Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Detect suspicious commands initiated by web server processes used for network discovery and user/owner discovery.
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | Microsoft Defender XDR |
| ID | fa2f7d8a-6726-465a-aa72-6f6e3d4c99d7 |
| Tactics | Execution, DefenseEvasion, Discovery |
| Required Connectors | MicrosoftThreatProtection |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
DeviceProcessEvents |
InitiatingProcessFileName in "beasvc.exe,httpd.exe,w3wp.exe"InitiatingProcessFileName startswith "tomcat"InitiatingProcessParentFileName in "beasvc.exe,httpd.exe,w3wp.exe"InitiatingProcessParentFileName startswith "tomcat"ProcessCommandLine contains "%temp%"ProcessCommandLine has "certutil"ProcessCommandLine has "ipconfig"ProcessCommandLine has "ping"ProcessCommandLine has "systeminfo"ProcessCommandLine has "timeout"ProcessCommandLine has "wget"ProcessCommandLine has "whoami" |
✓ | ✗ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊