Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Pysa – SessionGopher Credential Harvesting Preceding Empire/Koadic Beacon

Pysa Command and Control Sentinel
MITRE ATT&CK
Ingress Tool Transfer
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (pysa)
What This Detects
Pysa runs SessionGopher to harvest saved RDP/WinSCP/FileZilla/PuTTY sessions, then stages a PowerShell Empire, Koadic or Chashell implant for C2 – correlating the two narrows a broad credential-harvest signal to a Pysa-consistent chain.
Query
let harvest = DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has "SessionGopher"
| project DeviceName, HarvestTime = Timestamp, AccountName;
let implant = DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has_any ("Invoke-Empire","Koadic","chashell")
| project DeviceName, ImplantTime = Timestamp;
harvest
| join kind=inner implant on DeviceName
| where ImplantTime - HarvestTime between (0min .. 8h)
| project DeviceName, AccountName, HarvestTime, ImplantTime

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.