MDEH-Potential Lockbit detection

// Basic query to find if mpclient.dll is being run from a non-standard location. 
// This may help detect Lockbit based on Sentile One's writeup at 
// https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/
// The distinct projection can be changed to a standard project, but the noise ratio is awful with too much data returned 
// Written by @SiliconShecky

DeviceFileEvents
| join DeviceFileCertificateInfo on DeviceName //This is for checking if it is a signed version of the dll joined on Device Name for distinct usage
| where Timestamp > ago(7d) // look back over the past week
| where InitiatingProcessFolderPath contains "\\programdata\\microsoft\\windows defender\\platform" // makes sure that the intiating process is in the proper directory
| where InitiatingProcessFileName == "MpCmdRun.exe" and IsSigned // checks to make sure that mpclient is being run
| where FolderPath !contains "\\programdata\\microsoft\\windows defender\\platform" // do not check the normal location for the dll being run
| where FileName contains "mpclient"// checks for the misused dlls.
| distinct DeviceName, Timestamp, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessFolderPath