Mirage Kitten NightLedger - NetSetup.log Targeted Collection for AD Reconnaissance

Awais Munir@iawais

•updated Aug 4, 2026•1•1•7

Detects NightLedger Command 93, which collects C:\Windows\debug\NetSetup.log alongside a process listing and exfiltrates both to C2. Since DeviceFileEvents does not surface read-class ActionTypes, this query hunts the collection behavior in DeviceProcessEvents: shell commands (type, more, cmd /c) referencing the NetSetup.log path, spawned from the DLL-loader process class consistent with NightLedger's execution chain. NetSetup.log contains domain name, DC hostnames, and join timestamps, high-value AD recon for an espionage actor.