STAGE 4.1: THREAT HUNTING & FLEET DISPATCHEROSQUERY / VELOCIRAPTOR / CROWDSTRIKE RTR / MDE KQL14,850 SENSORS ACTIVE
Autonomous Threat Hunting & EDR Fleet Dispatcher
Converts reverse-engineered malware indicators into fleet-wide hunting queries across osquery SQL, Velociraptor VQL, CrowdStrike Real Time Response (RTR), and Microsoft Defender for Endpoint (MDE) KQL. Validates threat hypotheses, surfaces infected enterprise hosts, and executes 1-click containment.
Total Fleet Endpoints
14,850 Hosts
Win: 11,200 | Lin: 2,950 | Mac: 700
Active EDR Agents
99.8% Online
CrowdStrike • MDE • Velociraptor
Compromised Hosts Identified
5 Critical Hits
Across 4 subnets
Mean Query Execution
1.34 Seconds
Distributed asynchronous polling
Threat Hypothesis Catalog6 Active
Select an enterprise threat hypothesis derived from static/dynamic reverse engineering findings:
T1055.012 • Defense Evasion / Process InjectionCritical
Unbacked Executable Memory Regions (RWX) in svchost.exe
Hunts for hollowed or reflectively injected svchost.exe instances with PAGE_EXECUTE_READWRITE memory segments ...
Target: svchost.exeosquery
T1059.001 • ExecutionHigh
Anomalous PuTTY / Office Spawning Hidden PowerShell
Identifies interactive terminal clients or document viewers spawning hidden powershell.exe or cmd.exe child pr...
Target: putty.exe / WINWORD.EXEMDE KQL
T1490 • Impact / Inhibit System RecoveryCritical
Fleet-Wide Volume Shadow Copy Deletion Events
Searches for ransomware staging attempts attempting to delete Volume Shadow Copies to prevent system restore o...
Target: vssadmin.exe / wmic.exeVelociraptor
T1555.003 • Credential AccessHigh
DPAPI MasterKey Extraction & Chromium SQLite Scraping
Detects non-browser executables accessing '%LocalAppData%\Google\Chrome\User Data\Default\Login Data' SQLite d...
Target: RedLine / Unknown Binariesosquery
T1570 • Command and Control / Lateral MovementCritical
Cobalt Strike Named Pipe Pivot Infrastructure (\pipe\msagent_*)
Scans SMB named pipes across all corporate workstations for standard Cobalt Strike SMB beacon listeners and pi...
Target: All System HostsVelociraptor
T1071.001 • Defense Evasion / Network EgressMedium
Nim / Rust / Golang Binaries with Direct Outbound Sockets
Hunts for compiled binaries containing language runtime signatures (e.g. '@m..@sNimMain', 'go.buildid') establ...
Target: Non-standard PE/ELFMDE KQL
Fleet Hunting Query Forge: Unbacked Executable Memory Regions (RWX) in svchost.exe
Selected Tactic: Defense Evasion / Process Injection (T1055.012) • Target OS: Windows
Targeting: All 14,850 Workstations & Servers
Live Fleet Threat Detections (5 Hosts Flagged)
Real-time telemetry stream aggregated from CrowdStrike Falcon, MDE, and Velociraptor endpoints.
| Hostname / IP | OS / User | Process & PID | Matched Behavioral Indicator | Detection Time | Status | Action |
|---|---|---|---|---|---|---|
FIN-SRV-04.corp.local 10.140.12.44 | Windows Server 2022 NT AUTHORITY\SYSTEM | svchost.exe PID: 5410 | Unbacked RWX VAD Allocation (Beacon Watermark #1337) | 2026-08-23 23:14:02 UTC | Infected | |
DEV-WS-119.corp.local 10.140.88.19 | Windows 11 Enterprise corp\jsmith | SillyPutty.exe PID: 2104 | PuTTY spawned PowerShell TCP reverse shell to 192.168.195.139:4444 | 2026-08-23 23:18:45 UTC | Infected | |
HR-DESK-02.corp.local 10.140.19.102 | Windows 10 Pro 22H2 corp\mwilson | SikoMode.exe PID: 5120 | HTTP POST credential exfiltration to update.kbfirewall.com | 2026-08-23 23:22:11 UTC | Infected | |
EXEC-LAPTOP-01.corp.local 10.140.5.12 | Windows 11 Enterprise corp\ceo_office | RedLineStealer.exe PID: 6104 | MetaMask extension key scrape & Net.Tcp C2 stream | 2026-08-23 23:25:39 UTC | Infected | |
DC-PRIMARY-01.corp.local 10.140.1.10 | Windows Server 2022 NT AUTHORITY\SYSTEM | tasksche.exe PID: 3820 | WannaCry service wrapper 'mssecsvc2.0' spawned vssadmin shadow copy wipe | 2026-08-23 23:29:10 UTC | Infected |