Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

The Gentlemen – MANSPIDER Sensitive-String Share Crawler

Thegentlemen Discovery Sentinel
MITRE ATT&CK
Network Share Discovery
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (thegentlemen)
What This Detects
Beyond its PetitPotam/NTLM-relay chain, The Gentlemen runs MANSPIDER — a tool that crawls SMB/FTP/SFTP shares searching file contents for sensitive strings like 'password' — a distinctive, less commonly seen discovery technique.
Query
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName has "manspider" or ProcessCommandLine has_any ("manspider","MANSPIDER")
| project Timestamp, DeviceName, ProcessCommandLine, AccountName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.