apt unidentified nov 18 (1)

Description

Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_unidentified_nov_18.yml. Questions via Twitter: @janvonkirchheim.

Query · kql

DeviceFileEvents  
| where Timestamp  > ago(7d)
| where FolderPath has "ds7002.lnk"
| top 100 by Timestamp desc
Raw source apt unidentified nov 18 (1) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 9bff1151-227c-4581-946d-643266c346a6
name: apt unidentified nov 18 (1)
description: |
  Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_unidentified_nov_18.yml.
  Questions via Twitter: @janvonkirchheim.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
query: |
  DeviceFileEvents  
  | where Timestamp  > ago(7d)
  | where FolderPath has "ds7002.lnk"
  | top 100 by Timestamp desc

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.