PSExec Attrib commands

Description

Prior to deploying Macaw ransomware in an organization, adversaries wil use Attrib to display file attribute information on multiple drives and all subfolders.

Query · kql

DeviceProcessEvents 
| where InitiatingProcessParentFileName endswith "PSEXESVC.exe" 
| where InitiatingProcessCommandLine has ".bat" 
| where FileName =~ "cmd.exe" and ProcessCommandLine has_all("-s", "-h", "-r", "-a", "*.*") 
| take 100
Raw source PSExec Attrib commands · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 28f56c18-a66e-4c51-94f6-3c8902cb58af
name: PSExec Attrib commands
description: |
  Prior to deploying Macaw ransomware in an organization, adversaries wil use Attrib to display file attribute information on multiple drives and all subfolders.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Discovery
- Ransomware
query: |
  DeviceProcessEvents 
  | where InitiatingProcessParentFileName endswith "PSEXESVC.exe" 
  | where InitiatingProcessCommandLine has ".bat" 
  | where FileName =~ "cmd.exe" and ProcessCommandLine has_all("-s", "-h", "-r", "-a", "*.*") 
  | take 100

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.