AhsayCBS Exploitation and XMRig Miner Hunt
Detects indicators of compromise associated with a compromised AhsayCBS server, including connections to malicious infrastructure, execution of suspicious child processes or administrative utilities by cbssvcX64.exe, and the presence of known cryptominer artifacts and scripts. The query ran without errors in a live tenant.
Microsoft Sentinel (KQL)
