Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Nightspire – Everything.exe Rapid File Search Preceding WinSCP/MEGA Transfer

Nightspire Discovery Sentinel
MITRE ATT&CK
File and Directory Discovery
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (nightspire)
What This Detects
Nightspire uses the voidtools 'Everything' NTFS-index search utility for near-instant sensitive-file discovery, then stages the results out via WinSCP or MEGA – an uncommon discovery tool that stands out on endpoints.
Query
let search = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName has_any ("everything.exe","es.exe")
| project DeviceName, SearchTime = Timestamp;
let transfer = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in~ ("winscp.exe","winscp.com","megasync.exe","megacmd.exe")
| project DeviceName, TransferTime = Timestamp;
search
| join kind=inner transfer on DeviceName
| where TransferTime - SearchTime between (0min .. 4h)

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.