KQL Search

Query Details

Rundllwithoutcommandline

Query

Tags:

Query:
DeviceProcessEvents
| where FileName == "rundll32.exe" or ProcessVersionInfoOriginalFileName == @"RUNDLL32.EXE"| where ProcessCommandLine matches regex "^$"

References:

Notes:

Explanation

Sure! Here's a simple summary of the provided KQL (Kusto Query Language) query:

  1. Data Source: The query is looking at DeviceProcessEvents, which is a table containing events related to processes on devices.

  2. File Name Filter: It filters the events to include only those where the FileName is "rundll32.exe" or the ProcessVersionInfoOriginalFileName is "RUNDLL32.EXE".

  3. Command Line Filter: It further filters these events to include only those where the ProcessCommandLine is empty (matches the regex pattern "^$", which represents an empty string).

In summary, this query retrieves events where the process is "rundll32.exe" and the command line used to start the process is empty.

Details

Ali Hussein profile picture

Ali Hussein

Released: October 3, 2023

Tables

DeviceProcessEvents

Keywords

DeviceProcessEvents

Operators

==ormatches regex

Actions

GitHub