Microsoft Sentinel medium experimental kql

NRT Base64 Encoded Windows Process Command-lines

'This detection identifies instances of a base64 encoded PE file header seen in the process command line parameter.'

View Source

Detection Logic

SecurityEvent
| where EventID == 4688
| where isnotempty(CommandLine)
| where CommandLine contains "TVqQAAMAAAAEAAA"
| extend HostName = tostring(split(Computer, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(Computer, '.'), 1, -1), '.'))

Field Validations

Loading…

Comments (0)

Loading comments...