EXPLORE DETECTIONS
LeakNet Campaign: Deno Runtime & Klist Suspicious Execution Detection
Detects indicators of the LeakNet campaign (analyzed by ReliaQuest, March 2026), which uses ClickFix a social engineering tactic where compromised websites display fake error dialogs that coerce users into manually pasting and executing a malicious PowerShell/CMD command. This delivers a portable Deno (JavaScript runtime) binary to user-writable directories that runs malicious payloads entirely in memory, avoiding disk-based detection. The query targets the post-delivery kill chain: Deno execution from AppData/Temp/ProgramData paths, klist.exe usage from interactive shells indicating Kerberos ticket harvesting, Deno spawning reconnaissance and living-off-the-land binaries, and dangerous Deno runtime flags or remote code fetch patterns. A noise reduction filter excludes Deno running from standard developer or Program Files paths. This query detects post-exploitation activity associated with the LeakNet campaign, which was publicly analyzed by ReliaQuest in March 2026. LeakNet uses ClickFix — a social engineering technique where compromised websites present fake browser or application error dialogs that instruct users to copy a malicious command and paste it into a Run dialog or terminal. The pasted command downloads and executes a portable Deno binary, which then runs JavaScript payloads entirely in memory to evade traditional file-based detection. The query monitors CrowdStrike Falcon EDR `ProcessRollup2` telemetry and applies four detection clauses covering distinct stages of the LeakNet kill chain, followed by a noise reduction filter. CAMPAIGN DETAILS: Campaign: LeakNet Reference: ReliaQuest Threat Research, March 2026 Delivery: ClickFix social engineering → user-pasted PowerShell/CMD command Payload: Portable Deno binary dropped to AppData/Temp Execution: In-memory JavaScript payloads via Deno runtime Post-Exploitation: Credential enumeration (klist), host discovery, C2 callbacks VULNERABILITY DETAILS: CVE: N/A (Campaign-Specific TTPs / Living off the Land) Type: Initial Access, Execution, Credential Access, Discovery, Lateral Movement Status: ACTIVE CAMPAIGN — MONITORING FOR ANOMALOUS USAGE MITRE ATT&CK MAPPING: T1204.001 - User Execution: Malicious Link (ClickFix) T1059.007 - Command and Scripting Interpreter: JavaScript/TypeScript T1059.001 - Command and Scripting Interpreter: PowerShell T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1082 - System Information Discovery T1033 - System Owner/User Discovery T1016 - System Network Configuration Discovery T1087 - Account Discovery Tactics: Initial Access, Execution, Credential Access, Discovery, Lateral Movement EXPLOITATION REQUIREMENTS: - User interaction required (ClickFix paste-and-execute social engineering) - Deno binary present on disk (often portable/non-installed) - Execution within user-writable context (AppData/Temp) - Network access for remote script fetching (--allow-net) USE CASES: - Detect Deno-based malware or C2 stagers - Identify Kerberos ticket enumeration via klist.exe - Track post-exploitation discovery commands spawned by script runtimes - Flag dangerous Deno permission flags and remote code execution patterns DATA SOURCE: Event Type: ProcessRollup2 Required Fields: ImageFileName, CommandLine, ComputerName, UserName, ParentBaseFileName Sensor: CrowdStrike Falcon EDR AFFECTED SYSTEMS: - Windows 10/11 - Windows Server 2016/2019/2022 FALSE POSITIVES: - Legitimate developer activity (Deno used in IDE/Repos) - Automated IT scripts using klist for troubleshooting - Deno-based internal tools running from standard Program Files paths - DevOps pipelines that invoke Deno with --allow-net against internal registries INVESTIGATION NOTES: 1. Check if the Deno binary is signed and from a known developer location. 2. Review the CommandLine for --allow-all or remote URLs (http/https). 3. Correlate klist usage with recent logins or network connections to Domain Controllers. 4. Inspect the parent process of klist.exe; interactive shells are higher risk. 5. Verify if the user is a known developer or DevOps engineer. 6. Cross-reference SHA256HashData against known-good Deno release hashes. TUNING RECOMMENDATIONS: - Add specific exclusion for local 'dev' or 'git' directories. - Filter out known-good service accounts that use klist for health checks. - Baseline Deno usage by SHA256 if a standard version is deployed. - Add UserName exclusions for known developer accounts if discovery clause is noisy. REMEDIATION: Priority: MEDIUM (Context Dependent) Action: Quarantine suspicious Deno binaries found in AppData/Temp. Patches: Ensure Deno is updated to the latest version to prevent engine exploits. QUERY LOGIC: 1. Filters for ProcessRollup2 events. 2. Checks for Deno in writable paths (Local/Roaming/Temp/ProgramData). 3. Flags klist.exe when spawned by common shells or script hosts. 4. Monitors Deno spawning living-off-the-land and discovery binaries. 5. Identifies dangerous Deno flags or remote fetch commands in the command line. 6. Applies a global noise reduction for standard Program Files or developer paths.
LeakNet Campaign: Deno Runtime & Klist Suspicious Execution Detection
Detects indicators of the LeakNet campaign (analyzed by ReliaQuest, March 2026), which uses ClickFix a social engineering tactic where compromised websites display fake error dialogs that coerce users into manually pasting and executing a malicious PowerShell/CMD command. This delivers a portable Deno (JavaScript runtime) binary to user-writable directories that runs malicious payloads entirely in memory, avoiding disk-based detection. The query targets the post-delivery kill chain: Deno execution from AppData/Temp/ProgramData paths, klist.exe usage from interactive shells indicating Kerberos ticket harvesting, Deno spawning reconnaissance and living-off-the-land binaries, and dangerous Deno runtime flags or remote code fetch patterns. A noise reduction filter excludes Deno running from standard developer or Program Files paths. This query detects post-exploitation activity associated with the LeakNet campaign, which was publicly analyzed by ReliaQuest in March 2026. LeakNet uses ClickFix — a social engineering technique where compromised websites present fake browser or application error dialogs that instruct users to copy a malicious command and paste it into a Run dialog or terminal. The pasted command downloads and executes a portable Deno binary, which then runs JavaScript payloads entirely in memory to evade traditional file-based detection. The query monitors CrowdStrike Falcon EDR `ProcessRollup2` telemetry and applies four detection clauses covering distinct stages of the LeakNet kill chain, followed by a noise reduction filter. CAMPAIGN DETAILS: Campaign: LeakNet Reference: ReliaQuest Threat Research, March 2026 Delivery: ClickFix social engineering → user-pasted PowerShell/CMD command Payload: Portable Deno binary dropped to AppData/Temp Execution: In-memory JavaScript payloads via Deno runtime Post-Exploitation: Credential enumeration (klist), host discovery, C2 callbacks VULNERABILITY DETAILS: CVE: N/A (Campaign-Specific TTPs / Living off the Land) Type: Initial Access, Execution, Credential Access, Discovery, Lateral Movement Status: ACTIVE CAMPAIGN — MONITORING FOR ANOMALOUS USAGE MITRE ATT&CK MAPPING: T1204.001 - User Execution: Malicious Link (ClickFix) T1059.007 - Command and Scripting Interpreter: JavaScript/TypeScript T1059.001 - Command and Scripting Interpreter: PowerShell T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting T1082 - System Information Discovery T1033 - System Owner/User Discovery T1016 - System Network Configuration Discovery T1087 - Account Discovery Tactics: Initial Access, Execution, Credential Access, Discovery, Lateral Movement EXPLOITATION REQUIREMENTS: - User interaction required (ClickFix paste-and-execute social engineering) - Deno binary present on disk (often portable/non-installed) - Execution within user-writable context (AppData/Temp) - Network access for remote script fetching (--allow-net) USE CASES: - Detect Deno-based malware or C2 stagers - Identify Kerberos ticket enumeration via klist.exe - Track post-exploitation discovery commands spawned by script runtimes - Flag dangerous Deno permission flags and remote code execution patterns DATA SOURCE: Event Type: ProcessRollup2 Required Fields: ImageFileName, CommandLine, ComputerName, UserName, ParentBaseFileName Sensor: CrowdStrike Falcon EDR AFFECTED SYSTEMS: - Windows 10/11 - Windows Server 2016/2019/2022 FALSE POSITIVES: - Legitimate developer activity (Deno used in IDE/Repos) - Automated IT scripts using klist for troubleshooting - Deno-based internal tools running from standard Program Files paths - DevOps pipelines that invoke Deno with --allow-net against internal registries INVESTIGATION NOTES: 1. Check if the Deno binary is signed and from a known developer location. 2. Review the CommandLine for --allow-all or remote URLs (http/https). 3. Correlate klist usage with recent logins or network connections to Domain Controllers. 4. Inspect the parent process of klist.exe; interactive shells are higher risk. 5. Verify if the user is a known developer or DevOps engineer. 6. Cross-reference SHA256HashData against known-good Deno release hashes. TUNING RECOMMENDATIONS: - Add specific exclusion for local 'dev' or 'git' directories. - Filter out known-good service accounts that use klist for health checks. - Baseline Deno usage by SHA256 if a standard version is deployed. - Add UserName exclusions for known developer accounts if discovery clause is noisy. REMEDIATION: Priority: MEDIUM (Context Dependent) Action: Quarantine suspicious Deno binaries found in AppData/Temp. Patches: Ensure Deno is updated to the latest version to prevent engine exploits. QUERY LOGIC: 1. Filters for ProcessRollup2 events. 2. Checks for Deno in writable paths (Local/Roaming/Temp/ProgramData). 3. Flags klist.exe when spawned by common shells or script hosts. 4. Monitors Deno spawning living-off-the-land and discovery binaries. 5. Identifies dangerous Deno flags or remote fetch commands in the command line. 6. Applies a global noise reduction for standard Program Files or developer paths.
List all Identity Protection Detections
List of all IDP detections.
List all Identity Protection Detections
List of all IDP detections.
List of attachments sent from Outlook
List of attachments sent from Outlook
LOLBin Certutil
This query detects the use of certutil.exe. Certutil.exe – A Windows certificate-management tool that attackers often misuse to download executables or script files (even into alternate data streams), as well as encode or decode payloads, aiding stealthy file delivery and evasion techniques. [LOLBAS - Certutil.exe](https://lolbas-project.github.io/lolbas/Binaries/Certutil/)
LOLBin Certutil
This query detects the use of certutil.exe. Certutil.exe – A Windows certificate-management tool that attackers often misuse to download executables or script files (even into alternate data streams), as well as encode or decode payloads, aiding stealthy file delivery and evasion techniques. [LOLBAS - Certutil.exe](https://lolbas-project.github.io/lolbas/Binaries/Certutil/)
LOLBin Mshta
This query detects the use of mshta.exe. Mshta.exe – A Windows utility for executing HTML Applications (`.hta`) — often abused to run embedded or remote VBScript, JScript, or download-and-execute payloads via alternate data streams or web URLs. [LOLBAS - Mshta.exe](https://lolbas-project.github.io/lolbas/Binaries/Mshta/)
LOLBin Mshta
This query detects the use of mshta.exe. Mshta.exe – A Windows utility for executing HTML Applications (`.hta`) — often abused to run embedded or remote VBScript, JScript, or download-and-execute payloads via alternate data streams or web URLs. [LOLBAS - Mshta.exe](https://lolbas-project.github.io/lolbas/Binaries/Mshta/)
LOLBin Msiexec
This query detects the use of Msiexec.exe. Msiexec.exe – A Windows Installer utility that executes MSI packages or DLLs (including remote or transformed payloads), frequently misused by attackers for stealthy code execution and application control bypass. [LOLBAS - Msiexec.exe](https://lolbas-project.github.io/lolbas/Binaries/Msiexec/)
LOLBin Msiexec
This query detects the use of Msiexec.exe. Msiexec.exe – A Windows Installer utility that executes MSI packages or DLLs (including remote or transformed payloads), frequently misused by attackers for stealthy code execution and application control bypass. [LOLBAS - Msiexec.exe](https://lolbas-project.github.io/lolbas/Binaries/Msiexec/)
LOLBin Regsvr32
This query detects the use of Regsvr32 when it has loaded scrobj.dll. Regsvr32.exe – A native Windows tool designed to register DLLs, but frequently misused by attackers to execute remote or local scriptlets (SCT files)—often enabling Application Whitelisting bypass and stealthy code execution. [LOLBAS - Regsvr32.exe](https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/)
LOLBin Regsvr32
This query detects the use of Regsvr32 when it has loaded scrobj.dll. Regsvr32.exe – A native Windows tool designed to register DLLs, but frequently misused by attackers to execute remote or local scriptlets (SCT files)—often enabling Application Whitelisting bypass and stealthy code execution. [LOLBAS - Regsvr32.exe](https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/)
LOLBin Rundll32
This query detects the use of Rundll32 from parents that are known for misuse. Rundll32.exe – A native Windows binary that can be abused to execute DLLs, scripts, and other payloads, making it a common technique in Living-off-the-Land attacks. [LOLBAS - Rundll32.exe](https://lolbas-project.github.io/lolbas/Binaries/Rundll32/)
LOLBin Rundll32
This query detects the use of Rundll32 from parents that are known for misuse. Rundll32.exe – A native Windows binary that can be abused to execute DLLs, scripts, and other payloads, making it a common technique in Living-off-the-Land attacks. [LOLBAS - Rundll32.exe](https://lolbas-project.github.io/lolbas/Binaries/Rundll32/)
LOLBin WMIC
This query detects the use of WMIC. Wmic.exe – A built-in Windows tool for scripting and remote system management, which adversaries exploit to run commands, load executables via alternate data streams, execute remote or XSL-formatted payloads, and move files stealthily. [LOLBAS - Wmic.exe](https://lolbas-project.github.io/lolbas/Binaries/Wmic/)
LOLBin WMIC
This query detects the use of WMIC. Wmic.exe – A built-in Windows tool for scripting and remote system management, which adversaries exploit to run commands, load executables via alternate data streams, execute remote or XSL-formatted payloads, and move files stealthily. [LOLBAS - Wmic.exe](https://lolbas-project.github.io/lolbas/Binaries/Wmic/)
macOS Persistence via Launch Agents and Launch Daemons
Hunts for persistence being established on macOS hosts, either through plist files written to LaunchAgents or LaunchDaemons directories or through launchctl loading a job into launchd. **What it looks for:** the two most common ways persistence lands on macOS. First, a property list file being written into one of the real launchd locations: /Library/LaunchAgents, /Library/LaunchDaemons or a per-user ~/Library/LaunchAgents directory. The path regex is anchored to the filesystem root on purpose, so plists inside app bundles or cache directories (for example update stagings under /Library/Caches) do not match, since launchd never reads those. Second, launchctl being invoked with load or bootstrap to register a job with launchd. The case statement labels each hit with its SignalType, and the groupBy collapses duplicate write events that macOS emits for the same file. **Telemetry needed:** Falcon sensor on macOS with process telemetry (ProcessRollup2) and file write telemetry (the *Written event family). **False positives / tuning:** legitimate software registers launch items constantly; expect Zoom and Microsoft updaters, MDM agents and the Falcon sensor itself. Tune by excluding known ParentBaseFileName values or by allowlisting expected plist name prefixes in TargetFileName and CommandLine (com.microsoft., us.zoom., com.crowdstrike.). For a stricter detection variant, keep only writes to the per-user LaunchAgents path combined with an unusual writing process.
Mail: Inbox Rule Auto-Forwards or Hides Messages (Potential BEC Persistence)
Flags newly created or modified Exchange Online inbox rules that forward mail to another domain or internally, silently delete it, move it out of the inbox, or single out password, security or payment related mail, and risk-ranks each one. **What it looks for:** every successful `New-InboxRule` and `Set-InboxRule` operation in the Exchange Online audit data (`event.module=m365`), with the rule's mail handling parameters pulled out individually. Each hit is risk-tagged instead of filtered: - **High, forwards mail to a recipient in another domain:** `ForwardTo`, `ForwardAsAttachmentTo`, `RedirectTo` or `BlindCopyTo` points at a domain that differs from the acting mailbox's domain. This is the classic BEC exfiltration pattern. - **High, silently deletes matching mail:** `DeleteMessage=True`. - **Medium, forwards a copy to a recipient in the same domain:** usually delegation, but still worth a glance on sensitive mailboxes. - **Medium, rule targets password, security or payment related mail:** the sender or subject condition or the rule name matches password, sign in, MFA, security alert, invoice or payment keywords. This is the mail a BEC actor needs the victim not to see. - **Review, moves mail out of the inbox:** a `MoveToFolder` rule with no other signal. This matters more than it looks: a rule that quietly files security notifications into an unrelated folder is indistinguishable from housekeeping by folder name alone, yet it is exactly how an attacker keeps a compromised account's owner from seeing account recovery mail. - **Review, existing rule modified, its action is not part of this event:** see the `Set-InboxRule` caveat below. **Telemetry needed:** Microsoft 365 Exchange Online audit data ingested into Falcon Next-Gen SIEM through the Microsoft 365 data connector (`#event.dataset=m365.exchange`). **Set-InboxRule caveat:** a modification event only contains the parameters that were passed in that change. Editing a rule's `From` or `SubjectContainsWords` condition produces an event with no `MoveToFolder`, `ForwardTo` or `DeleteMessage` at all, even though the rule still performs that action. Those events are tagged rather than dropped, because retargeting an existing rule's condition is a realistic second step after planting a harmless looking rule. To see the action, pivot on `MailboxId` together with `RuleName` to find the original `New-InboxRule`. Do not use `Vendor.ObjectId` for this: it holds the rule name on `New-InboxRule` but a numeric rule ID on `Set-InboxRule`. If a rule is renamed, `Vendor.Parameters.Identity` holds the old name and `Vendor.Parameters.Name` the new one. **False positives and tuning:** - Most inbox rules are ordinary mailbox organization, and shared or resource mailboxes (calendars, ticket queues) routinely forward copies to the people who work them. - Outlook on the web saves a rule as a `New-InboxRule` followed within seconds by one or more `Set-InboxRule` events, so expect small bursts per edit. To collapse them into one row per rule, replace the `table` line with `| groupBy([MailboxId, RuleName], function=([min(@timestamp, as=FirstChange), max(@timestamp, as=LastChange), count(as=Changes), collect([user.name, event.action, FromCondition, SentToCondition, SubjectCondition, ForwardTarget, DeleteMessage, MoveToFolder, RiskLevel])]))`. This also puts the action from the `New` event next to later condition changes. - The keyword branch is a generic English list. Add local language terms or the senders of your own security tooling to it. - If your tenant uses several mail domains (three or four domains in one tenant is common for groups of companies), a forward between them will show as High. Either accept that or replace the comparison in the first case branch with a list of your owned domains, for example `| test(!in(ForwardDomain, values=["yourdomain.com", "yoursubsidiary.com"]))`.
Malicious Chrome Extension FreeVPN-One Detection
This Logic detects the presence of the malicious Chrome extension FreeVPN[.]One by identifying its unique extension ID across installed browsers. The logic further correlates this presence with network communications initiated by the extension to suspicious or untrusted domains. By combining extension enumeration with traffic analysis, the detection ensures high fidelity with minimal false positives. This layered approach strengthens visibility into malicious browser add-ons masquerading as VPN tools. Reference: [GitHub Aamir-Muhammad/CrowdStrike-Queries](https://github.com/Aamir-Muhammad/CrowdStrike-Queries/blob/main/Hunting-Queries/Malicious-Chrome-Extension-FreeVPN.One-Detection.md)
Malicious Chrome Extension FreeVPN-One Detection
This Logic detects the presence of the malicious Chrome extension FreeVPN[.]One by identifying its unique extension ID across installed browsers. The logic further correlates this presence with network communications initiated by the extension to suspicious or untrusted domains. By combining extension enumeration with traffic analysis, the detection ensures high fidelity with minimal false positives. This layered approach strengthens visibility into malicious browser add-ons masquerading as VPN tools. Reference: [GitHub Aamir-Muhammad/CrowdStrike-Queries](https://github.com/Aamir-Muhammad/CrowdStrike-Queries/blob/main/Hunting-Queries/Malicious-Chrome-Extension-FreeVPN.One-Detection.md)
MFA Failures
Displays the count of MFA authentication failures caused by service errors or user not being enrolled. A sudden spike in these errors may indicate a service incident requiring immediate investigation and response.
MFA Failures
Displays the count of MFA authentication failures caused by service errors or user not being enrolled. A sudden spike in these errors may indicate a service incident requiring immediate investigation and response.