Three CRITICAL fileless alerts.
One hash. One email subject.
The 12-hour intake returned seven PowerShell detections, three of them CRITICAL fileless executions across three hosts. The agent pivoted on the file hash across event types and found it in a still-active phishing campaign. Five emails matching the subject “Important Information About Your Account – Must Read” had been delivered earlier the same day.
"Important Information About Your Account - Must Read" · 3 delivered today, 1 blocked, 1 from yesterday. Active phishing ongoing.The hash existed in three event types: endpoint detections, mail flow, OSINT inventory. A single discovery query surfaced all three. Single-source tools see one event type. The mesh connects all three.
Three CRITICAL alerts were the starting point, not the case. The hunt mattered because the hash traced back to the delivery vector.
A single discovery scan connected endpoint detections to active email delivery. The mesh made that a one-query pivot.
Three CRITICAL alerts. Same message body.
A 12-hour intake on PowerShell detection findings returned 7 records. Three of them carried CRITICAL severity and the exact same alert text: “powershell.exe is executing a fileless script or command.” Three different hosts, three different users, all within 4 hours.
02:11 UTC, BD-3263 (edward.h***), titleENUMERATE_PROCESSES, hashf6c3023f..., source IP136.179.10.13504:03 UTC, NY-2162 (virginia.a***), titleFILELESS, hash6d05be44..., source IP52.39.83.2705:40 UTC, TS-872 (barbara.e***), titleFILELESS, hashf7de7d87..., same source IP52.39.83.27
Three hosts. Two different hashes. One shared source IP for two of them. The shape was suggestive of campaign activity, but a campaign of what? Fileless PowerShell can ride in via a dozen vectors. The agent’s next move decided whether the case stayed at three alerts or grew.
From one hash to three event types.
Instead of chasing each host individually, the agent pivoted on the file hash. One discovery scan on the IOC, across every event type in the mesh:
That single query hit three event types. The third one made the case.
osint_inventory_info
detection_finding
email_activity
The hash isn’t just on three endpoints. It’s in the mail flow. 62 email activity records, including 5 in the last 24 hours. The agent’s follow-up query confirmed the campaign was still running:
The other two pivots told the same story.
Each of the other two CRITICAL hashes got the same hash-pivot treatment. 6d05be44...
(NY-2162) returned 300+ cross-event records over 7 days. The timeline told the story: an earlier
“encoded fileless script” variant on 03/10, an svchost.exe injected code into iexplore.exe
alert (T1055 process injection) on 03/06, and twin “known virus detected” alerts on 03/12 with
Deny + Terminate actions. Same campaign, evolving payloads.
The 7-day per-host O365 sweeps confirmed the delivery vector across all three CRITICAL hosts: three O365 ATP Phishing alerts on BD-3263 (03/06, 03/07, 03/12), three on NY-2162 (03/08, 03/10, 03/11), and the same pattern on TS-872. Every CRITICAL fileless host had been receiving phishing for at least seven days before the fileless alert fired.
The two MEDIUM findings, BD-1158 (ryan.j***, ENUMERATE_PROCESSES) and
BD-2820 (daniel.k***, BYPASS_POLICY), came from a different but related
source IP (8.39.141.5) and matched the same campaign’s pre-execution phase. Two hosts
probed, not yet escalated to fileless.
One IP discovery scan errored. The agent ran QUERY *.message, *.time WITH %ip = '52.39.83.27' AFTER 7d
and the query timed out. Too many records across all event types. Rather than retrying blindly, the agent
narrowed to host-scoped queries and documented the gap.
Hash-pivot is the highest-leverage single query.
One QUERY *.message, *.time WITH %hash = ... AFTER 7d returned 225 records across three event types. Mail flow + endpoint detections + OSINT in a single result. The mesh-level discovery scan beats five single-source queries.
The delivery vector is the threat chain’s root.
Three CRITICAL fileless alerts didn’t tell the campaign story. The email_activity records did. With the delivery vector confirmed, the recommendation shifted from “investigate each host” to “block the campaign at the gateway and quarantine inboxes.”
Document timeouts as findings, not failures.
The broad IP scan timed out. Instead of retrying blindly, the agent narrowed to host-scoped queries and logged the gap. The narrow query produced the host context. The gap got an explicit follow-up.
Track hashes across days, not just the alert window.
Both CRITICAL hashes had history: earlier fileless variants on 03/10, process injection on 03/06, repeated phishing on the same hosts since 03/06. The 12h intake was the tip; the 7d hash-pivot was the iceberg.
Key queries: intake + hash-pivot + delivery confirmation
Q112h PowerShell detection_finding intakeINTAKE
Q5Hash discovery scan, f6c3023f… across all event typesCORE PIVOT
osint_inventory_info, detection_finding (~160), and email_activity (~62). Hash present in mail flow — delivery vector confirmed.Q6Hash discovery scan, 6d05be44… (the second CRITICAL)CAMPAIGN CONFIRMED
Q7IP discovery scan, 52.39.83.27 (shared across two CRITICALs)TIMEOUT
Q11Email activity for hash f6c3023f… (24h focused)CAMPAIGN ACTIVE
Showing 5 of 19 queries. Full audit trail in queries.md.
Sources queried · with status
| Source | Status | Notes |
|---|---|---|
| detection.crowdstrike | HIT | ~160 detection events; per-host process telemetry |
| email.o365 (ATP + mail flow) | HIT | 62 email_activity events; subject + sender + delivery status confirmed |
| osint.inventory_info | HIT | Hash reputation tracking; “last seen” timestamps |
| detection.o365_per_host (7d) | PARTIAL | Per-host phishing alerts with UNKNOWN severity/status (O365 connector limitation) |
| IP-scoped cross-event lookup | GAP | Q7 timed out on broad IP query. Too many records across all event types |
Gaps explicitly catalogued
- Broad IP discovery query timeout: narrowed to host-scoped follow-ups. Documented as connector budget limit, not data gap.
- O365 phishing alerts have UNKNOWN severity / status: connector mapping issue. Phishing delivery confirmed via mail flow records, not ATP alerts.
- Process_activity for the 5 affected hosts not queried: the agent confirmed fileless execution but not the parent process chain. Budget-bounded. Follow-up recommended.
- 52.39.83.27 source IP not enriched: OSINT reputation lookup deferred. Two CRITICAL fileless events share this source; recommend prioritization.
Trace your next fileless alert back to the inbox.
Bring the hash.