Hunting Spirals

• Jul 19, 2026
• 5-minute read

This is Part 2 the series. In Initial part we broke down the Spirals intrusion, one web shell to a fully encrypted network in under 24 hours and mapped it to the Microsoft controls that would have stopped it. This part is the hands-on half: the tools, and exactly how to use them.

In the initial part we walked the Spirals kill chain and pulled out the behaviours that matter. Knowing the theory is one thing; having the tripwires live in your tenant is another. So I’ve packaged the published indicators into two resources you can deploy today.

What you’re getting

Both are built entirely from the Symantec Protection Bulletin, nothing you can’t verify at source.

Before you start: read this first

Two things to set expectations:

1. The IOCs are a tripwire, not a strategy. Symantec has confirmed a single Spirals case. Static indicators (hashes, IPs) age fast and are trivial for an attacker to change. They’re worth loading because they’re cheap and specific — but the behavioural queries in the pack (LSASS dumps, backup-service kills, tunnelling) are what will catch the next fast operator regardless of what they call themselves.
2. Tune before you alert. The queries use a broad 30-day window and generic living-off-the-land filters. Run them as hunts first, learn what’s normal in your estate, and only then promote the useful ones to scheduled analytics rules. Turn query 5 (tunnelling) or query 6 (RDP / local accounts) into an alert without tuning and you’ll drown in legitimate admin activity.

Load the IOC watchlist into Microsoft Sentinel

A watchlist lets you manage the indicators in one place and reference them from any query, without hard-coding values.

1. In the Microsoft Security Portal portal, open Microsoft Sentinel.
2. Under Configuration, choose Watchlist, then + New.
3. On the General tab set:
   • Name and Alias: Spirals (the alias is what queries call — keep it exact).
   • Description: e.g. Spirals ransomware IOCs (Symantec, June 2026).
4. On the Source tab:
   • Number of lines before row with headings: 0.
   • Upload file: select spirals-ioc-watchlist.csv.
   • SearchKey: choose Indicator. This is the column Sentinel indexes for fast joins.
5. Review and Create. Give it a minute to ingest.

To confirm it loaded:

_GetWatchlist('Spirals')
| summarize count() by IndicatorType

You should see counts across SHA256, IPv4, URL, FileName and FilePath.

Use the watchlist in a detection

The pack’s final query joins your device telemetry against the watchlist, so it stays current as you edit the list — no query changes needed:

let iocs = _GetWatchlist('Spirals');
let badHashes = iocs | where IndicatorType == "SHA256" | project Indicator;
let badIPs    = iocs | where IndicatorType == "IPv4"   | project Indicator;
DeviceProcessEvents
| where Timestamp > ago(30d)
| where SHA256 in (badHashes)
| union (
    DeviceNetworkEvents
    | where Timestamp > ago(30d)
    | where RemoteIP in (badIPs))
| project Timestamp, DeviceName, FileName, SHA256, RemoteIP, ProcessCommandLine

Run the hunting pack in Defender XDR

If you’re working directly in Microsoft Defender XDR, the first seven queries run natively in Advanced Hunting with no watchlist required the indicators are embedded.

1. Go to Microsoft Security Portal → Hunting → Advanced hunting.
2. Open spirals-hunting-queries.kql, copy a query block, paste it in, and Run query.
3. Work through them in kill-chain order. The two highest-value queries to run first:

LSASS credential theft — appears in a large share of hands-on-keyboard intrusions, not just Spirals:

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "rundll32.exe"
| where ProcessCommandLine has "comsvcs.dll"
    and ProcessCommandLine has_any ("MiniDump","#24")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

Backup / database service termination — the last-minute move before encryption. A hit here is a five-alarm fire:

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("net.exe","sc.exe","taskkill.exe","powershell.exe")
| where ProcessCommandLine has_any (
    "Veeam","VMware","MSSQL","OracleService","postgresql","Hyper-V","vss","Backup")
| where ProcessCommandLine has_any ("stop","delete","disabled","kill")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine

The remaining queries in the pack cover the IOC sweep, Defender tampering, tunnelling C2, RDP/local-account creation, and the RECOVERY_SECTION.log ransom-note artifact.

Promote the good ones to alerts

Once you’ve hunted with a query and confirmed it’s clean of false positives in your environment, turn it into a scheduled detection:

• In Defender XDR: from the Advanced Hunting results, select Create detection rule, set the frequency and impacted entities, and map it to the right severity.
• In Sentinel: create an Analytics rule (Scheduled), paste the tuned KQL, set the entity mappings (Host, Account, IP), and a run frequency that matches the threat — for the backup-kill query, run it often; a hit needs a response in minutes, not hours.

Start with the LSASS and backup-kill queries as alerts. Keep the noisier ones (tunnelling, RDP) as scheduled hunts or heavily-scoped alerts until you’ve tuned out your own admin tooling.

Grab the files

• GitHub - Spirals Watchlist — the Sentinel-ready IOC watchlist.
• GitHub - Spirals KQL Pack — the seven-query Advanced Hunting pack + Sentinel watchlist version.

If you run these in your own tenant, I’d genuinely like to know how it goes! What fired, what needed tuning, what you’d add, drop a comment below.

And if you haven’t yet, read Part 1 for the story behind the indicators and the 30-minute hardening checklist.

Sources: Symantec Threat Intelligence — Spirals ransomware · BleepingComputer. All indicators reproduced from the Symantec Protection Bulletin.

Posts in this series

• Hunting Spirals
• Under 24 Hours: What the Spirals Ransomware Case Teaches Us About Speed

Related Posts

• Under 24 Hours: What the Spirals Ransomware Case Teaches Us About Speed
• Introducing Harbinger