Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

FunkSec – Mass Exploitation Attempt Against Internet-Facing Applications

Funksec Initial Access Sentinel
MITRE ATT&CK
Exploit Public-Facing Application
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group profile (funksec) – no group-specific tool/TTP telemetry on file; generic initial-access detection logic
What This Detects
FunkSec is a low-maturity, AI-assisted RaaS operation with no group-specific tooling on file; its affiliates are reported to rely on opportunistic mass exploitation of internet-facing applications for initial access rather than bespoke tradecraft.
Query
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName in~ ("w3wp.exe","httpd.exe","nginx.exe","java.exe","tomcat.exe")
| where FileName in~ ("cmd.exe","powershell.exe","sh","bash")
| where ProcessCommandLine has_any ("IEX","DownloadString","-enc","curl ","wget ")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.