Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Sinobi – Public-Facing Exploit or Privileged Logon Followed by Rapid Service Creation

Sinobi Initial Access Sentinel
MITRE ATT&CK
Exploit Public-Facing Application
Data Source
DeviceLogonEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live ttps dataset (sinobi)
What This Detects
Sinobi intrusions move quickly from initial access (exploited public-facing app or reused valid credentials) to service-based execution. Flags a privileged interactive/network logon followed within 30 minutes by a new service creation on the same host.
Query
let logon = DeviceLogonEvents
| where Timestamp > ago(1d)
| where LogonType in ("RemoteInteractive","Network") and IsLocalAdmin == true
| project DeviceName, LogonTime = Timestamp, AccountName;
let svcCreate = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "sc.exe" and ProcessCommandLine has "create"
| project DeviceName, SvcTime = Timestamp, SvcCmd = ProcessCommandLine;
logon
| join kind=inner svcCreate on DeviceName
| where SvcTime - LogonTime between (0min .. 30min)
| project DeviceName, AccountName, LogonTime, SvcTime, SvcCmd

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.