Detection rules › Kusto Query Language

Dev-0270 Malicious Powershell usage

Source
upstream

'DEV-0270 heavily uses powershell to achieve their objective at various stages of their attack. To locate powershell related activity tied to the actor, Microsoft Sentinel customers can run the following query.'

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1562 Impair Defenses
ExfiltrationT1048 Exfiltration Over Alternative Protocol

Event coverage

ProviderEvent IDTitle
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: source

<union>

Stage 2: union

union of 2 branches

Stage 3: extend

Stage 4: extend

Stage 5: extend