KNOTWEED-Domain IOCs

id: db6fe14a-cbe9-4d01-bbef-60b0f1a6624b
name: KNOTWEED-Domain IOCs
description: |
  'This query identifies matches based on domain IOCs related to KNOTWEED against Microsoft Defender for Endpoint device network connections'
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceNetworkEvents
tactics:
relevantTechniques:
query: |
  // c2 domains
  let c2domains = dynamic(["acrobatrelay[.]com","finconsult[.]cc","realmetaldns[.]com"]);
  let iocs = print c2domains
  | mv-expand domains=print_0
  | extend domainioc = replace_string(tostring(domains),"[.]",".")
  | distinct domainioc;
  DeviceNetworkEvents
  | where Timestamp > ago(1d)
  | where RemoteUrl has_any(iocs)