Trojan.GoDiscorder-10060526-0

Block federation with trial tenants.
Set-CsTenantFederationConfiguration -ExternalAccessWithTrialTenants "Blocked"

Connections to collector domain
DeviceNetworkEvents
| extend UrlForParsing = iff(RemoteUrl contains "://", RemoteUrl, strcat("http://", RemoteUrl))
| extend RemoteHost = trim_end(@"\.", tolower(tostring(parse_url(UrlForParsing).Host)))
| where RemoteHost in ("www.litellm.dev", "litellm.dev")
| project Timestamp, DeviceId, DeviceName, ActionType, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCreationTime, ReportId

Collector-like OpenSSL encryption staging
DeviceProcessEvents
| where FileName in~ ("openssl", "openssl.exe")
| where ProcessCommandLine contains_cs ".pc_e_"
| where (ProcessCommandLine contains_cs " enc " and ProcessCommandLine contains_cs "-aes-256-cbc") or ProcessCommandLine contains_cs " pkeyutl " or ProcessCommandLine contains_cs " rsautl "
| extend CryptoOperation = iff( ProcessCommandLine contains_cs " enc ", "AES packaging", "RSA wrapping")
| project Timestamp, DeviceId, DeviceName, FileName, CryptoOperation, ProcessId, ProcessCreationTime, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCreationTime, ReportId

Inline Python database-collection program reading LiteLLM credential tables
DeviceProcessEvents
| where FileName startswith "python" or FileName startswith "platform-python"
| where strlen(ProcessCommandLine) <= 4096
| where ProcessCommandLine contains_cs "-c "
| where (ProcessCommandLine contains_cs "LiteLLM_CredentialsTable" and ProcessCommandLine contains_cs "credential_values") or (ProcessCommandLine contains_cs "LiteLLM_ProxyModelTable" and ProcessCommandLine contains_cs "litellm_params")
| where ProcessCommandLine contains_cs "query_raw"
| where ProcessCommandLine contains_cs "json.dumps(" or ProcessCommandLine contains_cs "json.dump("
| where ProcessCommandLine contains_cs "os.devnull" and ProcessCommandLine contains_cs "os.dup2"
| project Timestamp, DeviceId, DeviceName, FileName, ProcessId, ProcessCreationTime, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCreationTime, ReportId

Cloud workload OpenSSL key wrapping in /tmp/.pc_ paths
CloudProcessEvents
| where ProcessName == 'openssl' and ProcessCurrentWorkingDirectory has_any ('/runner/','/app','/tmp/') and ProcessCommandLine has_all ('pkeyutl','-encrypt','-pubin') and ProcessCommandLine contains '/tmp/.pc_'

Look for branches named ci-sync- + six chars whose only change is new .github/workflows/sync-check.yml with commit message 'ci: sync config'.
^ci-sync-[0-9a-z]{6}$

YARA rule 'aokigahara' matching strings such as X-Chunk-Index: %u, AKGRES, AISessions/, \\.\pipe\akg_%lx_%lx, kamidere, .ROBLOSECURITY
rule aokigahara
{ meta: author = "@Tera0017/Check Point Research" description = "Aokigahara Stealer" strings: $str1 = "X-Chunk-Index: %u" ascii fullword $str2 = "X-Build-ID: %s" ascii fullword $str3 = "AKGRES" ascii fullword $str4 = "AISessions/" ascii $str5 = "\\\\.\\pipe\\akg_%lx_%lx" ascii fullword $str6 = "sysinfo\x00screenshot\x00clipboard" $str7 = "aokigahara" ascii fullword $str8 = "kamidere" ascii fullword $str9 = "/chunk" ascii fullword $str10 = "%s\\kmd_w_%d_%d.db" ascii fullword $str11 = ".ROBLOSECURITY" ascii fullword $code1 = {45 69 ED B1 79 37 9E 48 C1 EF 11 48 C1 EA 20 41 31 D6 41 31 C6 41 31 FD 45 89 77 04 45 89 6F 08} $code2 = {41 4B 47 52 45 53 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EF BE AD DE } condition: uint16(0) == 0x5A4D and 3 of them
}

Pre-build revocation actions: Okta DELETE /api/v1/users/{id}/sessions?oauthTokens=true; Entra POST /users/{id}/revokeSignInSessions; GitHub DELETE /orgs/{org}/credential-authorizations/{credential_id}; Snowflake PAT disable.
ALTER USER {name} MODIFY PAT {token} SET DISABLED = TRUE

OAuthAppInfo query to find ConnectWise apps present and their permissions
let ConnectWiseApps = dynamic([ "506e08f9-6e9a-4da4-942b-a099a03644ae", // ConnectWise Cloud Backup "24205314-2b89-4e07-a2a4-579e898a5640", // ConnectWise - MS Teams "0de14c77-b9b0-4137-9360-34878a929827" // ConnectWise - MS Graph ]);
OAuthAppInfo
| where OAuthAppId in (ConnectWiseApps)
| mv-expand Permission = Permissions
| extend PermissionName = tostring(Permission.PermissionName), TargetApp = tostring(Permission.TargetAppDisplayName), TargetAppId = tostring(Permission.TargetAppId), PermissionType = tostring(Permission.PermissionType), PermissionPrivilegeLevel = tostring(Permission.PrivilegeLevel), UsageStatus = tostring(Permission.UsageStatus)
| project AppName, OAuthAppId, ServicePrincipalId, AppStatus, PrivilegeLevel, IsAdminConsented, PermissionName, PermissionType, PermissionPrivilegeLevel, TargetApp, TargetAppId, UsageStatus
| order by AppName asc, PermissionPrivilegeLevel desc

SPN sign-ins + Graph API audit events for ConnectWise apps from indicator IPs
let Apps = dynamic([ "506e08f9-6e9a-4da4-942b-a099a03644ae", "24205314-2b89-4e07-a2a4-579e898a5640", "0de14c77-b9b0-4137-9360-34878a929827" ]);
let IPs = dynamic(["144.172.64.60", "144.172.64.99", "144.172.64.128"]);
union kind=outer (EntraIdSpnSignInEvents | extend EventType = "Sign-in"), (GraphAPIAuditEvents | extend EventType = "Graph API", IPAddress = IpAddress)
| where Timestamp >= datetime(2026-10-13)
| where ApplicationId in (Apps)
| where IPAddress in (IPs) // Comment out for broader hunting
| project-away IpAddress
| order by Timestamp asc

Sentinel SigninLogs for ConnectWise app IDs
let IPIndicators = dynamic([ "144.172.64.60", // IP Indicator "144.172.64.99", // IP Indicator "144.172.64.128" // IP Indicator
]);
let ConnectWiseApps = dynamic([ "506e08f9-6e9a-4da4-942b-a099a03644ae", // ConnectWise Cloud Backup "24205314-2b89-4e07-a2a4-579e898a5640", // ConnectWise - MS Teams "0de14c77-b9b0-4137-9360-34878a929827" // ConnectWise - MS Graph ]);
SigninLogs
| where TimeGenerated >= datetime(2026-10-13)
| where AppId in (ConnectWiseApps)
//| where IPAddress in (IPIndicators) // Comment out to review all activity from these applications
| project TimeGenerated, AppId, ServicePrincipalName, ResourceDisplayName, ResourceId, IPAddress, CorrelationId
| order by TimeGenerated asc

ESET detect_ebury.sh checks for Ebury abstract UNIX sockets (1.8.3 = event-0YsOG9WSOE in updated copy) and maps socket inode to PID; run with rootkit-evasion shell.
grep "@$1\$" /proc/net/unix | grep ' 00010000 ' | awk '{ print $7 }'

YARA rule autocad_orphaned_vba_project matching DWG files with 'AC10' at offset 0, uint32 at 0x24 equal to 0, OLE signature D0 CF 11 E0 A1 B1 1A E1, and the string '[Host Extender Info]'.
rule autocad_orphaned_vba_project {
 strings: $a = "AC10"
 $b = {D0 CF 11 E0 A1 B1 1A E1}
 $c = "[Host Extender Info]" ascii
 condition: $a at 0 and uint32(0x24) == 0 and $b and $c
}