// PROTOCOL TUNNELING — FUNCTION-READY QUERY

DeviceProcessEvents
| where Timestamp > ago(TimeFilter)
| where FileName in~ (
    "ssh.exe",
    "plink.exe",
    "chisel.exe",
    "frpc.exe",
    "frps.exe"
)
| where ProcessCommandLine matches regex @"(^|\s)-(L|R|D)(\s|=)"
    or ProcessCommandLine has_any (
        "DynamicForward",
        "LocalForward",
        "RemoteForward",
        "proxy",
        "socks",
        "reverse tunnel",
        "chisel",
        "frpc",
        "frps"
    )
| project
    Timestamp,
    DeviceName,
    AccountName,
    FileName,
    ProcessCommandLine,
    InitiatingProcessFileName
| order by Timestamp desc

THREAT HUNT IN TO FUNCTION

Development Effort

The development of these threat hunts was completed over approximately two months. This timeline included researching attacker tradecraft, designing and validating hunt hypotheses, developing and tuning KQL queries, investigating environmental false positives, mapping detections to the MITRE ATT&CK framework, converting the finalized hunts into Microsoft Defender XDR Shared Functions, and validating them for future XSOAR automation.

The work was performed alongside my regular responsibilities as a SOC Analyst, including incident triage, investigations, alert analysis, customer support, and other operational security duties. As a result, development was completed incrementally while maintaining normal SOC operations.

["SYSTEM","LOCAL SERVICE","NETWORK SERVICE",
 "NT AUTHORITY\\SYSTEM","NT AUTHORITY\\LOCAL SERVICE",
 "NT AUTHORITY\\NETWORK SERVICE",
 "svc.intune","svc.sccm","svc.nessus","svc.scan","svc.backup"]