Malicious bat file

Description

ZLoader was delivered in a campaign in late summer 2021. This campaign was tweeted by @MsftSecIntel on twitter.

Query · kql

DeviceFileEvents
| where FileName endswith '.bat'
    and FolderPath has @'Program Files (x86)\Sun Technology Network\Oracle Java SE'
Raw source Malicious bat file · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: c903138d-b948-4975-a660-57495b3f8754
name: Malicious bat file
description: |
  ZLoader was delivered in a campaign in late summer 2021. This campaign was tweeted by @MsftSecIntel on twitter.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
tactics:
- Initial access
query: |
  DeviceFileEvents
  | where FileName endswith '.bat'
      and FolderPath has @'Program Files (x86)\Sun Technology Network\Oracle Java SE'

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.