Shivammalaviya

SecurityEvent 
|  where EventID == 4688 | where ((ParentProcessName endswith @'\scpvss.exe') 
and (NewProcessName endswith @'\vssadmin.exe' or NewProcessName endswith @'\WMIC.exe' or NewProcessName endswith @'\wbadmin.exe' 
or NewProcessName endswith @'\bcdedit.exe'))

Shivammalaviya

let TorRelayData = (
externaldata (Nickname:string,Fingerprint:string,EntryAddress:string,IPAddress:string,Port:string,AddressType:string,Hostname:string,CountryCode:string,IsRunning:bool,RelayPublishDate:string,LastChangedIPData:string)
[h@'https://raw.githubusercontent.com/Shivammalaviya/Tor/main/torexitnodes.csv'] with (ignoreFirstRecord=true,format="csv")
| where AddressType == "IPv4"
);
TorRelayData
| join kind=inner DeviceNetworkEvents on $left.IPAddress == $right.RemoteIP
| join kind=inner (DeviceInfo | distinct DeviceId, PublicIP) on DeviceId
| project Timestamp, DeviceId, LocalPublicIP = PublicIP, LocalIP, RemoteIP, TorIP = IPAddress, Hostname, CountryCode, ActionType, InitiatingProcessFileName, InitiatingProcessFolderPath

Shivammalaviya

externaldata(RemoteIP: string, RemotePort: int, Status: string)
[
"https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.json"
]
with(format="MultiJSON", ingestionMapping='[{"Column":"RemoteIP","Properties":{"Path":"$.ip_address"}}, {"Column":"RemotePort","Properties":{"Path":"$.port"}}, {"Column":"Status","Properties":{"Path":"$.status"}}]')
| where Status == "online"
| join kind=inner DeviceNetworkEvents on RemoteIP, RemotePort

Shivammalaviya

let TorRelayData = (
externaldata (Nickname:string,Fingerprint:string,EntryAddress:string,IPAddress:string,Port:string,AddressType:string,Hostname:string,CountryCode:string,IsRunning:bool,RelayPublishDate:string,LastChangedIPData:string)
[h@'https://torinfo.blob.core.windows.net/public/TorRelayIPs.csv'] with (ignoreFirstRecord=true,format="csv")
| where AddressType == "IPv4"
);
TorRelayData
| join kind=inner DeviceNetworkEvents on $left.IPAddress == $right.RemoteIP
| join kind=inner (DeviceInfo | distinct DeviceId, PublicIP) on DeviceId
| project Timestamp, DeviceId, LocalPublicIP = PublicIP, LocalIP, RemoteIP, TorIP = IPAddress, Hostname, CountryCode, ActionType, InitiatingProcessFileName, InitiatingProcessFolderPath

Shivammalaviya

let CVE202226134 = externaldata(ip:string)[@"https://gist.githubusercontent.com/Shivammalaviya/8529563a6d4dca8a3617b79272d87d68/raw/47eafc8d2038b32a641022ed3dbe8b290dfd24cf/CVE-2022-26134%2520IPs"]
| distinct ip;
CVE202226134
| join (DeviceNetworkEvents
| where ActionType in ("ConnectionSuccess","InboundConnectionAccepted","ConnectionFound")
) 
on $left.ip == $right.RemoteIP
| project Timestamp,LocalIP,RemoteIP,DeviceName,RemoteUrl,InitiatingProcessFileName,ActionType

Shivammalaviya

66.42.41.213
173.255.223.253
81.70.242.26
45.251.241.82
103.200.97.34
108.61.144.67
172.104.82.246
183.194.150.135
195.181.170.209
62.204.41.233

Shivammalaviya

DeviceProcessEvents 
| where (FolderPath endswith @"\msdt.exe" and (ProcessCommandLine contains "IT_RebrowseForFile" 
or ProcessCommandLine contains "IT_BrowseForFile"))

Shivammalaviya

SecurityEvent 
| where (EventID == 4624 and LogonType == "3" and AuthenticationPackageName =~ 'Kerberos' 
and IpAddress =~ '127.0.0.1' and TargetUserSid startswith 'S-1-5-21-' and TargetUserSid endswith '-500')

Shivammalaviya

SecurityEvent 
|  where EventID == 1 
| where (NewProcessName endswith @'\KrbRelayUp.exe' or OriginalFilename =~ 'KrbRelayUp.exe' 
or (CommandLine contains ' relay ' and CommandLine contains ' -Domain ' and CommandLine contains ' -ComputerName ') 
or (CommandLine contains ' krbscm ' and CommandLine contains ' -sc ') or (CommandLine contains ' spawn ' 
and CommandLine contains ' -d ' and CommandLine contains ' -cn ' and CommandLine contains ' -cp '))

Shivammalaviya

DeviceProcessEvents 
| where (FolderPath endswith "javaw.exe" and (ProcessCommandLine contains "-jar" or ProcessCommandLine contains ".jar"))