Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
This query detects if an instance of Qakbot has attempted to overwrite its original binary.
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | Microsoft Defender XDR |
| ID | 63ecff0f-3a86-468b-8c9e-a7a88fe33ebb |
| Tactics | DefenseEvasion |
| Required Connectors | MicrosoftThreatProtection |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
DeviceProcessEvents |
InitiatingProcessCommandLine has "-n 6"InitiatingProcessCommandLine has "127.0.0.1"InitiatingProcessCommandLine has "calc.exe"InitiatingProcessFileName == "cmd.exe" |
✓ | ✗ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊