Identify Microsoft Defender Antivirus detection related to EUROPIUM

Description

This query looks for Microsoft Defender Antivirus detections related to EUROPIUM actor

Query · kql

let europium_sigs = dynamic(["BatRunGoXml", "WprJooblash", "Win32/Eagle!MSR", "Win32/Debitom.A"]);  
AlertEvidence 
| where ThreatFamily in~ (europium_sigs) 
| join AlertInfo on AlertId 
| project ThreatFamily, AlertId
Raw source Identify Microsoft Defender Antivirus detection related to EUROPIUM · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: d02275d6-45ba-4ddc-be90-8fa260aebe55
name: Identify Microsoft Defender Antivirus detection related to EUROPIUM
description: |
  This query looks for Microsoft Defender Antivirus detections related to EUROPIUM actor
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - AlertEvidence
tactics:
- Impact
query: |
  let europium_sigs = dynamic(["BatRunGoXml", "WprJooblash", "Win32/Eagle!MSR", "Win32/Debitom.A"]);  
  AlertEvidence 
  | where ThreatFamily in~ (europium_sigs) 
  | join AlertInfo on AlertId 
  | project ThreatFamily, AlertId

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.