Mirage Kitten NightLedger: Logical Drive Enumeration Spawned from DLL-Load Context
Detects NightLedger Command 75, which enumerates logical drives as a pre-exfiltration reconnaissance step; identifying available storage volumes before staging and uploading data via Command 70 (POST to C2). The query hunts for drive enumeration commands (WMIC, fsutil, PowerShell variants) spawned specifically from the DLL-loader process class associated with NightLedger's execution chain. Drive enumeration from rundll32, regsvr32, AppVShNotify.exe, or dllhost has no legitimate use case and is high-confidence in this parent-process context.
Microsoft Sentinel (KQL)
