AcroRd-Exploits

Description

The following query look for suspicious behaviors observed by the samples analyzed in the report.

Query · kql

// Search for persistence in Statup folder that's done by Adobe Acrobat Reader.
// Normally, this behavior is not expected.
DeviceFileEvents 
| where
    InitiatingProcessFileName =~ "acrord32.exe"
    and FolderPath contains "\\Start Menu\\Programs\\Startup"  
| project FolderPath, DeviceName, Timestamp, FileName, InitiatingProcessCommandLine, SHA1
Raw source AcroRd-Exploits · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: c87df1a7-fa54-4730-bc90-cbc1f8ac01aa
name: AcroRd-Exploits
description: |
  The following query look for suspicious behaviors observed by the samples analyzed in the report.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
query: |2-
   
  // Search for persistence in Statup folder that's done by Adobe Acrobat Reader.
  // Normally, this behavior is not expected.
  DeviceFileEvents 
  | where
      InitiatingProcessFileName =~ "acrord32.exe"
      and FolderPath contains "\\Start Menu\\Programs\\Startup"  
  | project FolderPath, DeviceName, Timestamp, FileName, InitiatingProcessCommandLine, SHA1

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.