KQL Search

Query Details

HomeAI ToolsDevice Query

Smashjacker Appinit DL Lmodifcation

Query

DeviceProcessEvents
| where ProcessVersionInfoFileDescription
 contains "Registry Console Tool" and ProcessCommandLine contains  "AppInit_DLLs"

Explanation

This query is searching through device process events to find instances where:

  1. The description of the process includes the phrase "Registry Console Tool".
  2. The command line used to start the process includes the term "AppInit_DLLs".

In simple terms, it looks for processes related to the Registry Console Tool that were started with a command line containing "AppInit_DLLs".

Details

Ali Hussein profile picture

Ali Hussein

Released: March 20, 2024

Tables

DeviceProcessEvents

Keywords

DeviceProcessEvents

Operators

wherecontains

Actions