KQL Search

This query is designed to identify potential security threats by detecting attempts to enable Remote Desktop on a device using a specific command-line tool, "wmic.exe." This technique is commonly used in ransomware attacks after an intruder has gained access to a system. Here's a breakdown of what the query does:

1. Data Source: It looks at events related to processes on devices (DeviceProcessEvents).

2. Filter by File Name: It specifically filters for events where the process involved is "wmic.exe."

3. Filter by Command Line: It further narrows down the results to instances where the command line includes the terms "rdtoggle," "SetAllowTSConnections," and "1." These terms indicate an attempt to enable Remote Desktop connections.

4. Select Specific Information: The query then selects and displays specific details about each detected event, including:

   • Timestamp: When the event occurred.
   • DeviceName: The name of the device where the event was detected.
   • DeviceId: The unique identifier of the device.
   • ReportId: An identifier for the report.
   • ProcessCommandLine: The full command line that was executed.
   • InitiatingProcessCommandLine: The command line of the process that initiated this event.

In summary, this query helps security teams identify suspicious activities related to enabling Remote Desktop, which could be a sign of a ransomware attack in progress.