Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
This query checks for multiple signs of ransomware activity to identify affected devices.
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | Microsoft Defender XDR |
| ID | 4f669adc-2c00-4bc8-896b-e59f068dcb18 |
| Tactics | Execution, Impact, Exfiltration |
| Required Connectors | MicrosoftThreatProtection |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
DeviceProcessEvents |
ProcessCommandLine has "cl"ProcessCommandLine has "config"ProcessCommandLine has "delete"ProcessCommandLine has "deletejournal"ProcessCommandLine has "disabled"ProcessCommandLine has "sc"ProcessCommandLine has "shadowcopy delete"ProcessCommandLine has "usn"ProcessCommandLine has "wbadmin"ProcessCommandLine has "wevtutil"ProcessCommandLine has "wmic" |
✓ | ✗ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊