SentinelOne Queries
Collected from everywhere over the years.
- Apps running from recycle bin FileFullName RegExp ".*\$Recycle\.Bin.*" - Apps running user directories FileFullName RegExp ".*\\AppData\\.*" - Bits Transfers FileFullName RegExp ".*bitsadmin\.exe.*" - PowerShell FileFullName RegExp ".*PowerShell.exe*" FileFullName RegExp "\.ps1" FileFullName RegExp "\.psm1" FileFullName RegExp "\.psd1" - Psexec usage FileFullName RegExp ".*psexec.*" - File sharing program usage FileFullName RegExp ".*OneDrive.*" OR FileFullName RegExp ".*DropBox.exe.*" OR FileFullName RegExp ".*Box.*" OR FileFullName RegExp ".*icloud.*" FileFullName RegExp ".*egnyte.*" OR FileFullName RegExp ".*dropsend.*" OR FileFullName RegExp ".*Hightail.*" OR FileFullName RegExp ".*justcloud.*" OR FileFullName RegExp ".*Onehub.*" OR ImageFileName="*OpenDrive*" OR ImageFileName="*sharedfile*" OR ImageFileName="*SugarSync*" OR ImageFileName="*4shared*" OR ImageFileName="*Google\\Drive*" OR ImageFileName="*owncloud*")|table ComputerName UserName ImageFileName FileName SHA256HashData - All Detection Events EventType=Event_ExternalApiEvent Severity>0 | table_time ComputerName CommandLine DetectDescription DetectName EventType FileName FilePath IOCType MD5String MachineDomain ParentProcessId ProcessId ProcessStartTime SHA1String SHA256String Severity SeverityName UTCTimestamp timestamp DstPort = "23" or DstPort ="21" or DstPort = "22" or DstPort = "3389" ProcessImagePath CONTAINS "$Recycle.Bin" ProcessImagePath RegExp ".*AppData.*" OR ProcessImagePath RegExp ".*Desktop.*" FileFullName RegExp ".*AppData.*" OR FileFullName RegExp ".*Desktop.*" DstPort = "23" or DstPort ="21" or DstPort = "22" or DstPort = "3389" ProcessImagePath CONTAINS "$Recycle.Bin" ProcessImagePath RegExp ".*AppData.*" OR ProcessImagePath RegExp ".*Desktop.*" FileFullName RegExp ".*AppData.*" OR FileFullName RegExp ".*Desktop.*"