Multi-TTP Hunting Query - QEMU Abuse Activity

Aamir Muhammad@Aamir

•updated Apr 21, 2026•3•0•220

This query searches for multiple indicators associated with the STAC4713 and STAC3725 campaigns (often linked to PayoutsKing/GOLD ENCOUNTER). It utilizes a fast free-text pre-filter followed by a case statement to categorize specific TTPs, including QEMU abuse, rogue scheduled tasks, suspicious services/accounts, covert tunneling, and credential access.