index=activity AND rg_functionality="Endpoint Management Systems" AND (deviceaction = "ProcessRollup2" or deviceaction = "Procstart" or deviceaction = "Childproc" or deviceaction = "Process" or deviceaction = "Process Create" or deviceaction = "Trace Executed Process") AND sourceprocessname ENDS WITH "rundll32.exe" AND (resourcecustomfield1 CONTAINS "..\" AND resourcecustomfield1 CONTAINS "DllRegisterServer")
index=activity AND rg_functionality="Endpoint Management Systems" AND (deviceaction = "ProcessRollup2" or deviceaction = "Procstart" or deviceaction = "Childproc" or deviceaction = "Process" or deviceaction = "Process Create" or deviceaction = "Trace Executed Process") AND destinationprocessname = wmic.exe AND resourcecustomfield1 contains regsvr32 AND resourcecustomfield1 contains "create"
index=activity AND rg_functionality="Endpoint Management Systems" AND (deviceaction = "ProcessRollup2" or deviceaction = "Procstart" or deviceaction = "Childproc" or deviceaction = "Process" or deviceaction = "Process Create" or deviceaction = "Trace Executed Process") AND destinationprocessname = "regsvr32.exe" AND resourcecustomfield1 contains "C:\Users\Public"
index=activity AND rg_functionality="Endpoint Management Systems" AND (deviceaction = "ProcessRollup2" or deviceaction = "Procstart" or deviceaction = "Childproc" or deviceaction = "Process" or deviceaction = "Process Create" or deviceaction = "Trace Executed Process") AND destinationprocessname = "rundll32.exe" AND resourcecustomfield1 contains "licencse.dat"
index=activity AND rg_functionality="Endpoint Management Systems" AND (deviceaction = "ProcessRollup2" or deviceaction = "Procstart" or deviceaction = "Childproc" or deviceaction = "Process" or deviceaction = "Process Create" or deviceaction = "Trace Executed Process") AND destinationprocessname = "wmic.exe" AND resourcecustomfield1 contains "AntiVirusProduct"
index=activity AND rg_functionality="Endpoint Management Systems" AND (deviceaction = "ProcessRollup2" or deviceaction = "Procstart" or deviceaction = "Childproc" or deviceaction = "Process" or deviceaction = "Process Create" or deviceaction = "Trace Executed Process") AND destinationprocessname = "nltest.exe" AND resourcecustomfield1 contains "domain_trusts"
index=activity AND rg_functionality="Endpoint Management Systems" AND (deviceaction = "ProcessRollup2" or deviceaction = "Procstart" or deviceaction = "Childproc" or deviceaction = "Process" or deviceaction = "Process Create" or deviceaction = "Trace Executed Process") AND resourcecustomfield1 contains "objectcategory"
index=activity AND rg_functionality="Endpoint Management Systems" AND (deviceaction = "ProcessRollup2" or deviceaction = "Procstart" or deviceaction = "Childproc" or deviceaction = "Process" or deviceaction = "Process Create" or deviceaction = "Trace Executed Process") AND (resourcecustomfield1 contains "domainlist" OR resourcecustomfield1 contains "dcmodes" OR resourcecustomfield1 contains "adinfo" OR resourcecustomfield1 contains "dclist" OR resourcecustomfield1 contains "computers_pwnotreqd" OR resourcecustomfield1 contains "trustdmp")
index=activity AND rg_functionality="Endpoint Management Systems" AND (deviceaction = "ProcessRollup2" or deviceaction = "Procstart" or deviceaction = "Childproc" or deviceaction = "Process" or deviceaction = "Process Create" or deviceaction = "Trace Executed Process") AND resourcecustomfield1 contains "--no-check-certificate" AND resourcecustomfield1 contains "copy"
index=activity AND rg_functionality="Endpoint Management Systems" AND baseeventid = "1" AND sourceprocessname ENDS WITH "rundll32.exe" AND (resourcecustomfield1 CONTAINS "..\" AND resourcecustomfield1 CONTAINS "DllRegisterServer")
index=activity AND rg_functionality="Endpoint Management Systems" AND baseeventid = "1" AND destinationprocessname = "wmic.exe" AND resourcecustomfield1 contains "regsvr32" AND resourcecustomfield1 contains "create"
index=activity AND rg_functionality="Endpoint Management Systems" AND baseeventid = "1" AND destinationprocessname = "regsvr32.exe" AND resourcecustomfield1 contains "C:\Users\Public"
index=activity AND rg_functionality="Endpoint Management Systems" AND baseeventid = "1" AND destinationprocessname = "rundll32.exe" AND resourcecustomfield1 contains "licencse.dat"
index=activity AND rg_functionality="Endpoint Management Systems" AND baseeventid = "1" AND destinationprocessname = "wmic.exe" AND resourcecustomfield1 contains "AntiVirusProduct"
index=activity AND rg_functionality="Endpoint Management Systems" AND baseeventid = "1" AND destinationprocessname = "net.exe" AND resourcecustomfield1 contains "Domain Admins"
index=activity AND rg_functionality="Endpoint Management Systems" AND baseeventid = "1" AND destinationprocessname = "nltest.exe" AND resourcecustomfield1 contains "domain_trusts"
index=activity AND rg_functionality="Endpoint Management Systems" AND baseeventid = "3" AND destinationprocessname = "wuauclt.exe" AND destinationport = 389
index=activity AND rg_functionality="Endpoint Management Systems" AND baseeventid = "3" AND destinationprocessname = "wuauclt.exe" AND destinationport = 636
index=activity AND rg_functionality="Endpoint Management Systems" AND baseeventid = "11" AND resourcecustomfield5 contains "Bloodhound"
index=activity AND rg_functionality="Endpoint Management Systems" AND baseeventid = "1" AND resourcecustomfield1 contains "objectcategory"
index=activity AND rg_functionality="Endpoint Management Systems" AND baseeventid = "1" AND (resourcecustomfield1 contains "domainlist" OR resourcecustomfield1 contains "dcmodes" OR resourcecustomfield1 contains "adinfo" OR resourcecustomfield1 contains "dclist" OR resourcecustomfield1 contains "computers_pwnotreqd" OR resourcecustomfield1 contains "trustdmp")
index=activity AND rg_functionality="Endpoint Management Systems" AND baseeventid = "1" AND resourcecustomfield1 contains "--no-check-certificate" AND resourcecustomfield1 contains "copy"
