Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

BianLian – PingCastle/SharpShares Active Directory Assessment Abuse

Bianlian Discovery Sentinel
MITRE ATT&CK
Domain Trust Discovery
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (bianlian)
What This Detects
Separately from its RDP Recognizer credential-validation step, BianLian runs the legitimate AD security-assessment tool PingCastle alongside SharpShares to map domain trusts and accessible shares.
Query
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName has "pingcastle" or FileName has "sharpshares"
| summarize ToolsSeen = make_set(FileName), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, AccountName
| where array_length(ToolsSeen) >= 1

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.