Dopplepaymer In-Memory Malware Implant

Description

Dopplepaymer In-Memory Malware Implant. This query identifies processes with command line launch strings. Which match the pattern used in Dopplepaymer ransomware attacks.

Query · kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine startswith "-q -s {{" and ProcessCommandLine contains "}} -p "
Raw source Dopplepaymer In-Memory Malware Implant · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: c7927ab6-63c8-41bc-a5d7-fc15826e2b57
name: Dopplepaymer In-Memory Malware Implant
description: |
  Dopplepaymer In-Memory Malware Implant.
  This query identifies processes with command line launch strings.
  Which match the pattern used in Dopplepaymer ransomware attacks.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents
  | where Timestamp > ago(7d)
  | where ProcessCommandLine startswith "-q -s {{" and ProcessCommandLine contains "}} -p "

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.