Distribution from remote location

Description

This query checks for alerts related to file drop and remote execution where the file name matches PsExec and similar tools used for distribution

Query · kql

AlertInfo
| where Title == "File dropped and launched from remote location"
| join AlertEvidence on $left.AlertId == $right.AlertId
// Looking for tools involved in potential distribution of ransomware
| where FileName hasprefix "psexe" or (FileName matches regex @"^([a-z0-9]){7}\.exe$" and FileName matches regex "[0-9]{1,5}")
or ProcessCommandLine has "accepteula"
Raw source Distribution from remote location · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 4e070afe-7a9b-4313-a964-c3168fffc1e2
name: Distribution from remote location
description: |
  This query checks for alerts related to file drop and remote execution where the file name matches PsExec and similar tools used for distribution
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - AlertInfo
  - AlertEvidence
tactics:
- Ransomware
query: |
  AlertInfo
  | where Title == "File dropped and launched from remote location"
  | join AlertEvidence on $left.AlertId == $right.AlertId
  // Looking for tools involved in potential distribution of ransomware
  | where FileName hasprefix "psexe" or (FileName matches regex @"^([a-z0-9]){7}\.exe$" and FileName matches regex "[0-9]{1,5}")
  or ProcessCommandLine has "accepteula"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.