Hunt and Detect GRIDTIDE
This hunting query searches Defender XDR telemetry for activity consistent with the GRIDTIDE campaign by combining network, process, and file-based indicators. It identifies endpoint connections to published campaign infrastructure, including known IP addresses and dynamic DNS-style domains. It also looks for direct access to Google Sheets API endpoints and parameters described as part of the actor’s command-and-control workflow, particularly when the initiating process is not a normal web browser. In addition, it checks for file and process indicators associated with reported GRIDTIDE artefacts by matching published SHA-256 hashes and common artefact filenames. Results are returned as a unified view with a match type label to help triage whether the alert is driven by network IOC matches, Google Sheets API usage, or host artefact indicators.
Microsoft Sentinel (KQL)
