Storm-1175 drops web shells immediately after exploiting vulnerable web-facing applications (Exchange, Ivanti, TeamCity, ScreenConnect, CrushFTP, GoAnywhere, SmarterMail, BeyondTrust). This query detects file writes to common web-accessible directories by web server worker processes. Tune the folder path list to match your environment's IIS, Tomcat, or application paths.

DeviceFileEvents
| where InitiatingProcessFileName has_any (
    "w3wp.exe", "tomcat.exe", "java.exe",
    "httpd.exe", "nginx.exe", "php-cgi.exe"
    )
| where ActionType in ("FileCreated", "FileModified")
| where FileName has_any (".aspx", ".ashx", ".php", ".jsp", ".jspx")
| where FolderPath has_any (
    @"inetpub\wwwroot", @"webapps\",
    @"htdocs\", @"public_html\", @"\owa\"
    )
| project TimeGenerated, DeviceName, FolderPath, FileName,
         InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

On the initially compromised device, Storm-1175 consistently creates a new user account and immediately adds it to the local administrators group using net user /add and net localgroup administrators /add. This query correlates both commands within a five-minute window on the same device, reducing false positives from legitimate IT provisioning.

DeviceProcessEvents
| where FileName in~ ("net.exe", "net1.exe")
| where ProcessCommandLine has "user"
      and ProcessCommandLine has "/add"
| summarize
    Commands   = make_set(ProcessCommandLine),
    FirstSeen  = min(TimeGenerated),
    LastSeen   = max(TimeGenerated),
    EventCount = count()
    by DeviceName, bin(TimeGenerated, 5m)
| where // Both user creation and group add occurred
    Commands has "localgroup" and Commands has "administrators"
| extend DwellSeconds = datetime_diff('second', LastSeen, FirstSeen)
| project FirstSeen, DeviceName, Commands, DwellSeconds, EventCount
| order by FirstSeen desc

Storm-1175 renames Cloudflare tunnel binaries to mimic legitimate Windows processes such as conhost.exe for covert lateral movement over RDP. This query catches instances where known Windows system binary names are executed from non-standard paths — a strong indicator of masquerading.

DeviceProcessEvents
| where FileName in~ (
    "conhost.exe", "svchost.exe", "lsass.exe",
    "csrss.exe", "services.exe", "explorer.exe"
    )
| where FolderPath !startswith @"C:\Windows\System32"
      and FolderPath !startswith @"C:\Windows\SysWOW64"
      and FolderPath !startswith @"C:\Windows\WinSxS"
| extend
    IsFromTemp  = FolderPath has_any (@"\Temp\", @"\AppData\", @"\ProgramData\"),
    ProcessHash = SHA256
| project TimeGenerated, DeviceName, FileName, FolderPath,
         ProcessCommandLine, IsFromTemp, ProcessHash
| order by TimeGenerated desc

Storm-1175 modifies the UseLogonCredential registry value under the WDigest provider to force Windows to cache plaintext credentials in LSASS memory, which are then harvested using Mimikatz or Impacket. Local administrator privileges are required for this modification, so any alert should prompt review of account privilege escalation activity on the same host.

DeviceRegistryEvents
| where RegistryKey has "WDigest"
      and RegistryValueName =~ "UseLogonCredential"
      and RegistryValueData =~ "1"
| extend
    Actor = InitiatingProcessAccountName,
    Cmd   = InitiatingProcessCommandLine
| project TimeGenerated, DeviceName, RegistryKey,
         RegistryValueData, Actor, Cmd,
         InitiatingProcessFileName
| order by TimeGenerated desc

Storm-1175 dumps credentials from LSASS using Task Manager, Mimikatz, and Impacket, and accesses the NTDS.dit Active Directory database from compromised Domain Controllers for offline cracking. This query covers three distinct technique variants: Task Manager LSASS dumps, comsvcs.dll MiniDump invocations, ntdsutil NTDS.dit extraction, and Mimikatz command-line indicators.

DeviceProcessEvents
| where (
    // Task Manager LSASS dump
    (FileName =~ "taskmgr.exe"
     and ProcessCommandLine has "lsass")
    // comsvcs MiniDump technique
    or (ProcessCommandLine has_all ("comsvcs.dll", "MiniDump", "lsass"))
    // ntdsutil NTDS.dit extraction
    or (FileName =~ "ntdsutil.exe"
        and ProcessCommandLine has_any ("ac i ntds", "ifm", "create full"))
    // Mimikatz indicators
    or ProcessCommandLine has_any (
        "sekurlsa::logonpasswords",
        "lsadump::sam", "lsadump::dcsync"
        )
    )
| project TimeGenerated, DeviceName, FileName,
         ProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated desc

Storm-1175 tampers with Microsoft Defender Antivirus registry settings and adds the C:\ drive as an exclusion path via encoded PowerShell before dropping ransomware payloads. The actor also modifies Windows Firewall rules to permit RDP when it is blocked. Both technique classes are covered by this compound query.

union
// Defender registry tampering
(
  DeviceRegistryEvents
  | where RegistryKey has_any (
      "Windows Defender\\Exclusions\\Paths",
      "Windows Defender\\DisableAntiSpyware",
      "Windows Defender\\DisableRealtimeMonitoring"
      )
  | where RegistryValueData in ("1", "C:\\", "C:/")
       or RegistryKey has "Paths"
  | extend AlertType = "DefenderTamper"
  | project TimeGenerated, DeviceName, RegistryKey,
           RegistryValueData, AlertType,
           InitiatingProcessCommandLine
),
// Firewall modification to allow RDP
(
  DeviceProcessEvents
  | where ProcessCommandLine has_all ("netsh", "firewall")
       and ProcessCommandLine has_any ("3389", "remotedesktop", "allow")
  | extend AlertType = "FirewallRDPEnablement",
           RegistryKey = "", RegistryValueData = ""
  | project TimeGenerated, DeviceName, RegistryKey,
           RegistryValueData, AlertType,
           InitiatingProcessCommandLine = ProcessCommandLine
)
| order by TimeGenerated desc

Storm-1175 uses Rclone — frequently renamed to blend in, with the known hash 9632d7e4...672523c observed as lsp.exe — to synchronise victim data to attacker-controlled cloud storage throughout the intrusion. This query detects Rclone by its command-line patterns regardless of the process name, and also flags the known IOC hash directly.

DeviceProcessEvents
| where (
    // Rclone CLI patterns regardless of binary name
    ProcessCommandLine has_any (
        "--config", "--no-check-certificate",
        "--ignore-existing", "--auto-confirm"
        )
    and ProcessCommandLine has_any (
        "copy", "sync", "move", "ls"
        )
    and ProcessCommandLine has_any (
        "mega:", "drive:", "onedrive:",
        "s3:", "ftp:", "sftp:", "pcloud:"
        )
    )
    or SHA256 =~ "9632d7e4a87ec12fdd05ed3532f7564526016b78972b2cd49a610354d672523c"
| extend
    PossibleRclone = FileName,
    TargetCloud    = extract(@"(\w+):", 1, ProcessCommandLine)
| project TimeGenerated, DeviceName, PossibleRclone,
         ProcessCommandLine, TargetCloud, SHA256,
         InitiatingProcessAccountName
| order by TimeGenerated desc

Storm-1175's final stage uses PDQ Deployer to execute RunFileCopy.cmd and distribute Medusa ransomware (Gaze.exe, SHA-256: 0cefeb62...4be96) across the network, or alternatively abuses Group Policy Objects (GPOs) for broad deployment. Alert fidelity is highest when correlated with earlier-stage detections in this ruleset.

union
// PDQ Deployer launching ransomware delivery script
(
  DeviceProcessEvents
  | where InitiatingProcessFileName =~ "PDQDeployRunner.exe"
       or ProcessCommandLine has_any (
           "RunFileCopy.cmd", "Gaze.exe"
           )
       or SHA256 =~ "0cefeb6210b7103fd32b996beff518c9b6e1691a97bb1cda7f5fb57905c4be96"
  | extend DeliveryMethod = "PDQ"
  | project TimeGenerated, DeviceName, ProcessCommandLine,
           SHA256, DeliveryMethod
),
// GPO modification as alternative mass-deployment vector
(
  SecurityEvent
  | where EventID in (5136, 5137, 5141)
  | where ObjectClass =~ "groupPolicyContainer"
       or OperationType has_any (
           "Write Property", "Create Object"
           )
  | extend DeliveryMethod = "GPO",
           ProcessCommandLine = "", SHA256 = ""
  | project TimeGenerated, DeviceName = Computer,
           ProcessCommandLine, SHA256, DeliveryMethod
)
| order by TimeGenerated desc