Permalink
Cannot retrieve contributors at this time
Name already in use
A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Azure-Sentinel/Hunting Queries/Microsoft 365 Defender/Ransomware/DEV-0270/DLLHost.exe WMIC domain discovery.yaml
Go to fileThis commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| id: dc612ff9-88ac-4968-97c1-6789cd48c5d8 | |
| name: DLLHost.exe WMIC domain discovery | |
| description: | | |
| Identify dllhost.exe using WMIC to discover additional hosts and associated domain. | |
| requiredDataConnectors: | |
| - connectorId: MicrosoftThreatProtection | |
| dataTypes: | |
| - DeviceProcessEvents | |
| tactics: | |
| - Reconnaissance | |
| query: | | |
| DeviceProcessEvents | |
| | where InitiatingProcessFileName =~ "dllhost.exe" and InitiatingProcessCommandLine == "dllhost.exe" | |
| | where ProcessCommandLine has "wmic computersystem get domain" |