Recover patient-zero web activity before Run execution
Finding
Huntress did not publish the compromised landing website. This first search derives the patient-zero execution time from RunMRU and attempts to recover preceding URL or referrer context from local web or proxy telemetry.
The arrival URL is a high-value environment pivot when retained, but it must remain unknown rather than invented when telemetry is absent.
View query
Q-01First searchRecover patient-zero web activity before Run execution
What this checks
Recover the URL, domain, or referrer visible immediately before suspicious RunMRU activity on NVV-EX-2123 without inventing the unpublished compromised website.
KQL
let patient_zero = "NVV-EX-2123";
let run_events =
DeviceRegistryEvents
| where DeviceName =~ patient_zero
| where RegistryKey endswith @"\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
| where RegistryValueData has_any (
"pcalua", "mshta", "powershell", "pwsh", "rundll32",
"regsvr32", "wscript", "cscript", "curl", "certutil",
"msiexec", "http://", "https://"
)
| project RunTime = Timestamp, DeviceId, DeviceName, RunCommand = RegistryValueData;
DeviceNetworkEvents
| join kind=inner run_events on DeviceId
| where Timestamp between (RunTime - 15m .. RunTime)
| project
RunTime,
Timestamp,
DeviceName,
RunCommand,
InitiatingProcessFileName,
InitiatingProcessCommandLine,
RemoteUrl,
RemoteIP,
RemotePort
| order by RunTime asc, Timestamp ascSPL
| multisearch
[ | tstats count
from datamodel=Endpoint.Registry
where Registry.dest="NVV-EX-2123"
Registry.registry_path="*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*"
by _time Registry.dest Registry.user Registry.registry_value_data
| rename Registry.dest as dest Registry.user as user Registry.registry_value_data as run_command
| where match(lower(run_command),
"(pcalua|mshta|powershell|pwsh|rundll32|regsvr32|wscript|cscript|curl|certutil|msiexec|https?://)")
| eval stage="run"
]
[ | tstats count values(Web.url) as urls values(Web.http_referrer) as referrers
from datamodel=Web.Web
where Web.src="NVV-EX-2123"
by _time Web.src Web.user Web.url_domain Web.action
| rename Web.src as dest Web.user as user Web.url_domain as url_domain Web.action as action
| eval stage="web"
]
| sort 0 dest - _time
| streamstats current=f
last(eval(if(stage="run", _time, null()))) as run_time
last(eval(if(stage="run", run_command, null()))) as run_command
by dest
| where stage="web" AND isnotnull(run_time) AND _time<=run_time AND _time>=run_time-900
| table run_time _time dest user run_command url_domain urls referrers action count
| sort run_time _timeWhat to look for
A recoverable source URL, referrer, redirect, or domain that can be searched across all users and devices, with first seen, last seen, action, and execution context preserved.
Technical details
Tested signal
Browser or web activity on patient zero during the fifteen minutes before a suspicious RunMRU event.
Assumptions
- RunMRU and endpoint network events share a stable device identifier and comparable timestamps.
- A fifteen-minute lookback is a bounded investigative window that must be adapted locally.
- Full source URL or referrer recovery may require proxy or web telemetry beyond endpoint network events.
Data requirements and relevant fields
- registry
Patient-zero RunMRU events used to derive the execution time from observed telemetry.
TimestampDeviceIdDeviceNameRegistryKeyRegistryValueDataInitiatingProcessAccountUpn
- network
Preceding endpoint network or mapped proxy activity with destination, process, user, and timestamp context.
TimestampDeviceIdDeviceNameRemoteUrlRemoteIPRemotePortInitiatingProcessFileNameInitiatingProcessCommandLine
KQL schema
DeviceNetworkEvents can recover preceding destinations but may not retain browser URL or referrer. Substitute mapped web or proxy telemetry where those fields are available.
SPL schema
Requires Registry and Web telemetry mapped to Splunk CIM. Web.http_referrer and full URL retention vary by source and must be confirmed locally.
Limitations
- DeviceNetworkEvents may show destinations without the full browser URL or referrer.
- Absence of retained web telemetry does not weaken the documented ClickFix execution chain.
- Nearby web activity must still be correlated with the user action and cannot be assumed causal.
The KQL variant derives the lookback from RunMRU and endpoint network telemetry. The SPL variant uses CIM Registry and Web events; referrer and full URL fields require local mapping.