Supply Chain Incident Response

Stage 2 · Our connectionEvery external tenant with a path into ours: guests, direct connect, GDAP and DAP

// Which external tenants act in ours, and by which path (serviceProvider = GDAP/DAP)
union SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(90d)
| where CrossTenantAccessType != "none" and HomeTenantId != AADTenantId
| summarize SignIns=count(), LastSeen=max(TimeGenerated), Users=dcount(UserPrincipalName),
            Apps=make_set(AppDisplayName, 20) by HomeTenantId, HomeTenantName, CrossTenantAccessType
// The named vendor: every account, what it reached, from where
union SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(90d) and HomeTenantId == "<vendor tenant id>"
| summarize LastSeen=max(TimeGenerated), Apps=make_set(AppDisplayName), IPs=make_set(IPAddress, 20)
    by UserPrincipalName, UserType, CrossTenantAccessType

Stage 2 · Our connectionVendor-owned apps, their permissions, and Azure Lighthouse delegations

Non-Microsoft SaaS-to-SaaS grants (a vendor app authorised in Salesforce, Google Workspace, Slack or GitHub) do not appear in Entra at all. List them in each platform's connected-apps page: the Salesloft Drift tokens used against Salesforce in August 2025 were invisible to an Entra-only inventory.

// Service principals the vendor owns (app object, and its secret, live in their tenant)
AADServicePrincipalSignInLogs
| where TimeGenerated > ago(90d)
| where AppOwnerTenantId == "<vendor tenant id>" or AppId == "<vendor app id>"
| summarize LastSeen=max(TimeGenerated), Resources=make_set(ResourceDisplayName), IPs=make_set(IPAddress, 20)
    by ServicePrincipalName, AppId, AppOwnerTenantId
// App governance: what those apps are allowed to do, and whether an admin consented
OAuthAppInfo
| where AppOwnerTenantId == "<vendor tenant id>" or AppId == "<vendor app id>"
| project AppName, AppId, PrivilegeLevel, Permissions, IsAdminConsented, AssignedRoles, LastUsedTime
// Azure Lighthouse: delegations written in the window. The current list is
// `az managedservices assignment list` per subscription, or Azure portal > Service providers.
AzureActivity
| where TimeGenerated > ago(90d)
| where OperationNameValue =~ "Microsoft.ManagedServices/registrationAssignments/write"
| project TimeGenerated, Caller, CallerIpAddress, ResourceId, ActivityStatusValue

Stage 3 · CredentialsWhich vendor-app credential is in use, was one added, and whose tenant holds it

AuditLogs
| where TimeGenerated > ago(30d)
| where OperationName in ("Add service principal credentials", "Consent to application",
                          "Add app role assignment to service principal", "Add delegated permission grant")
     or OperationName has "Certificates and secrets management"
| where tostring(TargetResources) has "<vendor app name>"
| project TimeGenerated, OperationName, Result, InitiatedBy, TargetResources
// Anything the vendor's own identities changed in our directory (GDAP technicians, guests, the app)
AuditLogs
| where TimeGenerated > ago(30d)
| where tostring(InitiatedBy) has "<vendor upn domain>" or tostring(InitiatedBy) has "<vendor app id>"
| summarize Count=count(), Examples=make_set(tostring(TargetResources), 10) by OperationName, Category
// Which key the app actually signs in with: KeyId on OUR service principal only if
// AppOwnerTenantId is our tenant; otherwise it is the vendor's app-object key (send them the id)
AADServicePrincipalSignInLogs
| where TimeGenerated > ago(30d) and AppId == "<vendor app id>"
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), IPs=make_set(IPAddress)
    by AppOwnerTenantId, ServicePrincipalCredentialKeyId, ServicePrincipalCredentialThumbprint

Stage 4 · SoftwareWhere the package, the vendor binary or the sideloaded payload exists, ran or was loaded

// The trojanised binary by hash: written, executed, or loaded as a module
union DeviceFileEvents, DeviceProcessEvents, DeviceImageLoadEvents
| where Timestamp > ago(30d)
| where SHA256 in ("<sha256 of installer>", "<sha256 of payload dll>")
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Types=make_set(ActionType) by DeviceName, FolderPath, FileName
// The sideloaded payload by name and parent, hash-agnostic (catches variants the advisory missed)
DeviceImageLoadEvents
| where Timestamp > ago(30d)
| where FileName =~ "<sideloaded dll>" and InitiatingProcessFileName =~ "<vendor exe>"
| summarize Hosts=dcount(DeviceName), Hashes=make_set(SHA256) by FolderPath
// The npm package on disk: laptops and runner workspaces (PyPI: FolderPath has "site-packages")
DeviceFileEvents
| where Timestamp > ago(30d)
| where FolderPath has "node_modules" and FolderPath has "<package>" and FileName =~ "package.json"
| summarize FirstSeen=min(Timestamp) by DeviceName, FolderPath, InitiatingProcessFileName
// Vendor desktop and server software by version. DeviceTvmSoftwareInventory indexes installed
// programs only: it does not see npm, pip, container or base-image contents.
DeviceTvmSoftwareInventory
| where SoftwareVendor has "<vendor>" | project DeviceName, SoftwareName, SoftwareVersion

Stage 4 · SoftwareEverything signed with the vendor's stolen certificate

// Signer, serial and countersignature (timestamp) time come from DeviceFileCertificateInfo, joined on SHA1
DeviceFileCertificateInfo
| where Timestamp > ago(30d)
| where Signer has "<vendor signer name>" or CertificateSerialNumber =~ "<serial from the advisory>"
| join kind=inner (
    union DeviceProcessEvents, DeviceImageLoadEvents
    | where Timestamp > ago(30d)
    | project DeviceName, SHA1, FileName, FolderPath, Timestamp) on SHA1
| summarize Hosts=dcount(DeviceName), FirstSeen=min(Timestamp1), Files=make_set(FileName, 20)
    by Signer, CertificateSerialNumber, CertificateCountersignatureTime, IsTrusted
// IsTrusted stays true until the CA revokes and the device fetches the CRL. A countersignature
// dated before the revocation keeps the signature valid even then: trust the serial and the
// countersignature time inside the compromise window, not the trust flag.

Stage 5 · ActivityVendor accounts, apps and MSP technicians signing in from outside the vendor's ranges

union SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(30d)
| where HomeTenantId == "<vendor tenant id>"
| where not(ipv4_is_in_any_range(IPAddress, "<vendor cidr>"))
| summarize SignIns=count(), Apps=make_set(AppDisplayName), FirstSeen=min(TimeGenerated)
    by UserPrincipalName, CrossTenantAccessType, IPAddress, ResultType
AADServicePrincipalSignInLogs
| where TimeGenerated > ago(30d) and AppId == "<vendor app id>"
| where not(ipv4_is_in_any_range(IPAddress, "<vendor cidr>"))
| summarize SignIns=count(), FirstSeen=min(TimeGenerated)
    by ServicePrincipalName, IPAddress, ResourceDisplayName, ServicePrincipalCredentialKeyId

Stage 5 · ActivityConnections and logons into our hosts from the vendor's ranges

DeviceNetworkEvents
| where Timestamp > ago(30d)
| where ipv4_is_in_any_range(RemoteIP, "<vendor cidr>")
| summarize Connections=count(), LastSeen=max(Timestamp) by DeviceName, LocalPort, ActionType, InitiatingProcessFileName
DeviceLogonEvents
| where Timestamp > ago(30d) and ipv4_is_in_any_range(RemoteIP, "<vendor cidr>")
| summarize Logons=count() by DeviceName, AccountName, LogonType, ActionType

Stage 5 · ActivityStolen CI credentials used in the cloud: OIDC role assumption from an unexpected subject

AWSCloudTrail
| where TimeGenerated > ago(30d)
| where EventName == "AssumeRoleWithWebIdentity"
| extend RoleArn = tostring(parse_json(RequestParameters).roleArn)
| where UserIdentityUserName !startswith "repo:<org>/"
     or UserIdentityUserName has "pull_request"
     or not(ipv4_is_in_any_range(SourceIpAddress, dynamic(["<runner egress cidr>"])))
| summarize Count=count(), FirstSeen=min(TimeGenerated), IPs=make_set(SourceIpAddress, 20) by UserIdentityUserName, RoleArn
// Long-lived keys that lived on runners or laptops: everything they did from a new address
AWSCloudTrail
| where TimeGenerated > ago(30d) and UserIdentityAccessKeyId in ("<leaked access key ids>")
| summarize Calls=count(), Events=make_set(EventName, 30) by UserIdentityAccessKeyId, SourceIpAddress, UserAgent

Stage 6 · Our spreadShells and commands launched by the MSP's remote-management agent

DeviceProcessEvents
| where Timestamp > ago(30d)
// Kaseya AgentMon.exe, ScreenConnect.ClientService.exe, AteraAgent.exe, NinjaRMMAgent.exe, CagService.exe (Datto), BASupSrvc.exe (N-able)
| where InitiatingProcessFileName in~ ("<rmm agent exe>")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "certutil.exe", "msiexec.exe", "sh", "bash")
| extend Suspicious = ProcessCommandLine has_any ("-EncodedCommand", "-enc ", "certutil", "-decode", "DisableRealtimeMonitoring", "Set-MpPreference", "vssadmin", "bcdedit")
| summarize Hosts=dcount(DeviceName), Examples=make_set(ProcessCommandLine, 25), FirstSeen=min(Timestamp)
    by InitiatingProcessFileName, FileName, AccountName, Suspicious

Stage 6 · Our spreadInstall-time execution: lifecycle scripts, in-process credential theft and the 2025 worm pattern

// 1. Lifecycle scripts in the window: every package with an install script matches, so filter to the package
DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName in~ ("node.exe", "node")
| where (FileName =~ "cmd.exe" and ProcessCommandLine has "/d /s /c")
     or (FileName in~ ("sh", "bash", "dash") and ProcessCommandLine has "-c")
| where ProcessCommandLine has_any ("<package>", "preinstall", "postinstall")
| summarize Examples=make_set(ProcessCommandLine, 25), FirstSeen=min(Timestamp) by DeviceName, AccountName
// 2. Node or bun spawning the tools the 2025 worms used
DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName in~ ("node.exe", "node", "bun", "bun.exe")
| where FileName in~ ("trufflehog", "trufflehog.exe", "gh", "gh.exe", "claude", "gemini", "q", "q.exe")
     or ProcessCommandLine has_any ("--dangerously-skip-permissions", "--yolo", "--trust-all-tools", "npm publish", "gh repo create", "gh auth", "/tmp/inventory.txt")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
// 3. Node, bun or trufflehog talking to GitHub, a webhook sink, the registry or the metadata service
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName in~ ("node.exe", "node", "bun", "bun.exe", "trufflehog", "trufflehog.exe")
| where RemoteUrl has_any ("api.github.com", "webhook.site", "registry.npmjs.org") or RemoteIP in ("169.254.169.254")
| summarize Count=count(), FirstSeen=min(Timestamp) by DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
// 4. Files the worms wrote (Shai-Hulud: bundle.js, setup_bun.js, bun_environment.js, the *.json dumps, migrate-repos.sh)
DeviceFileEvents
| where Timestamp > ago(30d)
| where FileName in~ ("setup_bun.js", "bun_environment.js", "cloud.json", "contents.json", "environment.json", "truffleSecrets.json", "actionsSecrets.json", "migrate-repos.sh", "shai-hulud-workflow.yml")
     or (FileName =~ "bundle.js" and FolderPath has "node_modules" and FileSize > 2000000)
| summarize Hosts=dcount(DeviceName), Paths=make_set(FolderPath, 20) by FileName

Stage 2 · Our connectionEvery external tenant with a path into ours: guests, direct connect, GDAP and DAP

#Vendor=microsoft @sourcetype="microsoft-entra-id"
| Vendor.properties.crossTenantAccessType!="none"
| groupBy([Vendor.properties.homeTenantId, Vendor.properties.crossTenantAccessType],
          function=[max(@timestamp, as=LastSeen), count(as=SignIns), count(Vendor.properties.userPrincipalName, distinct=true, as=Users)])
// The named vendor: accounts, apps and the path used
#Vendor=microsoft @sourcetype="microsoft-entra-id"
| Vendor.properties.homeTenantId="<vendor tenant id>" or Vendor.properties.appId="<vendor app id>"
| groupBy([Vendor.category, Vendor.properties.userPrincipalName, Vendor.properties.crossTenantAccessType, Vendor.properties.appDisplayName],
          function=[max(@timestamp, as=LastSeen), count(as=SignIns)])
// Vendor.properties.* mirrors Entra's JSON keys. Confirm homeTenantId, crossTenantAccessType and
// appOwnerTenantId exist in one parsed event before trusting an empty result.

Stage 3 · CredentialsWhich vendor-app credential is in use, was one added, and whose tenant holds it

#Vendor=microsoft @sourcetype="microsoft-entra-id" Vendor.category=AuditLogs
| Vendor.operationName=/Add service principal credentials|Certificates and secrets management|Consent to application|Add app role assignment to service principal|Add delegated permission grant/i
| table([@timestamp, Vendor.operationName, Vendor.properties.initiatedBy.user.userPrincipalName, Vendor.properties.targetResources[0].displayName])
// Filter the table on <vendor app name>. Then the key in use:
#Vendor=microsoft @sourcetype="microsoft-entra-id" Vendor.category=ServicePrincipalSignInLogs
| Vendor.properties.appId="<vendor app id>"
| groupBy([Vendor.properties.appOwnerTenantId, Vendor.properties.servicePrincipalCredentialKeyId, Vendor.properties.servicePrincipalCredentialThumbprint],
          function=[min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen), count(as=SignIns)])

Stage 4 · SoftwareWhere the package, the vendor binary or the sideloaded payload exists, ran or was loaded

#event_simpleName=ProcessRollup2
| SHA256HashData=~in(values=["<sha256 of installer>", "<sha256 of payload dll>"]) or CommandLine=/<package>/i
| groupBy([ComputerName, ImageFileName, SHA256HashData], function=[min(@timestamp, as=FirstSeen), count(as=Runs)])
// The sideloaded payload as a module load (confirm ClassifiedModuleLoad is populated in your tenant)
#event_simpleName=ClassifiedModuleLoad
| ImageFileName=/\\<sideloaded dll>$/i or SHA256HashData="<sha256 of payload dll>"
| groupBy([ComputerName, ImageFileName, SHA256HashData, TargetProcessId], function=count())
// Execution and loads only. A package that is installed but never ran needs a disk check, RTR on the runner or laptop:
//   runscript -Raw=```Get-ChildItem C:\Users, C:\actions-runner, C:\agent -Recurse -Filter package.json -ErrorAction SilentlyContinue | ? FullName -like '*\node_modules\<package>\package.json' | % { $_.FullName; (Get-Content $_.FullName | ConvertFrom-Json).version }```
//   runscript -Raw=```find /home /root /opt /srv /builds -path '*/node_modules/<package>/package.json' -exec grep -H '"version"' {} +```

Stage 4 · SoftwareEverything signed with the vendor's stolen certificate

runscript -Raw=```Get-ChildItem 'C:\Program Files', 'C:\Program Files (x86)', 'C:\ProgramData', 'C:\Users' -Recurse -Include *.exe,*.dll,*.msi -ErrorAction SilentlyContinue |
  Get-AuthenticodeSignature | Where-Object { $_.SignerCertificate.Thumbprint -eq '<thumbprint>' -or $_.SignerCertificate.SerialNumber -eq '<serial>' } |
  Select-Object Path, Status, @{n='Countersigned';e={$_.TimeStamperCertificate.NotBefore}}, @{n='SHA256';e={(Get-FileHash $_.Path).Hash}}```
// Status stays Valid until the CA revokes and the host fetches the CRL; a countersignature dated before the
// revocation keeps it Valid even then. The serial and a signing time inside the window are the evidence.

Stage 5 · ActivityVendor accounts, apps and MSP technicians signing in from outside the vendor's ranges

#Vendor=microsoft @sourcetype="microsoft-entra-id"
| Vendor.properties.homeTenantId="<vendor tenant id>" or Vendor.properties.appId="<vendor app id>"
| !cidr(source.ip, subnet=["<vendor cidr>"])
| groupBy([user.email, Vendor.properties.crossTenantAccessType, Vendor.properties.appDisplayName, source.ip, #event.outcome],
          function=[min(@timestamp, as=FirstSeen), count(as=SignIns)])

Stage 5 · ActivityConnections and logons into our hosts from the vendor's ranges

#event_simpleName=NetworkReceiveAcceptIP4
| cidr(RemoteAddressIP4, subnet=["<vendor cidr>"])
| groupBy([aid, ComputerName, LocalPort, RemoteAddressIP4], function=count(as=Connections))
#event_simpleName=UserLogon
| cidr(RemoteAddressIP4, subnet=["<vendor cidr>"])
| groupBy([ComputerName, UserName, LogonType])

Stage 5 · ActivityStolen CI credentials used in the cloud: OIDC role assumption from an unexpected subject

// AWS CloudTrail connector, ECS-normalised. Confirm the field names in one parsed AssumeRoleWithWebIdentity event first.
#Vendor=aws event.action="AssumeRoleWithWebIdentity"
| user.name!=/^repo:<org>\// or user.name=/pull_request/ or !cidr(source.ip, subnet=["<runner egress cidr>"])
| groupBy([user.name, source.ip], function=[min(@timestamp, as=FirstSeen), count()])

Stage 6 · Our spreadShells and commands launched by the MSP's remote-management agent

#event_simpleName=ProcessRollup2
// AgentMon.exe (Kaseya), ScreenConnect.ClientService.exe, AteraAgent.exe, NinjaRMMAgent.exe, CagService.exe (Datto), BASupSrvc.exe (N-able)
| ParentBaseFileName=/^<rmm agent exe>$/i
| ImageFileName=/[\\\/](cmd|powershell|pwsh|rundll32|certutil|msiexec)\.exe$|\/(ba)?sh$/i
| Suspicious := if(CommandLine=/-enc|-EncodedCommand|certutil|-decode|DisableRealtimeMonitoring|vssadmin|bcdedit/i, then="yes", else="no")
| groupBy([ParentBaseFileName, ImageFileName, UserName, Suspicious, CommandLine], function=count(ComputerName, distinct=true, as=Hosts))

Stage 6 · Our spreadInstall-time execution: lifecycle scripts, in-process credential theft and the 2025 worm pattern

// 1. Lifecycle scripts in the window, scoped to the package
#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^node(\.exe)?$/i
| (ImageFileName=/\\cmd\.exe$/i and CommandLine=/\/d \/s \/c/) or (ImageFileName=/\/(ba|da)?sh$/ and CommandLine=/ -c /)
| CommandLine=/<package>|preinstall|postinstall/i
| groupBy([ComputerName, UserName, CommandLine], function=min(@timestamp, as=FirstSeen))
// 2. Node or bun spawning the tools the worms used
#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^(node|bun)(\.exe)?$/i
| ImageFileName=/[\\\/](trufflehog|gh|claude|gemini|q)(\.exe)?$/i or CommandLine=/--dangerously-skip-permissions|--yolo|--trust-all-tools|npm publish|gh repo create|gh auth|\/tmp\/inventory\.txt/i
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentCommandLine])
// 3. Node, bun or trufflehog resolving GitHub, a webhook sink or the registry (confirm DnsRequest field names in one event)
#event_simpleName=DnsRequest
| ContextBaseFileName=/^(node|bun|trufflehog)(\.exe)?$/i
| DomainName=/api\.github\.com|webhook\.site|registry\.npmjs\.org/i
| groupBy([ComputerName, ContextBaseFileName, DomainName], function=[min(@timestamp, as=FirstSeen), count()])

Stage 2 · Our connectionWhich of our hosts the vendor reaches, and whether Entra data is in the lake

// Identity half: only if Entra logs are ingested. Discover the parser's fields, then filter on the vendor tenant id:
dataSource.name = '<entra source>' | limit 5
// Endpoint half: hosts that accept logons from the vendor's addresses
event.category = 'logins' AND net_ipsubnet(src.endpoint.ip.address, '<vendor cidr>')
| group Logons = count() by endpoint.name, event.login.userName, event.login.type

Stage 3 · CredentialsCopies of the vendor's key or token on our hosts

event.type = 'Process Creation' AND tgt.process.cmdline contains '<key prefix>'
| columns event.time, endpoint.name, src.process.user, tgt.process.cmdline
// Files that embed the key: RemoteOps Fetch Files on the hosts above, or a Remote Shell grep:
//   grep -rl '<key prefix>' /etc /opt /home /srv 2>/dev/null

Stage 4 · SoftwareWhere the package, the vendor binary or the sideloaded payload exists, ran or was loaded

// By hash across every event type (#sha256 expands to every SHA256 field; explicit: tgt.file.sha256, module.sha256)
#sha256 in ('<sha256 of installer>', '<sha256 of payload dll>')
| group Events = count(), Hosts = estimate_distinct(endpoint.name) by event.type, tgt.file.path, module.path
// The sideloaded payload by name and parent, hash-agnostic
event.type = 'Module Load' AND module.path contains '<sideloaded dll>' AND src.process.name = '<vendor exe>'
| group Hosts = estimate_distinct(endpoint.name), Hashes = estimate_distinct(module.sha256) by module.path
// The npm package on disk (PyPI: site-packages)
event.type = 'File Creation' AND tgt.file.path contains 'node_modules' AND tgt.file.path contains '<package>'
| group Files = count() by endpoint.name, src.process.name
// Installed vendor applications by version: Application Inventory in the console (installed programs only;
// it does not see npm, pip or container contents)

Stage 4 · SoftwareEverything signed with the vendor's stolen certificate

src.process.publisher contains '<vendor signer name>' OR tgt.process.publisher contains '<vendor signer name>'
| group Hosts = estimate_distinct(endpoint.name), Hashes = estimate_distinct(tgt.process.image.sha256)
    by tgt.process.publisher, tgt.process.name, tgt.process.signedStatus
// Serial number and countersignature time are not in the event: check them on the sample with
//   Get-AuthenticodeSignature <file> | Select SignerCertificate, TimeStamperCertificate
// A countersignature dated before the revocation keeps the signature valid; the serial is the evidence.

Stage 5 · ActivityVendor accounts signing in to our hosts from outside the vendor's ranges

event.category = 'logins' AND event.login.userName contains '<vendor account prefix>'
  AND NOT net_ipsubnet(src.endpoint.ip.address, '<vendor cidr>')
| group Logons = count() by endpoint.name, event.login.userName, src.endpoint.ip.address

Stage 5 · ActivityConnections into our hosts from the vendor's ranges

event.type = 'IP Connect' AND event.network.direction = 'INCOMING'
  AND (net_ipsubnet(src.ip.address, '<vendor cidr>') OR net_ipsubnet(dst.ip.address, '<vendor cidr>'))
| group Connections = count() by endpoint.name, src.process.name, dst.port.number

Stage 6 · Our spreadShells and commands launched by the MSP's remote-management agent

// AgentMon.exe (Kaseya), ScreenConnect.ClientService.exe, AteraAgent.exe, NinjaRMMAgent.exe, CagService.exe (Datto), BASupSrvc.exe (N-able)
event.type = 'Process Creation' AND src.process.name in:anycase ('<rmm agent exe>')
  AND tgt.process.name in:anycase ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'rundll32.exe', 'certutil.exe', 'msiexec.exe', 'sh', 'bash')
| group Hosts = estimate_distinct(endpoint.name), First = min(event.time) by src.process.name, tgt.process.cmdline
// Narrow to the suspicious set:
//   AND tgt.process.cmdline contains ('-enc', '-EncodedCommand', 'certutil', '-decode', 'DisableRealtimeMonitoring', 'vssadmin', 'bcdedit')

Stage 6 · Our spreadInstall-time execution: lifecycle scripts, in-process credential theft and the 2025 worm pattern

// 1. Lifecycle scripts in the window, scoped to the package
event.type = 'Process Creation' AND src.process.name in:anycase ('node', 'node.exe')
  AND ((tgt.process.name in:anycase ('cmd.exe') AND tgt.process.cmdline contains '/d /s /c')
       OR (tgt.process.name in:anycase ('sh', 'bash', 'dash') AND tgt.process.cmdline contains ' -c '))
  AND tgt.process.cmdline contains ('<package>', 'preinstall', 'postinstall')
| group First = min(event.time), Cmds = count() by endpoint.name, src.process.user, tgt.process.cmdline
// 2. Node or bun spawning the tools the worms used
event.type = 'Process Creation' AND src.process.name in:anycase ('node', 'node.exe', 'bun', 'bun.exe')
  AND (tgt.process.name in:anycase ('trufflehog', 'trufflehog.exe', 'gh', 'gh.exe', 'claude', 'gemini', 'q', 'q.exe')
       OR tgt.process.cmdline contains ('--dangerously-skip-permissions', '--yolo', '--trust-all-tools', 'npm publish', 'gh repo create', 'gh auth', '/tmp/inventory.txt'))
| columns event.time, endpoint.name, src.process.user, tgt.process.name, tgt.process.cmdline, src.process.cmdline
// 3. Node, bun or trufflehog connecting to GitHub, a webhook sink, the registry or the metadata service
(event.type = 'IP Connect' OR event.type = 'DNS Resolved')
  AND src.process.name in:anycase ('node', 'node.exe', 'bun', 'bun.exe', 'trufflehog', 'trufflehog.exe')
  AND (dns.request contains ('api.github.com', 'webhook.site', 'registry.npmjs.org') OR dst.ip.address = '169.254.169.254')
| group Count = count(), First = min(event.time) by endpoint.name, src.process.name, dns.request, dst.ip.address
// 4. Files the worms wrote
event.type = 'File Creation'
  AND (tgt.file.path contains ('setup_bun.js', 'bun_environment.js', 'truffleSecrets.json', 'actionsSecrets.json', 'migrate-repos.sh', 'shai-hulud-workflow.yml', 'cloud.json', 'environment.json')
       OR (tgt.file.path contains 'node_modules' AND tgt.file.path contains 'bundle.js' AND tgt.file.size > 2000000))
| group Hosts = estimate_distinct(endpoint.name) by tgt.file.path

Stage 2 · Our connectionThe endpoint half of the vendor's connection — its software and its agents on our hosts

Hunt: Windows.Sys.Programs          (installed programs; filter the results on the vendor's publisher)
Hunt: Linux.Debian.Packages         (dpkg and snap packages)
Hunt: Linux.RHEL.Packages           (rpm packages)
Hunt: Generic.System.Pstree         (the vendor's agent running right now)
  CallChainFilter = (?i)<rmm agent or vendor process>

Stage 3 · CredentialsCopies of the vendor's key or token on our hosts

Hunt: Windows.Search.FileFinder
  SearchFilesGlob = C:\ProgramData\**\*.{json,config,ini,xml,env}
  YaraRule        = rule k { strings: $a = "<key prefix>" condition: $a }
Hunt: Linux.Search.FileFinder
  SearchFilesGlob = /{etc,opt,home/*,root}/**/*.{json,yml,yaml,env,conf,npmrc,pypirc}
  YaraRule        = (same rule)
Hunt: Linux.Sys.BashHistory
  SearchRegex     = <key prefix>

Stage 4 · SoftwareWhere the package, the vendor binary or the sideloaded payload exists or is loaded

Hunt: Generic.Detection.HashHunter
  TargetGlob = C:/**/*.{exe,dll,msi}            (narrow to the vendor's install folder)
  SHA256List = <sha256 of installer>
               <sha256 of payload dll>
Hunt: Windows.System.DLLs                       (the sideloaded payload loaded right now, with its certificate)
  ProcessRegex    = (?i)^<vendor exe>$
  DllRegex        = (?i)<sideloaded dll>$
  Calculate_Hash  = Y
  CertificateInfo = Y
Hunt: Windows.Search.FileFinder
  SearchFilesGlob = C:\{Users\*,actions-runner,agent}\**\node_modules\<package>\package.json
  Upload_File     = Y                              (the version is inside the file)
Hunt: Linux.Search.FileFinder
  SearchFilesGlob = /{home/*,root,opt,srv,builds}/**/node_modules/<package>/package.json
  Upload_File     = Y
  (PyPI: .../site-packages/<package>-*.dist-info/METADATA)

Stage 4 · SoftwareEverything signed with the vendor's stolen certificate

-- Notebook or custom artifact; narrow the glob to the vendor's folders on a large fleet
SELECT OSPath, Sig.SubjectName AS Signer, Sig.SerialNumber AS Serial, Sig.Timestamp AS Countersigned, Sig.Trusted AS Trusted,
       hash(path=OSPath).SHA256 AS SHA256
FROM foreach(row={
       SELECT OSPath FROM glob(globs=['C:/Program Files*/**/*.{exe,dll}', 'C:/ProgramData/**/*.{exe,dll}', 'C:/Users/*/AppData/**/*.{exe,dll}'])
     }, query={ SELECT OSPath, authenticode(filename=OSPath) AS Sig FROM scope() })
WHERE Signer =~ "<vendor signer name>" OR Serial =~ "<serial from the advisory>"
-- Trusted stays true until the CA revokes and the host fetches the CRL; a countersignature dated
-- before the revocation keeps it true even then.

Stage 5 · ActivityLogons by the vendor's accounts, and from the vendor's ranges, on our hosts

Hunt: Windows.EventLogs.RDPAuth
  UserNameRegex = (?i)<vendor account prefix>
  DateAfter     = <start of the exposure window>
  (compare the source IPs in the results with the vendor's ranges)
Hunt: Windows.EventLogs.RDPAuth
  SourceIPRegex = <vendor ip regex>          (regex, not CIDR: e.g. ^203\.0\.113\.)
  DateAfter     = <start of the exposure window>
Hunt: Windows.Network.NetstatEnriched       (live connections)
  IPRegex = <vendor ip regex>
Hunt: Linux.Network.NetstatEnriched
  IPRegex = <vendor ip regex>

Stage 6 · Our spreadShells and commands launched by the MSP's remote-management agent

Hunt: Generic.System.Pstree               (live process chains)
  CallChainFilter = (?i)<rmm agent exe>.*(cmd|powershell|pwsh|certutil|rundll32|bash)
Hunt: Windows.EventLogs.EvtxHunter         (history, if Sysmon or 4688 with command line is logged)
  IocRegex  = (?i)<rmm agent exe>|-EncodedCommand|certutil.*-decode
  DateAfter = <start of the exposure window>
Hunt: Linux.Sys.BashHistory                 (what the agent's shells ran, if interactive)
  SearchRegex = (?i)curl|wget|base64|chmod \+x|crontab|systemctl enable

Stage 6 · Our spreadInstall-time execution: what the package left behind, and what node is running now

Hunt: Linux.Search.FileFinder
  SearchFilesGlob = /{home/*,root,opt,srv,builds,tmp}/**/{setup_bun.js,bun_environment.js,truffleSecrets.json,actionsSecrets.json,cloud.json,environment.json,contents.json,migrate-repos.sh,inventory.txt}
  Upload_File     = Y
Hunt: Windows.Search.FileFinder
  SearchFilesGlob = C:\{Users\*,actions-runner,agent}\**\{setup_bun.js,bun_environment.js,truffleSecrets.json,actionsSecrets.json,migrate-repos.sh}
Hunt: Linux.Sys.BashHistory
  SearchRegex = (?i)(npm|pnpm|yarn|bun|pip3?) (install|i|add|ci) .*<package>|trufflehog|gh repo create|npm publish|claude .*--dangerously|gemini .*--yolo
Hunt: Linux.Sys.BashHistory                (Nx s1ngularity appended a shutdown to shell rc files)
  TargetGlob  = /{root,home/*}/.{bashrc,zshrc}
  SearchRegex = shutdown
Hunt: Generic.System.Pstree               (live, while a build runs)
  CallChainFilter = (?i)(node|bun).*(sh|bash|trufflehog|gh|claude|gemini|q)

Stage 2 · Our connectionEvery external tenant with a path into ours: guests, direct connect, GDAP and DAP

sourcetype=azure:monitor:aad category IN (SignInLogs, NonInteractiveUserSignInLogs) properties.crossTenantAccessType!=none
| stats count as signins max(_time) as last_seen dc(properties.userPrincipalName) as users
    by properties.homeTenantId properties.crossTenantAccessType
| convert ctime(last_seen)
`comment("the named vendor: accounts, apps, and its service principals")`
sourcetype=azure:monitor:aad category IN (SignInLogs, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs)
  (properties.homeTenantId="<vendor tenant id>" OR properties.appOwnerTenantId="<vendor tenant id>" OR properties.appId="<vendor app id>")
| stats max(_time) as last_seen values(properties.appDisplayName) as apps values(properties.ipAddress) as ips
    by category properties.userPrincipalName properties.crossTenantAccessType properties.servicePrincipalName properties.appOwnerTenantId
| convert ctime(last_seen)

Stage 3 · CredentialsWhich vendor-app credential is in use, was one added, and whose tenant holds it

sourcetype=azure:monitor:aad category=AuditLogs
  (operationName="Add service principal credentials" OR operationName="Update application*Certificates and secrets management*"
   OR operationName="Consent to application" OR operationName="Add app role assignment to service principal" OR operationName="Add delegated permission grant")
  "<vendor app name>"
| table _time operationName properties.initiatedBy.user.userPrincipalName properties.targetResources{}.displayName
`comment("the key the app signs in with")`
sourcetype=azure:monitor:aad category=ServicePrincipalSignInLogs properties.appId="<vendor app id>"
| stats min(_time) as first_seen max(_time) as last_seen count by properties.appOwnerTenantId properties.servicePrincipalCredentialKeyId properties.servicePrincipalCredentialThumbprint
| convert ctime(first_seen) ctime(last_seen)

Stage 4 · SoftwareWhere the package, the vendor binary or the sideloaded payload exists, ran or was loaded

index=windows source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
  ((EventCode=1 (Hashes="*<sha256 of installer>*" OR Hashes="*<sha256 of payload dll>*"))
   OR (EventCode=7 (Hashes="*<sha256 of payload dll>*" OR (ImageLoaded="*\\<sideloaded dll>" Image="*\\<vendor exe>")))
   OR (EventCode=11 TargetFilename="*node_modules*<package>*package.json"))
| stats min(_time) as first_seen by host EventCode Image ImageLoaded TargetFilename Signature SignatureStatus
| convert ctime(first_seen)
`comment("everything signed with the vendor's certificate: Sysmon 7 Signature is the signer name; the serial is not logged, check it on the sample with Get-AuthenticodeSignature")`
index=windows source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 Signed=true Signature="<vendor signer name>"
| stats dc(host) as hosts values(Hashes) as hashes min(_time) as first_seen by ImageLoaded Image SignatureStatus
| convert ctime(first_seen)
`comment("Linux runners with Sysmon for Linux: source=\"Syslog:Linux-Sysmon/Operational\" (sourcetype=sysmon:linux)")`

Stage 5 · ActivityVendor accounts, apps and MSP technicians signing in from outside the vendor's ranges

sourcetype=azure:monitor:aad category IN (SignInLogs, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs)
  (properties.homeTenantId="<vendor tenant id>" OR properties.appId="<vendor app id>")
| where NOT cidrmatch("<vendor cidr>", 'properties.ipAddress')
| stats count min(_time) as first_seen by properties.userPrincipalName properties.crossTenantAccessType properties.servicePrincipalId properties.ipAddress properties.appDisplayName properties.servicePrincipalCredentialKeyId
| convert ctime(first_seen)

Stage 5 · ActivityConnections and logons into our hosts from the vendor's ranges

index=windows ((source="XmlWinEventLog:Security" EventCode=4624)
  OR (source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 Initiated="false"))
| eval src=coalesce(IpAddress, SourceIp)
| where cidrmatch("<vendor cidr>", src)
| stats count by host EventCode TargetUserName Image DestinationPort
`comment("firewall and VPN logs: the same cidrmatch on your firewall index's source-IP field")`

Stage 5 · ActivityStolen CI credentials used in the cloud: OIDC role assumption from an unexpected subject

sourcetype=aws:cloudtrail eventName=AssumeRoleWithWebIdentity
| rename userIdentity.userName as sub, requestParameters.roleArn as role
| where NOT like(sub, "repo:<org>/%") OR like(sub, "%pull_request%") OR NOT cidrmatch("<runner egress cidr>", sourceIPAddress)
| stats count min(_time) as first_seen values(sourceIPAddress) as ips by sub role
| convert ctime(first_seen)
`comment("long-lived keys that lived on runners or laptops: everything they did from a new address")`
sourcetype=aws:cloudtrail userIdentity.accessKeyId IN ("<leaked access key ids>")
| stats count values(eventName) as events by userIdentity.accessKeyId sourceIPAddress userAgent

Stage 6 · Our spreadShells and commands launched by the MSP's remote-management agent

index=windows source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  ParentImage IN ("*\\AgentMon.exe", "*\\ScreenConnect.ClientService.exe", "*\\AteraAgent.exe", "*\\NinjaRMMAgent.exe", "*\\CagService.exe", "*\\BASupSrvc.exe", "*\\<rmm agent exe>")
  (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\rundll32.exe" OR Image="*\\certutil.exe" OR Image="*\\msiexec.exe")
| eval suspicious=if(match(CommandLine, "(?i)-enc|-EncodedCommand|certutil|-decode|DisableRealtimeMonitoring|vssadmin|bcdedit"), "yes", "no")
| stats dc(host) as hosts values(host) as host_list min(_time) as first_seen by ParentImage Image User suspicious CommandLine
| convert ctime(first_seen)

Stage 6 · Our spreadInstall-time execution: lifecycle scripts, in-process credential theft and the 2025 worm pattern

`comment("1. lifecycle scripts in the window, scoped to the package")`
index=* (source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR source="Syslog:Linux-Sysmon/Operational") EventCode=1
  (ParentImage="*\\node.exe" OR ParentImage="*/node")
  ((Image="*\\cmd.exe" CommandLine="*/d /s /c*") OR (Image IN ("*/sh", "*/bash", "*/dash") CommandLine="* -c *"))
  (CommandLine="*<package>*" OR CommandLine="*preinstall*" OR CommandLine="*postinstall*")
| stats min(_time) as first_seen values(CommandLine) as cmds by host User
`comment("2. node or bun spawning the tools the worms used")`
index=* (source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR source="Syslog:Linux-Sysmon/Operational") EventCode=1
  (ParentImage IN ("*\\node.exe", "*/node", "*\\bun.exe", "*/bun"))
  (Image IN ("*/trufflehog", "*\\trufflehog.exe", "*/gh", "*\\gh.exe", "*/claude", "*/gemini", "*/q", "*\\q.exe")
   OR CommandLine IN ("*--dangerously-skip-permissions*", "*--yolo*", "*--trust-all-tools*", "*npm publish*", "*gh repo create*", "*gh auth*", "*/tmp/inventory.txt*"))
| table _time host User Image CommandLine ParentCommandLine
`comment("3. node, bun or trufflehog resolving GitHub, a webhook sink or the registry (Sysmon 22), or hitting the metadata service (Sysmon 3)")`
index=* (source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR source="Syslog:Linux-Sysmon/Operational")
  (Image IN ("*\\node.exe", "*/node", "*\\bun.exe", "*/bun", "*/trufflehog", "*\\trufflehog.exe"))
  ((EventCode=22 QueryName IN ("api.github.com", "webhook.site", "registry.npmjs.org")) OR (EventCode=3 DestinationIp="169.254.169.254"))
| stats count min(_time) as first_seen by host Image QueryName DestinationIp
`comment("4. files the worms wrote (Sysmon 11)")`
index=* (source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR source="Syslog:Linux-Sysmon/Operational") EventCode=11
  TargetFilename IN ("*setup_bun.js", "*bun_environment.js", "*truffleSecrets.json", "*actionsSecrets.json", "*cloud.json", "*environment.json", "*migrate-repos.sh", "*shai-hulud-workflow.yml")
| stats dc(host) as hosts values(TargetFilename) as paths by Image

Stage 2 · Our connectionEvery external tenant with a path into ours: guests, direct connect, GDAP and DAP

FROM logs-azure.signinlogs-*
| WHERE @timestamp > NOW() - 90 days AND azure.signinlogs.properties.cross_tenant_access_type != "none"
| STATS signins = COUNT(*), last_seen = MAX(@timestamp), users = COUNT_DISTINCT(azure.signinlogs.properties.user_principal_name)
    BY azure.signinlogs.properties.home_tenant_id, azure.signinlogs.properties.cross_tenant_access_type
// The named vendor: accounts, apps and the path used
FROM logs-azure.signinlogs-*
| WHERE @timestamp > NOW() - 90 days
| WHERE azure.signinlogs.properties.home_tenant_id == "<vendor tenant id>"
     OR azure.signinlogs.properties.app_id == "<vendor app id>"
| STATS last_seen = MAX(@timestamp), signins = COUNT(*)
    BY azure.signinlogs.category, azure.signinlogs.properties.user_principal_name,
       azure.signinlogs.properties.cross_tenant_access_type, azure.signinlogs.properties.service_principal_name

Stage 3 · CredentialsWhich vendor-app credential is in use, was one added, and whose tenant holds it

FROM logs-azure.auditlogs-*
| WHERE @timestamp > NOW() - 30 days
| WHERE azure.auditlogs.operation_name IN ("Add service principal credentials", "Consent to application",
          "Add app role assignment to service principal", "Add delegated permission grant")
     OR azure.auditlogs.operation_name LIKE "*Certificates and secrets management*"
| KEEP @timestamp, azure.auditlogs.operation_name, azure.auditlogs.properties.initiated_by.user.userPrincipalName,
       azure.auditlogs.properties.target_resources.*
// Filter on <vendor app name> in target_resources. The key the app signs in with is in the
// service-principal sign-in properties (same integration, category ServicePrincipalSignInLogs).

Stage 4 · SoftwareWhere the package, the vendor binary or the sideloaded payload exists, ran or was loaded

any where
  process.hash.sha256 in ("<sha256 of installer>", "<sha256 of payload dll>") or
  file.hash.sha256 in ("<sha256 of installer>", "<sha256 of payload dll>") or
  dll.hash.sha256 == "<sha256 of payload dll>" or
  (event.category == "file" and file.path : ("*/node_modules/<package>/package.json",
                                             "*\\node_modules\\<package>\\package.json"))
// The sideloaded payload by name and parent, hash-agnostic
library where dll.name : "<sideloaded dll>" and process.name : "<vendor exe>"

Stage 4 · SoftwareEverything signed with the vendor's stolen certificate

any where
  process.code_signature.subject_name : "<vendor signer name>" or
  dll.code_signature.subject_name : "<vendor signer name>"
// ECS carries subject_name, trusted, status and timestamp, not the serial: check the serial on the sample
// with Get-AuthenticodeSignature. trusted stays true until the CA revokes and the host fetches the CRL;
// a countersignature dated before the revocation keeps it true even then.

Stage 5 · ActivityVendor accounts, apps and MSP technicians signing in from outside the vendor's ranges

FROM logs-azure.signinlogs-*
| WHERE @timestamp > NOW() - 30 days
| WHERE azure.signinlogs.properties.home_tenant_id == "<vendor tenant id>"
     OR azure.signinlogs.properties.app_id == "<vendor app id>"
| WHERE NOT CIDR_MATCH(source.ip, "<vendor cidr>")
| STATS signins = COUNT(*), first_seen = MIN(@timestamp)
    BY azure.signinlogs.properties.user_principal_name, azure.signinlogs.properties.cross_tenant_access_type,
       azure.signinlogs.properties.service_principal_name, source.ip

Stage 5 · ActivityConnections and logons into our hosts from the vendor's ranges

FROM logs-*
| WHERE @timestamp > NOW() - 30 days
| WHERE CIDR_MATCH(source.ip, "<vendor cidr>")
| STATS events = COUNT(*) BY host.name, event.dataset, destination.port, user.name

Stage 5 · ActivityStolen CI credentials used in the cloud: OIDC role assumption from an unexpected subject

FROM logs-aws.cloudtrail-*
| WHERE @timestamp > NOW() - 30 days AND event.action == "AssumeRoleWithWebIdentity"
| WHERE NOT user.name LIKE "repo:<org>/*" OR user.name LIKE "*pull_request*" OR NOT CIDR_MATCH(source.ip, "<runner egress cidr>")
| STATS count = COUNT(*), first_seen = MIN(@timestamp), ips = VALUES(source.ip) BY user.name, aws.cloudtrail.user_identity.type
// Long-lived keys that lived on runners or laptops: everything they did from a new address
FROM logs-aws.cloudtrail-*
| WHERE @timestamp > NOW() - 30 days AND aws.cloudtrail.user_identity.access_key_id IN ("<leaked access key ids>")
| STATS calls = COUNT(*), events = VALUES(event.action) BY aws.cloudtrail.user_identity.access_key_id, source.ip, user_agent.original

Stage 6 · Our spreadShells and commands launched by the MSP's remote-management agent

process where event.type == "start" and
  process.parent.name : ("AgentMon.exe", "ScreenConnect.ClientService.exe", "AteraAgent.exe", "NinjaRMMAgent.exe", "CagService.exe", "BASupSrvc.exe", "<rmm agent exe>") and
  process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "certutil.exe", "msiexec.exe", "sh", "bash")
// Narrow to the suspicious set: and process.command_line : ("*-enc*", "*-EncodedCommand*", "*certutil*", "*-decode*", "*DisableRealtimeMonitoring*", "*vssadmin*", "*bcdedit*")

Stage 6 · Our spreadInstall-time execution: lifecycle scripts, in-process credential theft and the 2025 worm pattern

// 1. Lifecycle scripts in the window, scoped to the package
process where event.type == "start" and process.parent.name : ("node", "node.exe") and
  ((process.name : "cmd.exe" and process.command_line : "*/d /s /c*") or
   (process.name : ("sh", "bash", "dash") and process.args : "-c")) and
  process.command_line : ("*<package>*", "*preinstall*", "*postinstall*")
// 2. Node or bun spawning the tools the worms used
process where event.type == "start" and process.parent.name : ("node", "node.exe", "bun", "bun.exe") and
  (process.name : ("trufflehog", "trufflehog.exe", "gh", "gh.exe", "claude", "gemini", "q", "q.exe") or
   process.command_line : ("*--dangerously-skip-permissions*", "*--yolo*", "*--trust-all-tools*", "*npm publish*", "*gh repo create*", "*gh auth*", "*/tmp/inventory.txt*"))
// 3. Node, bun or trufflehog resolving GitHub, a webhook sink or the registry, or hitting the metadata service
any where process.name : ("node", "node.exe", "bun", "bun.exe", "trufflehog", "trufflehog.exe") and
  (dns.question.name : ("api.github.com", "webhook.site", "registry.npmjs.org") or destination.ip == "169.254.169.254")
// 4. Files the worms wrote
file where event.type : ("creation", "change") and
  (file.name : ("setup_bun.js", "bun_environment.js", "truffleSecrets.json", "actionsSecrets.json", "cloud.json", "environment.json", "migrate-repos.sh", "shai-hulud-workflow.yml") or
   (file.name : "bundle.js" and file.path : "*node_modules*" and file.size > 2000000))