Malware_In_recyclebin

Description

Finding attackers hiding malware in the recycle bin. Read more here: https://azure.microsoft.com/blog/how-azure-security-center-helps-reveal-a-cyberattack/. Tags: #execution #SuspiciousPath.

Query · kql

DeviceProcessEvents 
| where Timestamp > ago(7d)
| where FileName in~('cmd.exe','ftp.exe','schtasks.exe','powershell.exe','rundll32.exe','regsvr32.exe','msiexec.exe')
| where ProcessCommandLine contains ":\\recycler"
| project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessFileName
Raw source Malware_In_recyclebin · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 5fa993a8-b9cd-419b-b67a-b783bf7dadbb
name: Malware_In_recyclebin
description: |
  Finding attackers hiding malware in the recycle bin.
  Read more here: https://azure.microsoft.com/blog/how-azure-security-center-helps-reveal-a-cyberattack/.
  Tags: #execution #SuspiciousPath.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents 
  | where Timestamp > ago(7d)
  | where FileName in~('cmd.exe','ftp.exe','schtasks.exe','powershell.exe','rundll32.exe','regsvr32.exe','msiexec.exe')
  | where ProcessCommandLine contains ":\\recycler"
  | project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessFileName

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.