Suspicious DLLs in spool Folder

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

Look for the creation of suspicious DLL files spawned in the \spool\ folder along with DLLs that were recently loaded afterwards from \Old.

Attribute	Value
Type	Hunting Query
Solution	Microsoft Defender XDR
ID	0b5b076b-9a1c-440c-a11f-8471a75f46fd
Tactics	PrivilegeEscalation, Execution
Required Connectors	MicrosoftThreatProtection
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Selection Criteria	Transformations	Ingestion API	Lake-Only
DeviceFileEvents	ActionType in "FileCreated,FileRenamed"	✓	✗	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries · Back to Microsoft Defender XDR