Succesfull Exploitationof PD Freaders

Tags: Query: DeviceProcessEvents | where InitiatingProcessFileName in ("AcroRd32.exe","Acrobat.exe","FoxitPhantomPDF.exe","FoxitReader.exe") and FileName in ("arp.exe", "dsquery.exe", "dsget.exe", "gpresult.exe", "hostname.exe", "ipconfig.exe", "nbtstat.exe", "net.exe", "net1.exe", "netsh.exe", "netstat.exe", "nltest.exe", "ping.exe", "qprocess.exe", "quser.exe", "qwinsta.exe", "reg.exe", "sc.exe", "systeminfo.exe", "tasklist.exe", "tracert.exe", "whoami.exe", "bginfo.exe", "cdb.exe", "cmstp.exe", "csi.exe", "dnx.exe", "fsi.exe", "ieexec.exe", "iexpress.exe", "installutil.exe", "Microsoft.Workflow.Compiler.exe", "msbuild.exe", "mshta.exe", "msxsl.exe", "odbcconf.exe", "rcsi.exe", "regsvr32.exe", "xwizard.exe", "atbroker.exe","forfiles.exe", "schtasks.exe", "regasm.exe", "regsvcs.exe", "cmd.exe", "cscript.exe", "powershell.exe", "pwsh.exe", "wmic.exe", "wscript.exe", "bitsadmin.exe", "certutil.exe", "ftp.exe") References:

Explanation

The query is filtering DeviceProcessEvents data based on two conditions. The first condition checks if the InitiatingProcessFileName is one of the specified values ("AcroRd32.exe","Acrobat.exe","FoxitPhantomPDF.exe","FoxitReader.exe"). The second condition checks if the FileName is one of the specified values ("arp.exe", "dsquery.exe", "dsget.exe", "gpresult.exe", "hostname.exe", "ipconfig.exe", "nbtstat.exe", "net.exe", "net1.exe", "netsh.exe", "netstat.exe", "nltest.exe", "ping.exe", "qprocess.exe", "quser.exe", "qwinsta.exe", "reg.exe", "sc.exe", "systeminfo.exe", "tasklist.exe", "tracert.exe", "whoami.exe", "bginfo.exe", "cdb.exe", "cmstp.exe", "csi.exe", "dnx.exe", "fsi.exe", "ieexec.exe", "iexpress.exe", "installutil.exe", "Microsoft.Workflow.Compiler.exe", "msbuild.exe", "mshta.exe", "msxsl.exe", "odbcconf.exe", "rcsi.exe", "regsvr32.exe", "xwizard.exe", "atbroker.exe","forfiles.exe", "schtasks.exe", "regasm.exe", "regsvcs.exe", "cmd.exe", "cscript.exe", "powershell.exe", "pwsh.exe", "wmic.exe", "wscript.exe", "bitsadmin.exe", "certutil.exe", "ftp.exe").

Details

Ali Hussein

Released: September 19, 2023

Tables

DeviceProcessEvents

Keywords

DeviceProcessEvents,InitiatingProcessFileName,FileName,AcroRd32.exe,Acrobat.exe,FoxitPhantomPDF.exe,FoxitReader.exe,arp.exe,dsquery.exe,dsget.exe,gpresult.exe,hostname.exe,ipconfig.exe,nbtstat.exe,net.exe,net1.exe,netsh.exe,netstat.exe,nltest.exe,ping.exe,qprocess.exe,quser.exe,qwinsta.exe,reg.exe,sc.exe,systeminfo.exe,tasklist.exe,tracert.exe,whoami.exe,bginfo.exe,cdb.exe,cmstp.exe,csi.exe,dnx.exe,fsi.exe,ieexec.exe,iexpress.exe,installutil.exe,Microsoft.Workflow.Compiler.exe,msbuild.exe,mshta.exe,msxsl.exe,odbcconf.exe,rcsi.exe,regsvr32.exe,xwizard.exe,atbroker.exe,forfiles.exe,schtasks.exe,regasm.exe,regsvcs.exe,cmd.exe,cscript.exe,powershell.exe,pwsh.exe,wmic.exe,wscript.exe,bitsadmin.exe,certutil.exe,ftp.exe

Operators

|whereinand

KQL Search