DLLHost.exe file creation via PowerShell

Description

Identify masqueraded DLLHost.exe file created by PowerShell.

Query · kql

DeviceProcessEvents 
| where InitiatingProcessFileName =~ 'powershell.exe' 
| where InitiatingProcessCommandLine has_all('$file=', 'dllhost.exe', 'Invoke-WebRequest', '-OutFile')
Raw source DLLHost.exe file creation via PowerShell · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 361aa11c-c7ad-4ef0-99fd-2ef52ddd2ba6
name: DLLHost.exe file creation via PowerShell
description: |
  Identify masqueraded DLLHost.exe file created by PowerShell.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
query: |   
  DeviceProcessEvents 
  | where InitiatingProcessFileName =~ 'powershell.exe' 
  | where InitiatingProcessCommandLine has_all('$file=', 'dllhost.exe', 'Invoke-WebRequest', '-OutFile')

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.