Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Clop – Suspicious Child Process from Internet-Facing File-Transfer Service

Clop Initial Access Sentinel
MITRE ATT&CK
Exploit Public-Facing Application
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live ttps dataset (clop); public Clop MOVEit/Cleo advisories
What This Detects
Clop's initial access is near-exclusively mass exploitation of internet-facing MFT/file-transfer applications (Cleo, MOVEit, Accellion, GoAnywhere). Flags a web/app-service process spawning a shell or downloader – the pivot point right after exploitation.
Query
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName in~ ("w3wp.exe","java.exe","CleoAS2.exe","CleoHarmony.exe","CleoVLTrader.exe","MOVEitTransfer.exe")
| where FileName in~ ("cmd.exe","powershell.exe","certutil.exe","cscript.exe","wscript.exe")
| where ProcessCommandLine has_any ("IEX","DownloadString","-enc","certutil -urlcache")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.