Judgement Panda exfil activity

id: ae8a5c5d-4cfb-4a59-9adb-eb6c6c219620
name: Judgement Panda exfil activity
description: |
  Original Sigma Rule: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/TA/APT31/proc_creation_win_apt_apt31_judgement_panda.yml
  Questions via Twitter: @janvonkirchheim.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents
  | where Timestamp > ago(7d)
  | where ProcessCommandLine has @"\ldifde.exe -f -n "
       or ProcessCommandLine has @"\7za.exe a 1.7z " 
       or ProcessCommandLine endswith @" eprod.ldf" 
       or ProcessCommandLine has @"\aaaa\procdump64.exe" 
       or ProcessCommandLine has @"\aaaa\netsess.exe" 
       or ProcessCommandLine has @"\aaaa\7za.exe" 
       or ProcessCommandLine has @"copy .\1.7z \" 
       or ProcessCommandLine has @"copy \client\c$\aaaa\" 
       or FolderPath == @"C:\Users\Public\7za.exe"
  | top 100 by Timestamp desc