Hunt for BlueHammer, RedSun, and UnDefend activity
This query detects activity associated with the BlueHammer, RedSun, and UnDefend toolset used in post‑exploitation campaigns (including "Nightmare Eclipse" intrusions). It identifies: - Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive). - File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders). - BeigeBurrow tunneling via agent.exe. - Reconnaissance commands (whoami /priv, cmdkey /list, net group). - Network connections to known‑malicious IP addresses. - Use of the REDSUN named pipe for privilege escalation. The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
Microsoft Sentinel (KQL)
