KNOTWEED-AV Detections

Description

'This query looks for Microsoft Defender Antivirus detections with the family names used by KNOTWEED'

Query · kql

// AV Detections
let knotweed_sigs = dynamic(["JumplumpDropper", "Jumplump", "Corelump", "Mexlib", "Medcerc ", "SuspModuleLoad"]);
AlertEvidence
| where Timestamp > ago(30d)
| where ThreatFamily in~ (knotweed_sigs)
| join MtpAlerts on AlertId
| project OriginalReportOccurrenceTime, LastSeen, MachineId1, ThreatFamily, AlertId
Raw source KNOTWEED-AV Detections · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 24b0f252-08fd-4f70-b387-9015bea1b34c
name: KNOTWEED-AV Detections
description: |
  'This query looks for Microsoft Defender Antivirus detections with the family names used by KNOTWEED'
requiredDataConnectors:
  - connectorId: MicrosoftDefenderAdvancedThreatProtection
    dataTypes:
      - SecurityAlert (MDATP)
tactics:
relevantTechniques:
query: |
  // AV Detections
  let knotweed_sigs = dynamic(["JumplumpDropper", "Jumplump", "Corelump", "Mexlib", "Medcerc ", "SuspModuleLoad"]);
  AlertEvidence
  | where Timestamp > ago(30d)
  | where ThreatFamily in~ (knotweed_sigs)
  | join MtpAlerts on AlertId
  | project OriginalReportOccurrenceTime, LastSeen, MachineId1, ThreatFamily, AlertId

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.