Prohibited Applications Spawning cmd.exe or powershell.exe

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

Hunts for commonly utilized Microsoft programs (Word, Excel, Publisher, etc) and other programs known to malicious launch powershell or cmd, such as Internet Explorer, Chrome and Firefox.

Attribute	Value
Type	Hunting Query
Solution	Cyborg Security HUNTER
ID	fc36d683-385a-4ec2-842d-2982dbed97a4
Tactics	CommandandControl
Techniques	T1102
Required Connectors	SecurityEvent
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
SecurityEvent	✓	✓	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries · Back to Cyborg Security HUNTER