title: High-Volume Ingress Tool Transfer From Newly-Attributed CIDR
id: hfl-2026-034-01
status: experimental
description: Detects multiple binary downloads from an outbound destination newly attributed to a threat actor CIDR in the last 30 days.
logsource:
    category: network_connection
    product: firewall
detection:
    selection:
        dst_ip|cidr_recent_attribution: true
        payload_type: 'binary'
        connection_count|gte: 3
    timeframe: 1h
    condition: selection
fields: [src_host, dst_ip, dst_cidr, payload_hash, first_attribution_date]
level: high
tags: [attack.command_and_control, attack.t1105]

title: PowerShell With Base64 or Obfuscated Argument Chain
id: hfl-2026-034-02
status: experimental
description: Detects PowerShell invocations with base64-encoded commands or characteristic obfuscation markers.
logsource:
    category: process_creation
    product: windows
detection:
    selection_powershell:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_obfuscation:
        CommandLine|contains:
            - '-enc'
            - '-EncodedCommand'
            - 'FromBase64String'
            - '[char]'
            - 'IEX(New-Object'
    filter_admin:
        User|contains: 'admin_scheduled_task_svc'
    condition: selection_powershell and selection_obfuscation and not filter_admin
fields: [Image, CommandLine, ParentImage, User]
level: high
tags: [attack.execution, attack.t1059_001, attack.defense_evasion, attack.t1027]

title: Spearphishing Link Click Followed By Drive-By Payload Fetch
id: hfl-2026-034-03
status: experimental
description: Detects a mail-client link click quickly followed by an outbound HTTP fetch to a payload URL.
logsource:
    category: proxy
detection:
    selection_mail:
        source_process|endswith:
            - '\outlook.exe'
            - '\thunderbird.exe'
        referer|contains: 'outlook'
    selection_payload:
        response_content_type|contains:
            - 'application/octet-stream'
            - 'application/x-msdownload'
    timeframe: 5m
    condition: selection_mail and selection_payload
fields: [src_user, dst_url, response_content_type, referer]
level: high
tags: [attack.initial_access, attack.t1566_002, attack.t1189]

title: Ransomware Precursor Cascade — Shadow-Copy Delete + Defender Disable
id: hfl-2026-034-04
status: experimental
description: Detects the canonical ransomware pre-encryption cascade — shadow-copy deletion + defender disable within a short window.
logsource:
    category: process_creation
    product: windows
detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'resize shadowstorage'
    selection_defender_off:
        CommandLine|contains:
            - 'Set-MpPreference -DisableRealtimeMonitoring'
            - 'Set-MpPreference -DisableBehaviorMonitoring'
    timeframe: 10m
    condition: selection_vssadmin or selection_defender_off
fields: [Image, CommandLine, ParentImage, User]
level: critical
tags: [attack.impact, attack.t1486, attack.t1490, attack.defense_evasion, attack.t1562_001]

SELECT src_host, dst_cidr, connection_count
FROM outbound_connections
JOIN cti_cidr_attribution USING (dst_cidr)
WHERE attribution_operator_iocs_this_week >= 100
  AND event_time >= now() - interval '7 days'
GROUP BY src_host, dst_cidr
ORDER BY connection_count DESC
LIMIT 100;

# Interpretation: any internal host talking to a CIDR whose owning operator produced
# 100+ IOCs THIS WEEK. Small pool. High-signal. Priority-1 triage.

SELECT host, MIN(event_time) first_event, ARRAY_AGG(DISTINCT indicator) markers
FROM endpoint_events
WHERE (
  (image_ends 'vssadmin.exe' AND command_line MATCHES 'delete shadows')
  OR command_line MATCHES 'Set-MpPreference%DisableRealtimeMonitoring'
  OR command_line MATCHES 'wbadmin delete catalog'
  OR command_line MATCHES 'bcdedit%recoveryenabled No'
)
AND event_time >= now() - interval '30 days'
GROUP BY host
HAVING COUNT(DISTINCT indicator) >= 2
ORDER BY first_event DESC;

# Interpretation: hunt the CASCADE, not the family. Any endpoint that fires two of
# these precursors within 30 days is a Priority-1 ransomware-staging suspect regardless
# of which of the 50 operators is behind it.

WITH mail_click AS (
  SELECT src_user, dst_url click_url, event_time click_time
  FROM proxy_events
  WHERE source_process ENDS 'outlook.exe' OR source_process ENDS 'thunderbird.exe'
    AND event_time >= now() - interval '7 days'
),
followup_fetch AS (
  SELECT src_user, dst_url fetch_url, event_time fetch_time
  FROM proxy_events
  WHERE response_content_type IN ('application/octet-stream','application/x-msdownload')
    AND event_time >= now() - interval '7 days'
)
SELECT m.src_user, m.click_url, f.fetch_url,
       EXTRACT(EPOCH FROM (f.fetch_time - m.click_time)) delta_seconds
FROM mail_click m JOIN followup_fetch f USING (src_user)
WHERE f.fetch_time BETWEEN m.click_time AND m.click_time + interval '5 minutes'
ORDER BY m.click_time DESC
LIMIT 100;

# Interpretation: the canonical spearphishing-into-drive-by chain. When a user clicks
# a link from a mail client and their machine fetches a binary payload within 5
# minutes, that is high-signal T1566.002 -> T1189 -> T1204 chain evidence.