Sinobi – Public-Facing Exploit or Privileged Logon Followed by Rapid Service Creation

Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

MITRE ATT&CK

T1190

Exploit Public-Facing Application

Data Source

DeviceLogonEvents

Date Added

2026-07-23

Last Updated

2026-07-23

Source

ransomware.live ttps dataset (sinobi)

What This Detects

Sinobi intrusions move quickly from initial access (exploited public-facing app or reused valid credentials) to service-based execution. Flags a privileged interactive/network logon followed within 30 minutes by a new service creation on the same host.

Query

let logon = DeviceLogonEvents
| where Timestamp > ago(1d)
| where LogonType in ("RemoteInteractive","Network") and IsLocalAdmin == true
| project DeviceName, LogonTime = Timestamp, AccountName;
let svcCreate = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "sc.exe" and ProcessCommandLine has "create"
| project DeviceName, SvcTime = Timestamp, SvcCmd = ProcessCommandLine;
logon
| join kind=inner svcCreate on DeviceName
| where SvcTime - LogonTime between (0min .. 30min)
| project DeviceName, AccountName, LogonTime, SvcTime, SvcCmd

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.