Suspicious JScript staging comment

Description

Microsoft has observed attackers who have gained entry to an environment via the Log4J vulnerability utilizing identifiable strings in PowerShell commands.

Query · kql

DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has "VMBlastSG"
Raw source Suspicious JScript staging comment · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 8495c33d-0048-447f-b1e5-27fa5e7f7417
name: Suspicious JScript staging comment
description: |
  Microsoft has observed attackers who have gained entry to an environment via the Log4J vulnerability utilizing identifiable strings in PowerShell commands.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
- Vulnerability
query: |
  DeviceProcessEvents
  | where FileName =~ "powershell.exe"
  | where ProcessCommandLine has "VMBlastSG"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.